SMS phishing (smishing) impersonates NZ government agencies, banks, and courier services to steal credentials and financial information. Unlike email phishing, SMS arrives on mobile devices often without security filtering, with no sender authentication, and in a channel people have historically trusted.
CERT NZ's quarterly reports consistently include smishing among the highest-volume reported incidents affecting New Zealand individuals and businesses. In 2023, fake IRD, NZ Post, and ANZ/ASB/BNZ bank SMS messages were distributed in the millions — targeting NZ numbers with convincing messages and local-context links.
Why SMS Is a More Dangerous Channel Than Email
Email phishing is filtered by spam engines, security tools, and increasingly by user training. SMS has none of these protections. There's no SMS equivalent of DMARC — sender phone numbers can be spoofed trivially. Mobile devices don't typically run URL filtering that would flag malicious links before the browser opens them. And SMS as a communication channel has historically carried less scrutiny than email — people have been trained to be suspicious of emails but not SMS messages.
The mobile browser context is also less protective: URL bars on mobile browsers show less of the URL (making lookalike domains harder to spot), and mobile pages are formatted differently, making fake sites easier to make look authentic.
Common NZ Smishing Scenarios
IRD tax refund: "You have a tax refund of $347.80 waiting. Verify your details to receive your refund: [link]" — leads to a convincing IRD-branded page requesting IRD number, bank account details, and identity information.
NZ Post delivery: "Your package could not be delivered. Pay the $3.49 customs fee to release it: [link]" — leads to a page requesting credit card details for the "fee." The fee is trivial to encourage compliance; the card details are then used for larger fraudulent transactions.
Bank security alert: "ANZ Security Alert: Unusual activity detected on your account. Verify now to prevent suspension: [link]" — leads to a bank-branded page capturing internet banking credentials and, in some cases, one-time authentication codes.
Business-targeted smishing: "Your Microsoft 365 subscription payment has failed. Update payment details to maintain access: [link]" — targeting business users on phones enrolled in company Microsoft 365 tenants.
Protections for Business Smishing Risk
For business-targeted smishing (targeting staff mobile devices): mobile device management (Intune) can push web filtering configurations to managed mobile devices, blocking connections to known phishing domains in the mobile browser. Staff training on smishing — knowing that IRD never requests personal details via SMS link, that banks never request credentials via SMS — is the primary human control. The same verification principle applies: if an SMS asks you to act on something, verify by calling the organisation directly using a number from their official website.
SMS phishing works in part because people's defensive instincts haven't caught up with the channel. Treat unexpected SMS messages requesting any action — especially financial action — with the same scepticism as unexpected emails.
