Shifty ANZ email doing the rounds
A phishing email from ingenberg.com is impersonating ANZ and pushing you to click through for supposed credit card verification.
You could receive a plain-looking email with the subject line "update your account", appearing to be about ANZ. It presents itself as a credit card verification request, warns of an issue, and pushes you to click a "CLICK HERE" link to sort it out. The message is simple and direct, which can make it feel routine at a glance.
What gives it away is that the sending domain is ingenberg.com, not ANZ, and it has no established history as a trusted business sender. Even though the email passes normal technical checks, that only shows the sender is authorised to send from ingenberg.com, not that it is genuinely from ANZ. In plain terms, the email can look legitimate to your mail system while still being a fake brand impersonation.
The attacker is trying to get you onto a phishing page where you may be asked for card details, login information, or other sensitive account data. If you click and continue, you could hand over information that can be used for fraud, account access, or follow-up scams against your business.
This campaign has already been observed circulating across multiple NZ organisations in the last day, so treat any ANZ verification email from an unrelated domain as suspicious. If you need to check anything about your bank account or card, go directly to ANZ through your usual app, website, or known phone number.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Look closely at the sender domain on any banking email. If it is not the bank's real domain, treat it as suspicious.
- Do not: Click links or enter card or login details from unsolicited verification emails, even if the message looks clean and professional.
- Check: Verify any supposed banking issue by opening your usual ANZ app, typing the bank website yourself, or calling a trusted number from the official site.
- Report: Send suspicious emails to your IT provider or security team so they can block the sender and check whether anyone engaged with it.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine ANZ Bank NZ message looks like, the real sender domain, the real link destination, and where to report a fake.