Security awareness

If you think you’ve been sent a phishing email, here’s what to do next

  • If you haven’t done anything with the email, delete it.
  • If you gave out some personal or financial details:
    • contact us at [email protected] and tell us what happened
    • change the passwords for any online accounts you think might be at risk
    • Enable Multi Factor Authentication if available
  • Review CERT NZ recommendations, keep calm and read on…

Although you can’t prevent a phishing attack, there are things you can do to make sure you recognise one.

  • Know what to look for in a phishing email. You might notice that:
    • you don’t recognise the sender
    • the sender name doesn’t sound quite right
    • you don’t recognise the name of the company
    • the company logo doesn’t look like it should
    • the email refers to you in a generic or odd way — for example, ‘Dear You…’
    • the email contains bad grammar or spelling
    • if you hover over a link in the email with your mouse, the address that you see doesn’t match the place it’s saying it’ll take you.
  • Don’t click on web links sent by someone you don’t know, or that seem out of character for someone you do know. If you’re not sure about something, contact the person you think might have sent it to check first.
  • Use bookmarks or favourites to access websites rather than links in emails.
  • Check to see how the companies you deal with — like your bank — will contact you, so you’re more likely to recognise what’s a legitimate request and what isn’t.
  • If you have your own business, make sure you keep your support contracts (with your antivirus provider or your firewall provider, for example) up to date.

Remember — if you don’t click on any links or attachments in a phishing email, your system is safe.