IRD & government scams: how to spot them and what to do.

Fake tax refunds, overdue fines, “MyIR login” links, and urgent “verification” messages are designed to rush you into clicking or sharing details. KiwiScan helps you verify the message safely.

Check a message now See red flags What to do next

Common IRD & government scam examples

These patterns are common in NZ texts and emails.

“Tax refund waiting — claim now”

Promises a refund amount and links to a fake “MyIR” or “secure claim” page that steals logins and card details.

Treat “claim refund” links as suspicious until verified in MyIR directly.

“Overdue fine / debt notice”

Threatens penalties or legal action if you don’t pay immediately. Often uses scary words and a payment link.

Urgency + payment link = high-risk combination.

“Verify your identity / update details”

Asks you to confirm identity, banking, or contact details via a link. Scammers use this to harvest personal data.

Never enter personal details from a message link.

IRD & government scam red flags

If you see any of these, pause and verify via official channels.

Suspicious links

Short links or strange domains that don’t match the agency
“myir / verify / login / refund / secure” in the link path
Lookalike spelling (extra dashes, odd endings, misspellings)
Messages pushing you to “tap to view” an urgent notice

Pressure tactics

“Final warning” / “Immediate action required”
Threats of fines, arrest, court, deportation, or account closure
Countdown timers or “today only” language
Attempts to stop you from calling the real agency

Requests for sensitive details

MyIR login/password requests via a link
Requests for OTP codes or “verification codes”
Card details or bank transfer instructions
Asks for photos of ID documents

“Looks official” formatting traps

Official logos copied into emails/SMS
Reference numbers that are meaningless
Professional wording paired with a dodgy link
Sender name says “IRD” but the email address doesn’t match

What to do next

Use the safest path: official apps, typed URLs, and verified contact numbers.

Step 01

Don’t click links in the message

Treat the message as untrusted. Don’t tap links, don’t open attachments, and don’t reply with any details.

If it’s real, you can confirm through official channels without using the message.

Step 02

Verify from a trusted source

Open MyIR from your usual method (app/bookmark/typed URL) and check for messages there. If you need to call, use the official website to find contact details.

Avoid searching the phone number from the SMS — scammers spoof those too.

Step 03

If you entered details or paid

Act fast: contact your bank immediately, change any passwords you used, and watch accounts for unusual activity. If you shared ID details, treat it as identity-risk.

Use the emergency action pages below for step-by-step help.

FAST SAFETY SHORTCUTS

Need immediate steps?

If you clicked a link, paid money, or shared details — these pages walk you through what to do next.

I clicked a link I paid money I shared details

IRD & government scams FAQ

Quick answers to common questions.

How do I know if a tax refund message is real?

Don’t use the message link. Check MyIR through your normal trusted method (app/bookmark/typed URL). If there’s no matching message or notice in your account, treat it as suspicious.

What does KiwiScan treat as HIGH risk?

Any hard indicator: a link/shortlink, a phone/WhatsApp handle, a payment request, a login/OTP request, or install/remote-access instructions. Those are strong scam markers.

What if the message includes a reference number?

Reference numbers are easy to fake. Only trust what you can confirm inside your official account (or via official contact details found from a trusted source).

Not sure if it’s a real IRD message?

Paste it into KiwiScan and get clear next steps in seconds.

SCAN NOW