In recent years we have unfortunately seen an increase in fraudsters trying to defraud New Zealanders via scam calls and TXTs. Fraudsters can be very sophisticated, so if you think you have received a scam call (or email) you need to report it.

Please remember to never give out personal information if you’re unsure who the caller is - this means do not share your bank account, credit card details, or passwords if you think you may have received a scam call.

When you report a phone or email scam to One NZ, we’ll investigate this and try to block the number or sender if possible.

Phone scams are an industry-wide issue, which all Telcos are trying to combat with the help of our industry association, the Telecommunications Carriers Forum (TCF). For more information, they have a lot of useful information on their website.

What to do if you think you’ve received a scam call

If you get an unexpected phone call that seems strange or suspicious, the best action to take is to:

1. Hang up. Put down the phone - and do not share any personal information with the caller.
2. Call the company. If a caller tells you they are from a particular company, ring the company (find their number online, don’t call back the number they called you from) and alert that company to the call you have just received. They will let you know if it was a legitimate call.
3. Report it to us. Please report a scam or suspected scam to One NZ (if we are your telecommunications provider) so we can investigate the matter and block the number if necessary. The more information you can provide the better, which ideally includes the time, date and phone number that called you.
4. Report it to Netsafe. All scams should also be reported to Netsafe, regardless if it was an internet, phone or other type of scam. Even if you were not tricked by the scam, reporting it can protect others. You can report a scam to Netsafe here.

There are two key ways that fraudsters may attempt to get your phone number. If either happens, please report it to us as soon as possible.

Unauthorised Porting - If your phone has unexpectedly stopped working and is showing “NO SERVICE”, it’s possible that your number has been fraudulently ported to another carrier without your authorisation.

Unauthorised SIM Swap – SIM swapping occurs when a fraudster contacts your telco provider and is able to convince the employee that they are you, using your personal information. The fraudster is then able to port your number from your SIM card to their SIM card. They then receive all calls and TXT messages intended for you.

When you think about all of the information we have linked to our phone numbers (like our bank accounts, email and social media accounts) you can see how easy it would be for a fraudster to take over your identity.

Please immediately report either of these scenarios to:

• Customer Care on 0800 800 021 from any phone or by using our online chat at one.nz/chat
• Your Bank – to prevent unauthorised access to your accounts
• New Zealand Police, once the fraud is confirmed

If you suspect someone has stolen your identity and used it to create a service with us, you could be a victim of identity fraud.

This kind of fraud happens when someone has used your ID or personal information without your permission to sign up a service with One NZ.

Some ways your identity can be stolen:

• You lose your wallet or it is stolen
• Your car or house gets broken into
• Your mail is stolen and that mail contains personal information
• Your computer has been compromised by malware or you have provided personal information to a website you’ve visited in a phishing attack
• Someone you know and who has access to your ID has used it for fraudulent purposes

If you suspect you’ve been a victim of a scam or fraud involving your One NZ account, please complete an online report by following the below link.

Identity Theft Report

If you see transactions from One NZ appear on your bank or credit card statement and you don’t recognise these transactions, contact your bank immediately. Ask them to raise a dispute with One NZ and refund the charges back to you. The bank will then contact One NZ on your behalf.

If you get a TXT about a fantastic deal that asks you to pass it on to others in order to qualify, chances are it's a hoax. And if a TXT message asks for your contact or bank details, it’s probably a criminal scam. Passing it on or replying means you’ll be part of the problem, so it’s best to hit ‘delete’.

We’ll never do a ‘pass it on’ TXT campaign. If we want to let you know about a great offer, we’ll send you a TXT or PXT direct.

How to spot a hoax TXT

It's usually easy to spot a hoax as they fail the ‘Yeah, right’ test. They're usually about a deal that's too good to be true, or an early warning that every mobile in the world is about to blow up or be shut down by a virus, or that you've been randomly selected to win millions of dollars. Yeah, right.

They often try to sound important by using impressive-looking statistics and technical terms, or claiming the story has appeared on a reputable website.

