NZTA registration expiring? This email can't tell you.
Emails circulating across NZ are impersonating NZ Transport Agency and pushing you to renew vehicle registration through a suspicious link.
You get a plain text email with the subject line "dor", appearing to relate to NZ Transport Agency, Waka Kotahi. It presents itself as a Vehicle Registration Notice and urges you to renew your registration online through a single blue link. Even without a polished design, it is built to look routine and official enough that you might click without thinking.
What gives it away is the sender does not line up with the story. The message is coming from chiropractorsolihull.com, which has nothing to do with vehicle licensing in New Zealand, and the mail system could not properly verify that it was authorised to send on behalf of the brand it was imitating. Some technical checks passed, which can make it look more legitimate at first glance, but the overall authentication result still failed, meaning you cannot trust who it claims to be.
The attacker is trying to get you to click and hand over information, most likely through a fake renewal page designed to capture credentials or payment details. If you engage, you could end up giving away login information, business contact details, or card data that can be utilised for further fraud.
This campaign has been observed across multiple Microsoft 365 tenants in the last day, so treat any unexpected registration reminder with caution. If your business manages fleet vehicles or receives government-related notices by email, your staff are more likely to recognise the theme and act quickly unless they stop to verify it first.
The domain the message claims to be from. Fresh registrations and known-bad reputations are the strongest technical tells of a spoofed sender.
Where a reply to this message would actually be delivered. When it differs from the visible From address, an unsuspecting reply lands with the attacker instead.
Practical steps you or your IT provider can take to reduce the risk from this kind of threat.
- Check: Verify any vehicle registration notice by going directly to the official NZ Transport Agency website, not by using links in the email.
- Do not: Click renewal links or enter payment details from unexpected emails, even if the message looks official.
- Check: Look closely at the sender domain and be wary if it has no obvious connection to the organisation it claims to represent.
- Report: Send suspicious messages to your IT provider or security team so they can block similar emails and check whether anyone interacted with them.
- Contact Decision1: If you believe your business has been targeted, contact the Decision1 team immediately.