If you’re not sure what happened, start here. Choose the situation that matches you:
• you clicked a link
• you paid money
• you shared personal details or a code
These pages walk you through the right next steps.
Stop the damage, scan your device, change passwords, and check for follow-up scams.
Contact your bank immediately, secure accounts, and gather details for reporting.
Secure identity, replace cards if needed, and lock down logins + 2FA.
If you’re unsure, follow these in order.
Don’t reply. Don’t click again. Don’t call numbers in the message. Take a breath and verify using official channels only.
Screenshot the message, the sender details, any links, and any payments. Keep transaction refs, account numbers, and timestamps.
Change passwords (unique), enable 2FA, and check for unknown devices/sessions. If banking is involved, contact your bank immediately.
Reporting helps stop repeat scams and can support recovery attempts.
Use the Report a Scam page for NZ reporting channels and step-by-step guidance.
Quick answers to common questions.
No. Replying confirms your number/account is active and can increase follow-up targeting. Block and report instead.
Any hard indicator: a link/shortlink, a phone/WhatsApp handle, a payment request, a login/OTP request, install/download/remote-access prompts, or crypto wallet/transfer instructions.
Report anyway. Scams are designed to work on normal people. Reporting helps others and can support future takedowns.