Why scam texts work on busy people
Text messages feel personal and urgent in a way email doesn't. People read them within seconds, often while walking, driving or between meetings, and a phone screen shows very little of the real link. Scammers know that a message saying a parcel is held, a toll is unpaid or an account has been locked will get a quick tap from someone who is half paying attention.
Work phones add a twist. Staff use them for multi-factor sign-in codes, company email and banking apps, so a scam text that captures a password or a code can open a door to the business, not just to someone's personal accounts. A single tap on a fake login page from a work phone can be the start of a mailbox takeover.
The common scam texts in New Zealand
Delivery scams are the most familiar: a courier or NZ Post lookalike says a parcel couldn't be delivered and asks for a small redelivery fee. Others pretend to be from Waka Kotahi about unpaid tolls, IRD about a refund, a bank about a suspicious payment, or a mobile carrier about an expiring plan. Each one leads to a page that asks for card details, a login or a code.
A growing group targets staff directly. 'Hi, it's [owner's name], this is my new number, can you help me with something urgent?' is the opening line of many boss impersonation and gift card scams. Another pretends to be the IT team or Microsoft, warning that a work password is about to expire and offering a link to keep it.
How to tell a scam text from a real one
Look at the link. Genuine organisations rarely send links in texts asking you to pay or sign in, and when they do, the address is their normal domain. Scam links use odd domains, long strings of random characters, URL shorteners, or a real brand name buried in the middle of a different address. If you have to think hard about whether a link is genuine, don't use it.
Look at the request as well. Paying a small fee, confirming card details, entering a one-time code, or replying with personal information are all requests to treat with suspicion. Real banks in NZ say they will never ask you to share a one-time code, and that is a good rule to apply to every organisation.
What staff should do with a suspicious text
Don't tap the link and don't reply, not even with STOP, which confirms the number is active. If the message claims to be from an organisation you deal with, open its official app or type its website address yourself to check. If it claims to be from a colleague, call them on the number already saved in your contacts.
Forward scam texts to the Department of Internal Affairs free spam-text reporting service, which helps carriers block the sender, then delete the message. Let your manager or IT contact know too, particularly if the text mentioned the business by name or used a colleague's name, because others in the team are probably getting the same message.
Setting up work phones to reduce the risk
Keep work phones on the latest operating system, since updates fix the browser and messaging flaws scammers use. If the business manages its phones through a device management service, it can enforce a screen lock, block unknown app installs and wipe a lost device. Encourage staff to use an authenticator app for multi-factor sign-in rather than text codes where they can. Most carriers and phone makers now offer spam filtering for messages; make sure it's switched on. It won't catch everything, but it removes a good share of the obvious ones and leaves staff to deal with fewer, more convincing messages.
If someone tapped a link or entered details
If a staff member entered a work password on a page they reached from a text, change that password immediately from a different device and sign the account out of all sessions. If they entered card details, call the bank to cancel the card. If they typed in a one-time code, assume someone has used it and check the account for recent sign-ins and changes. Make reporting easy and blame-free. A staff member who says 'I think I just tapped something dodgy' within five minutes gives you a far better outcome than one who stays quiet out of embarrassment. Say thank you, fix the problem, and move on.
Keeping the team's awareness fresh
Scam texts change with the news. Around Christmas they lean on parcel deliveries, in tax season they mention IRD refunds, and after a well-publicised data breach they pretend to offer help to affected customers. A two-minute mention at a team meeting when a new wave starts does more than an annual training session that people have forgotten by the following week. Encourage staff to share screenshots of scam texts they receive in a team chat channel set up for the purpose. Seeing real examples from colleagues keeps everyone alert, and it quickly shows whether the business itself is being targeted by name.
In short
- Never act on a link in an unexpected text; go to the app or website yourself.
- Never share a one-time code with anyone who contacts you.
- Confirm 'new number' messages from colleagues by calling their saved number.
- Forward scam texts to the DIA spam-text service, then delete them.
- If someone tapped and typed, change passwords and check the account straight away.