Keep safe from scams

This scam sees fraudsters target victims by using Apple’s iMessage or Google Android’s RCS messaging services to send phishing messages.

These messages show up just like a text message, but come through from an email address rather than a mobile phone number.

The subject of these messages is often around package deliveries from NZ Post, but could evolve to impersonate other reputable companies. 

If you receive a message like this, you should not select any links. To help combat these messages, please report them to the DIA by forwarding it to 7726. This reporting service is free of charge. 

This scam sees a fraudster pose as someone from the IRD and
claim you have a tax refund to collect.

It asks you to click a link in order to do this. This is not a legitimate text and you should not click the link provided. 

Flubot is a malware disguised as an application or update. If downloaded it can gain access to certain functions on your handset. The malware is mainly being spread by scam text messages, the content of which is changing all the time.

This is not a genuine text message, and the app is suspected to be a form of malware, known as "Flubot". Learn about malware here: https://s.spark.co.nz/2WmzYyj

Please do not click on the link, text, or call the number back, and refrain from downloading any apps that don’t come directly from the Apple or Google App store.

If you think you’ve already downloaded this app, we encourage you to perform a factory reset on your phone ASAP. If you have logged in to any accounts or apps using a password since downloading the app, you must change that account password. If you have used these same passwords for any other accounts, then these also need to be changed.

To report the scam forward the text message directly to the DIA on 7726.

For more information, visit https://www.spark.co.nz/help/scams-safety/flubot

This scam is sent from a mobile number (usually beginning with 022) claiming to be Spark. It falsely advises that the payment for your latest bill couldn’t be processed by your bank. It then invites you to click a link and update your details. 

This is not a legitimate text message from Spark. If you receive a message like this, do not open the link.

Posted 17 June 2020

Scammers may try to use the coronavirus (COVID-19) pandemic to scam you or steal sensitive information.

Coronavirus-related text scams may include a text message with a link that claims to direct you to coronavirus testing facilities.

If you see a suspicious text message, do not click on any links or reply to the message. Instead, you can report it to [email protected] and we will work to block it.

Posted 2 April 2020

This scam is a text message from a four-digit number or a standard NZ or AUS mobile number.

The message says the company has tried to deliver a parcel to a customer’s address. The message provides a fake tracking number and includes a URL to a page asking for the tracking number. This then leads to another website claiming that the status of the package is pending and that the delivery fee has not been paid.

The aim of the scammer is to convince the customer to enter their personal and financial information to exploit you for financial gain. Do not open the link.

Posted 12 September 2019, updated 11 December 2020

• This scam sees fraudsters pretending to be from Spark contact you and offer you exceptional discounts or deals.

• Please remember to never share your personal account details with someone who calls you out of the blue. Never share account information, instead, hang up and contact Spark using our publicly listed contact information.
  

Scammers may try to use the coronavirus (COVID-19) pandemic to scam you. Some coronavirus-related phone scams are circulating, including:

• cold calls with fake investment opportunities in things like pharmaceuticals
• pre-recorded voicemails where scammers pretend to be health professionals and claim they have your positive coronavirus test results, saying you need to share your credit card details with them so they can send you medication
  

This scam is when you get a call and the caller says they're from a trusted organisation like Spark, another telecommunications company or Microsoft. The caller will usually say something like one or more of the following:

• There's a problem with your phone, internet or computer
• They’ve received a report that you’re experiencing slow internet
• They understand you’ve had Fibre installed and they’d like to run some tests
• That they need you to update your information with them
• That Spark has had an internal breach which means your modem, email or device has been hacked

The caller may also use scare tactics to create a sense of urgency. For example, "you must pay your account now or you'll lose connection immediately".  

Once the scammer has your attention, they'll often ask you to log on to your computer and download an application (for example, "TeamViewer" or "AweSun"). This app lets them access your computer. The scammer will then show you what they claim are problems and they'll say they can resolve the problems for a fee.  

