Every year, thousands of Kiwis are targeted by fraudsters using increasingly clever tactics to impersonate IR, especially around tax return and payment deadlines.

Whether you’re an individual taxpayer, a contractor, or a business owner, you may receive messages that appear legitimate, complete with IR logos, personalised language, and even realistic website links.

But these scams are crafted to trick you into handing over your personal information, your IR number, or direct access to your bank account.

What’s happening

 There’s been a significant rise in scam reports, with phishing attempts via email, SMS, and phone calls all becoming more sophisticated. Some of the most common scams include:

• Emails pretending to offer tax refunds and asking users to click a link to ‘claim now.’
• Texts warning of overdue tax debt and urging immediate payment under threat of legal action.
• Phone calls pretending to be from IR staff, demanding payment via gift cards, crypto, or prepaid debit cards.
• Fake myIR login pages designed to steal credentials and access your financial history.

One of the more recent tactics includes the use of QR codes embedded in scam messages, which when scanned, direct users to fraudulent sites that mimic official government pages. These traps are often difficult to distinguish from the real thing.

Why these scams work

Scammers take advantage of moments when people are already expecting communications from IR around tax season, when GST returns are due, or following changes to payments. They target:

• People who are self-employed or work multiple jobs
• Migrants unfamiliar with how IR communicates
• Students receiving StudyLink payments
• Older adults unfamiliar with digital systems

Even seasoned professionals are falling victim to these increasingly tailored attacks.

Stay protected: Your 3-step defence plan

1. Pause before you respond

Never rush to act on a message that demands urgent payment or login. IR will never pressure you with threats or time limits. If something feels off, trust your instincts.

2. Verify the source

IRD will never:

• Ask for personal details like passwords or bank PINs by email or text.
• Send messages with clickable links to log in or make payments.
• Request payment in unusual ways (e.g. gift cards, crypto).

If you’re unsure, log in to myIR directly by typing the address into your browser and don’t click on links. You can also contact IR directly at 0800 227 774

3. Report suspicious activity

If you receive a suspicious message:

• Forward the email to phishing@ird.govt.nz
• Screenshot text messages and submit them via IRD’s online scam reporting tool
• Let your accountant or tax agent know so they can check your records

By reporting scams, you help protect others too.

How IR really contacts you

IRD may send email or text notifications, but they will:

• Direct you to log into myIR yourself without using links
• Use formal, consistent language
• Include your name or customer ID (not generic greetings)

They will never use social media to ask for documents, payments, or personal details. They also won’t leave threatening voicemails demanding immediate action.

If you’re contacted by someone claiming to be from IR and they seem aggressive, hang up and contact IR directly. You won’t get in trouble for checking first.

Signs of a scam

Here are some red flags to watch for:

• Messages with poor spelling or grammar
• Requests to “verify your account” urgently
• Threats of arrest or account suspension
• Links that don’t lead to “ird.govt.nz”
• Payment requests through untraceable methods

What to do if you’ve been scammed

If you think you’ve shared sensitive information or clicked on a scam link:

1. Immediately log into your myIR account via the official IR website and change your password.
2. Contact your bank to report suspicious transactions.
3. Call IR or your accountant for next steps.
4. Report the incident to CERT NZ at www.cert.govt.nz for support on digital threats.

Early action can make a huge difference in limiting damage.

Final message

Tax scams are not just a personal inconvenience, they’re part of a growing wave of global cybercrime. By staying informed and cautious, you can help stop fraudsters in their tracks.

If in doubt, don’t click. Take your time, verify independently, and report anything suspicious.