Your BNZ login is fine.
A phishing email is circulating that pretends to be a BNZ security alert and pushes you to verify your account after a blocked login from an unrecognised device.
You could receive an email with the subject line “BNZ Security Alert: Login blocked from unrecognised device (IP 203.0.113.47)”. It appears to be a banking security warning and claims BNZ blocked a login from a Windows 11 device, then urges you to verify now to restore access. The sender domain is diplaasstoep.co.za, which does not match BNZ, but the message is written to feel urgent enough that you act before you think.
What gives it away is that the email does not stand up cleanly as a genuine sender. One of the main authentication checks passed, but the message signing did not, which means parts of the email could not be properly verified as coming from the organisation it claims to be. That matters because criminals often rely on mixed or weak authentication results to slip messages through filters. The sender domain also has no established reputation as a legitimate BNZ sender, so there is no trustworthy history behind it.
The attacker is trying to get your banking credentials by pushing you into a fake verification step. If you click through and enter your details, you could hand over account access, expose your business to fraudulent transactions, or give criminals enough information to target you again with more convincing follow-up scams.
This campaign has already been seen across multiple tenants in the last day, which means it is not a one-off test. If this lands in your inbox, treat it as a live phishing attempt, do not engage with it, and report it straight away.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Look closely at the sender domain before acting on any banking alert. BNZ messages should come from authorised BNZ infrastructure, not an unrelated overseas domain.
- Do not: Click verification links or enter banking credentials from an email claiming your login was blocked. Open your banking site from a saved bookmark or type the address yourself.
- Report: Mark the message as phishing in Microsoft 365 or forward it to your IT provider for review.
- Check: If anyone interacted with the email, review banking access and reset exposed passwords immediately.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.
See what a genuine BNZ message looks like, the real sender domain, the real link destination, and where to report a fake.