Sometimes they might ask you to do a bank transfer or credit card payment to pay for these services. If neither option is available, they'll ask you to go to Western Union to make a payment. Or, they might ask you to pay in iTunes vouchers.  

There's been instances of scammers transferring victims to the "Police Cyber Crime Unit" after saying they're the subject of identity theft through their emails.  Victims are then told that the police need their help to set up a "trap to catch the criminals". They're convinced to withdraw large sums of money to post to an address, or to deposit it to an account. 

Sometimes, instead of a real person on the line, scammers will use a pre-recorded message pretending to be from Spark or other large organisations such as banks.

If the call claims to come from Spark, the message will often threaten to disconnect your broadband. It may then tell you to press a number on your keypad to speak to an operator. This would then redirect you to a scammer.

If the call claims to come from a bank, they may also ask you to press a number on your keypad or to call back what may look like a local number. If the receiver does so, they'll be put through to the bank’s supposed "anti-fraud" department. They may use various tactics to extort money, including asking you to help catch international criminals or claiming there's been fraudulent activity on your account.

These are not legitimate calls. If you receive a call like this, hang up immediately.

This scam is when you receive a call and the caller says they're from the government grants department.

They say that because you're such a good citizen, you're going to receive a sum of money. They say that to receive the money, you must pay a sum of money first. Then, you're asked to do a bank transfer or credit card payment. After transferring the money, you don't receive any payment.  

This scam is when you receive a call where the caller says they're from FedEx. The caller says they have a parcel to deliver to a named person. If the parcel's for another member of the household, the caller will ask for their mobile number.  

Shortly after, the person who answered the call about the parcel will receive a second call. This second call will have a falsified caller ID. This means it shows up as the number of the household member whose number was provided in the first call. The scammer will this time say they're from the New Zealand Police or the Federal Police and that the household member is in police custody due to them being an illegal immigrant.

The caller threatens legal action and demands money to release the household member, requesting payment by one of the following methods: 

• Credit card/bank card information
• Bank transfers
• Western Union transfers
• Payments made by iTunes vouchers

This scam is when you receive a call from an international number, usually to your mobile phone. They will say they know you've expressed interest in investment opportunities or online trading. This scam can include silent calls from +44 and other international country codes. Silent calls are when there's no response after answering the call. Don't try to call the number back as you may be charged.

Sometimes scammers will make bulk calls from overseas using a premium service and hang up after only one or two rings. They do this hoping you'll call back. If you do, you'll be charged premium rates and the scammer will collect the money. These calls are usually made to mobile phones from an 0900 number.

Often scammers use what’s called robo-dialling to carry out phone scamming activity. Robo-dialling is a system that calls a list of numbers collected from various places like the phone book or dark web. If someone answers, the scammer is prompted to start talking.

If no one answers, the system may leave a silent message and you'll be charged international rates if you call the number back. It's best to avoid returning calls from international numbers you don't recognise. Wait for them to leave a voicemail message or contact you another way. If you have family, friends or colleagues who are overseas, save their number.

Spark offers a product that can prevent these types of calls from coming through to you. It's called Call Screen. The Call Screen home phone can help by prompting callers with unsaved numbers to leave their name. Until they do, your phone will not ring. Robo-dialling systems can't leave a name, so the phone won't ring.

You can find more information about Call Screen at spark.co.nz/callscreen

This scam is when someone receives an call from what looks like a local number. When the person picks up the phone they hear a pre-recorded message in Chinese. It says they're calling from the Chinese embassy and asks people to press two to hear a message from them.  

This scam targets the Chinese community. The call connects to the fake embassy and is then transferred to someone pretending to be from the Chinese police. The goal of the caller is to get passport and bank account details.

请广大客户小心提防最近的一些中文诈骗电话. 此类电话经常伪装成新西兰本地座机号码. 当接听时会有一段提前录制的中文语音留言并自称是“中国大使馆”或“领事馆”等官方机构打来. 留言会让接听者按“2”听余下留言.