Smishing

Sometimes referred to as smishing (phishing via SMS or TXT), this is a hoax where the fraudster sends TXT messages pretending to be from reputable companies or Government agencies to get you to share personal information. The messages often contain a link to a website. Indicators of a smishing scam:

• Usually begins with a TXT message that looks like it's from a genuine business - like a bank or phone company
• Poor spelling and grammar
• Usually an urgent call to action
• A link to click on, which takes you to a fake website
• Web address may not be in the proper format for the business website
• You’ll be asked for personal details that no credible business or organisation would ever ask for (remember, the company already has your details, they don’t need to ask for it again)

DON’T ✘	DO ✔
Phone that number - you could be charged a lot of money	Take a screen shot
Click on the web link – it could infect your device with a virus	Delete the message
Enter and submit your details into a webform from a link like this. It will lead to your identity being ‘stolen’, which could result in money being taken from your bank accounts	Report this scam

If you receive a phishing TXT, do not reply, do not click on the link and definitely do not provide any of your personal details. A reputable business will never ask you for your PIN or password by TXT.

Where to find out more

View some examples of hoax TXTs that other customers have seen.

Report a scam SMS/TXT to us

Please report any suspected scam or phishing SMS’s to us by using the form below so we can investigate the matter and block the number if necessary.

Report a scam SMS/TXT

We’ve listed below some of the common phone scams.

Report a scam to us

Please report any instances of suspected scam calls to One NZ via the link below (if we are your telecommunications provider) so we can investigate the matter and block the number if necessary. The more information you can provide the better, which ideally includes the time, date and phone number that called you.

Report a Scam Call

• Wangiri (“one ring”) scam

Wangiri calls are missed calls from international numbers you don’t recognise on either a mobile or a landline. Fraudsters making the calls hope you call back, ensuring the call is charged at premium rates, from which the fraudsters profit.

You are not specifically targeted with these types of calls. Fraudsters generate numerous calls to a range of mobile numbers and yours will just happen to be included.

DON’T ✘	DO ✔
Return calls to international numbers that you don’t recognise	Report it to us (if we are your telecommunications provider)

• Telco provider scam: One NZ calling

If you have received a phone call from someone saying they work at One NZ, and have some concerns about whether the call is genuine, do not disclose any personal information or account details, ask for the caller’s name and department and end the call. Call us on our published contact numbers to check on the status of your account and authenticity of the call.

• Technical support scam

These are typically made from a number made to resemble a New Zealand number, but are often generated from overseas. Tech support fraudsters might claim to be from a trusted provider (such as Microsoft) to sell support packages you don’t need and didn’t ask for or, more commonly, to gain access to your computer.

Once you give the fraudster access to your computer, they can steal your personal information in order to commit identity fraud, or some other illegal activity.

If you receive an unexpected phone call, be careful. Ask for their name, end the call and find a published number for the company and ring them back to check on the authenticity of the call.

• Inland Revenue scam

If you receive a call from someone claiming to be from the Inland Revenue Department (IRD), and they’re trying to collect payment over the phone, this caller may be a fraudster. Typically they will demand money and create some urgency. If in doubt, ask for their name, hang up and contact the IRD directly to check on the authenticity of the call.

• Email phishing

One of the most common scams you'll come across online or on your mobile is 'phishing', when a fraudster poses as a legitimate institution to lure you into providing sensitive data such as personally identifiable information.

Indicators of a phishing scam:

• A phishing scam usually begins with an email that looks like it's from a genuine business - like a bank or phone company
• Email addresses are odd. For example, the email appears to be from One NZ, but doesn’t end with @one.nz
• Spelling is often poor and you may not be addressed personally (Dear Sir/Madam instead of your name)
• It might ask for personal details - like usernames, passwords and PINs - and will often ask you to take urgent action
• There's normally a link to click on, which takes you to a fake website. The web address may contain the name of the business but it will not be in the proper format for the business website
• If you click on the link, you’ll then be asked for personal details that no credible business or organisation would ever ask for. Remember that the businesses you’ve signed up with already have your details, so they don’t need to ask for it again
• Never enter and submit your details into a form like this. It will lead to your identity being ‘stolen’, which could result in money being taken from your bank accounts
• Phishing is sometimes done via TXT message – you might be asked to click on a link or call a number. Delete the message, never phone that number (you could be charged a lot of money) and never click on the web link – it could infect your device with a virus
• Some emails come with an attachment. Do not open the attachment as it could contain a virus that could damage your computer.