此类诈骗电话专门针对新西兰本地华人社团, 并欺骗或有时威胁接听者“中国警方”会和他们联系. 诈骗者会借次机会骗取接听者的护照或银行账号和密码信息.

如果你接到此类诈骗电话, 可以选择立即挂断或者把号码加入黑名单. 如果你是客户请给我们发邮件([email protected])或向政府网络安全部门Netsafe报告此类诈骗电话

如果你不慎向诈骗者透漏你的个人信息或密码, 请马上重置你的密码.

如果你不慎向诈骗者透漏你的银行信息, 请立即通知你的银行.

We’re aware of a scam email that claims to be from Spark.co.nz. It says that you have no more access to your Spark account and to follow a link to recover your account.

These are not legitimate communications from Spark and we strongly encourage you not to click on any links in the email if you receive one. 

Posted 1 May 2023

We’re aware of a scam email that claims to be from Spark.co.nz. It says that you have an unread voicemail. A screenshot of the email is below.

These are not legitimate communications from Spark and we strongly encourage you not to click on any links in the email if you receive one. 

Posted 2 September 2020

We’re aware of a scam email that asks people pay their Spark bill. A screenshot of the fake email is below.

These are not legitimate communications from Spark and we strongly encourage you not to click on any links in the email if you receive one. 

If you're not sure whether your Spark bill is genuine, here are some key things to look for:

• The due date on the Spark Bill will always be approximately 14 days from the receipt of the bill. In this instance, the due date is one day away which indicates that the bill is not genuine.
• The account number will always be your account number. If the number in the email is different from your account number, this would indicate that the bill is not genuine.
• The amount owing will always match the amount shown on your Spark app and in MySpark. If the amount in the email is different, this indicates that the bill is not genuine.

Always check your Spark app or MySpark to verify your due date, account number, and actual amount owing.

Updated 2 July 2020

Scammers may try to use the coronavirus (COVID-19) pandemic to scam you or steal sensitive information. If you see a suspicious email, do not click on any links or open any attachments. If you receive an email like the ones below, report it to your email provider then delete the email.

Some coronavirus-related email scams include the following:

1. An email claiming to be from the Ministry of Education (MOE) or health agency with advice related to the virus. These emails may have links and/or attachments which suggest that you can see further information. These links and attachments actually install malicious software (malware) that's designed to steal personal information from your device.
2. An email in which the scammer threatens to infect you and your family with coronavirus if you don’t pay a ransom.
3. An email in which you're invited to download a "coronavirus map" application. It actually installs malicious software (malware) that's designed to steal personal information from your device.
   
4. An email claiming to be from the World Health Organisation (WHO) with "COVID-19" in the subject line. The scammer requests the recipient to donate to the WHO COVID-19 Response Fund using their digital wallet. This is not legitimate communication from WHO.
   
5. An email claiming to be from Spark with the subject line "We wish you an entertaining quarantine". It's offering a 12-month free streaming service to keep people entertained while in quarantine. This is not legitimate communication from Spark. See example screenshot below:

Updated 30 March 2020

This scam appears to come from Xtramail/Spark. It claims that the storage in your email account has been limited and so your account has been temporarily suspended. The email asks you to open a link called "Click here to regain access". It opens a page that asks you to log in and verify your personal details.

This is not legitimate communication from Spark or Xtramail. If you receive an email like this, do not click on the link.

• From: Xtramail <[email protected]>
• Subject line: Confirm your email storage
• Content: Spark NZ logo with alt text "Comcast" and the text, "Just to let you know that we noticed that the storage of your email account is being limited during our regular update today."
  
• See screenshot below:

This scam email asks you to confirm your Spark ID by clicking on a link called "Verify my Spark ID username".

This is not legitimate communication from Spark. It's a scam aimed at getting your personal information.

Do not click on the link in the email.

• From: Spark
• Subject line: Confirm your Spark ID
• Content: Purple banner with the text "Your privacy made clearer" and the text "Due to Spark New Zealand security and anti-fraud regulations, users must provide proof of identification in order to continue to use our services, just click on the link below."

Posted 19 February 2020

This scam is an email or pop-up that looks like it's from Spark. It might tell people that they've been chosen to be a part of a yearly draw and get a free prize as thanks for being a loyal Spark customer or that they’re among 100 users selected as part of Spark’s loyalty program. They may claim to have smartphones, Countdown gift cards and iPhones up for grabs. All you have to do is answer some anonymous questions for a customer survey.

The aim of this scam is to get personal information about you. Scammers then use this information to make targeted scam calls.

Xtra Mail customers receive an email that looks like a Spark NZ bill. It prompts you to view your bill and pay through a link. The link will direct you to a website that asks you to enter your personal information.

This scam can occur on any email platform, not only Xtra Mail. It usually only occurs if a scammer has gained access to your email because they have your login details.

Once the scammer has gained access to your email, they set up an auto-forwarding rule which sends a copy of all the emails you receive to a different email account.

The scammer then monitors your emails to understand more about you and what you're up to. They use this information to send you fraudulent emails and requests for money. For example, they might send a fake invoice that looks like a bill you're expecting, but it will have different bank payment details.

If you pay this invoice, the scammers will move your money offshore very fast. The Police and your bank may find it difficult to reclaim that money.

If Spark becomes aware your Xtra Mail account has had unauthorised access we'll:

• Reset your Xtra Mail password
• Remove any auto-forwarding rules and notify you

It’s often hard to track this kind of activity. It’s important to be very wary of any previous or future requests for large sums of money.

• If you receive any large invoices it's a good idea to call the business to double check it's genuine and the account details are correct before you pay
• Call the business on the phone number you have recorded for them or look it up on their website or in the phone book. Don't call the phone number on the email as it likely belongs to the scammer.

If you think someone has accessed your email account:

• Follow the instructions on this page to report the scam. Report a scam
• Find tips on how to keep your account secure going forward. Keep my email secure
• Find out more information on this scam on the Netsafe website. Visit Netsafe website

This scam involves receiving a fake account update via email. It asks you to upgrade your service or your account will be closed.

• From: Spark Notice
• Subject line: *Action required: Reset your Spark account*

Posted 31 October 2019

This scam appears to come from Spark’s support team. It claims you’ve requested a password reset and asks you to sign in to confirm. The link included in the message appears to be genuine, but instead directs you to a fake page.

• From: Spark Support <[email protected]>
• Subject line: Password Change Confirmation

To safely reset your Xtra email password, type spark.co.nz/xtramail into your web browser and select Can’t sign in.

This scam attempts to blackmail recipients to pay money or risk having their personal details exposed to family and friends. The scammer claims to have installed malware on the recipient’s device and has accessed their password as well as potentially embarrassing footage.

In an attempt to make the email more believable, the scammer will include an old password. The scammer obtains these passwords through historic breaches from other organisations.

We’re aware of a scam email that asks people to recover their Xtra Mail account and update their billing information due to the account being inactive. The email asks you to open a link called ‘Recover Now’. A screenshot of the fake email is below.

These are not legitimate communications from Spark or Xtra Mail and we strongly encourage you not to click on any links in the email if you receive one. 

• From: SPARK REMINDER [email protected]
• Subject: Recover your account!
  

We’re aware of a scam email that asks people to log into their Xtra Mail account to upgrade their storage which has been exceeded. The email asks you to open a link called ‘Verify Now’. A screenshot of the fake email is below.

These are not legitimate communications from Spark or Xtra Mail and we strongly encourage you not to click on any links in the email if  you receive one. 

• From: Xtramail [email protected]
• Subject: Alert Xtramail: Renew your storage