What to do if you’re being phished

If you receive a phishing email or a TXT, do not reply, do not click on the link and definitely do not provide any of your personal details. A reputable business will never ask you for your PIN or password by TXT or email.

• One NZ bill scam

We’re aware of an email scam sent to unsuspecting New Zealanders, masquerading as a My One NZ bill.

We have blocked, and are continuing to block, URLs contained within this email but we urge customers as well as all online Kiwis to be vigilant and double check emails to ensure the sender is legitimate before clicking on the links.

The scam emails look like a One NZ Bill from the sender: donotreply@one.nz - and takes people who click on the “Pay My Bill” link to a non-One NZ website.

If you receive an email that looks suspicious, please check the sender's address. If you are unsure, please login to your One NZ account and check your account balance.

Where to find out more

View some examples of hoax emails that other customers have seen.

Everyone with an online presence is at risk of being scammed so it is really important that we are all aware of the risks in order to protect ourselves and our families.

Fraudsters reach out to prospective victims via various methods like email, social networking, text messages, phone call scams and instant messaging (e.g. Messenger services with Facebook, Windows Live and Yahoo, Skype, Google Talk, WhatsApp, WeChat).

Report a One NZ scam to us

Please report any instances of suspected scams, which claim to be from or representing One NZ, to us via the form below so we can investigate the matter and block the sender’s URL if necessary. The more information you can provide the better.

Report a suspected online scam

• Fake Facebook pages

We are aware of a current scam where fraudsters impersonate genuine NZ companies by setting up a fake Facebook pages. These often relate to the sale of electronic goods but could be other popular items.

These pages may be advertising goods at a lower than normal retail value, luring victims to pay for goods they will never receive.

Remember, if a deal seems too good to be true, it probably is. If in doubt, contact the main advertised number for the company to check on the promotion’s authenticity.

• Romance scam

Some fraudsters deceive people by pretending to have romantic intentions towards others in order to gain their affection and trust. Fraudsters target people on sites used for social introductions, like dating sites, social networking sites, classified sites, and dating apps. The fraudster typically expresses strong emotions in a short period of time. This lures the victim into the scam and creates an emotional attachment to the fraudster and the victim then feels guilty saying no to the fraudster (who is usually asking for help involving money).

We are aware of fraudsters engaging unsuspecting victims to be “money mules” for them, providing assistance with money laundering and purchasing goods online (with stolen funds) and shipping those goods overseas.

Remember, all scams should be reported to Netsafe regardless if it was an internet, phone or other type of scam. Even if you were not tricked by the scam, reporting it can protect others. Please report a scam to Netsafe here.

One NZ has identified instances of international criminals attempting to gain access to customer voicemail accounts, which could be used to access to apps like WhatsApp. The scammers may then use the messaging app to send spam messages or attempt to scam other users.

Our security teams are working to block these attempts at fraudulent activity and ask customers to remain vigilant and contact us directly if they receive strange or multiple verification messages for their WhatsApp account, or are locked out of their voicemail accounts. We also suggest turning on two-step verification for WhatsApp (available through the app's Settings -> Account menu), which will allow customers to set up a PIN and recovery email address. Customers can also update their Voicemail security by calling Voicemail or dialling 707, selecting option 4 'other settings', and then the change your PIN function.

One NZ’s Top 10 Tips for staying safe online:
Cyber-attacks can impact anyone with an internet or phone connection, whether they’re an individual or a business, so we all need to take steps to protect our data and stay safe online.

1. Back-up your data

In recent years storage has increased in size and decreased in price so backing up your data, both at work and at home, is more accessible than ever. Hackers are not always out to steal your data. Sometimes the end goal is to encrypt or erase it or threaten to do so. Regular backups mean you always have a recovery option so if they encrypt your data, you don’t have to worry.

Top tip: Back-up your data both at a physical location and on the cloud for an extra layer of protection.

2. Keep your devices and apps up to date

Keeping your software and apps up to date is often overlooked, especially on home computers and mobile devices. Software and app developers publish updates on a regular basis with security patches to keep up with the latest security threats. It’s essential that you keep every device updated, including IoT devices like home assistants and wireless speakers. The next time you see a notification to update your software, don’t click ‘Remind me tomorrow’.

Top tip: Turn on automatic updates for your operating system and in your App store.

3. Practice good password management – longer is stronger!

Good password management is essential for online security. It’s fundamental to use strong passwords to prevent them being breached by cyber attacks.

• Choose passwords that are at least eight characters long, using a phrase based on at least 3 random words helps.
• Don’t reuse passwords on multiple sites, if one gets compromised, they all do.
• Your passwords should contain a combination of upper- and lower-case letters and symbols
• Reset your password when you forget it and change them regularly as a general refresh.

Top tip: To make password management easier, use a password management tool or account vault such as LastPass or Password Safe, or save passwords in your browser account (e.g. Chrome)

4. Use multi-factor authentication

Two-factor or multi-factor authentication adds something you ‘have’ to something you ‘know’ in addition to a standard password. With two-factor authentication (2FA), instead of entering your username and password, you will instead be required to complete an additional form of authentication. This could be as simple as a PIN or more complex like an authentication app on your phone. Most mobile devices today have two-factor authentication via a biometric identifier such as a fingerprint or facial recognition. In future, expect iris (eye) recognition to be an additional option on more devices.

Top tip: Using two factor authentication is like having a deadlock as well as a key on your door. Enable it.

5. Install anti-virus protection and host-based Firewall

Anti-virus (AV) protection software is the most prevalent solution to fight malicious attacks. AV software blocks malware and other malicious viruses from compromising your device and data. Use anti-virus software from trusted vendors and only run one AV tool on your device.

Using a host-based firewall is also important when defending your data against malicious attacks. A firewall helps screen out hackers, viruses, and other malicious activity that occurs over the Internet and determines what traffic can access your device.

Top tip: Both Windows and Mac OS X come with built in firewalls so take the time to invest in a trusted anti-virus software for all your devices.

6. Be careful with removable storage drives

Malware can easily be spread through infected flash drives, external hard drives and even smartphones. In the workplace, businesses should have policies to restrict access to removable media devices and scan any device for malware before plugging it into a computer. On particularly sensitive systems, consider disabling removable media altogether. At home, also ensure that your antivirus software will scan any removable media before it connects to your device.

Top tip: Ideally the removable media device should be encrypted, if not ensure any sensitive data is encrypted before being copied to the device.

7. Monitor user accounts and privileges

This applies more in the workplace than at home, however you should be aware of who has access to your device and network (including your home network) and ensure they are secure. In the workplace, employees should only be allowed access to the information they need to do their job. Limit the number of privileged user accounts and monitor user activity. Have a list of all accounts an employee has access to and remove their permissions when they leave the company.

Top tip: Conduct regular access reviews across your network and devices to ensure access is appropriate for your users roles.

8. Embrace training and awareness

Cyber security training and awareness is an essential part in keeping your information and network secure. Workplaces should hold a mandatory cyber security training session for every staff single member and include anyone with access to the network. At home, you should educate yourself around the latest scams and phishing attacks as keeping on top of the latest threats will help to keep your data and devices secure.

Top tip: The more security aware that people are, the stronger the human defence will be.

9. Patch patch patch! Security patches that is

Apply security patches as soon as they are released on all your devices. In the workplace, close critical and high vulnerabilities, and configure systems securely. Prompt patching is essential for effective cyber security. When a new patch is released, attackers will quickly identify the underlying vulnerability in the application and release malware to exploit it. If a criminal hacker can successfully attack before the target patches the vulnerability, there is a high risk of a system being compromised.

Top tip: Always apply the latest security patches promptly.

10. Don’t think it won’t happen to you

Thinking that it will never happen to you is the first step down the rocky road towards a cyber-attack so it’s important to stay vigilant and deploy as many defensive mechanisms as possible to stop potential cyber-attacks to your business or to your personal devices. Do not be the weakest link!

Top tip: Be cyber aware, as cyber criminals do not discriminate.