Payment Fraud Index: New Zealand 2026

Payment Fraud Index: New Zealand 2026

New Zealanders lost NZ$265 million to fraud in the 12 months to October 2025, according to the Payments NZ Reported Fraud Monitor. Business email compromise drove a sharp spike in cybercrime losses, with the NCSC recording a 118% quarter-on-quarter increase in direct financial losses in Q3 2025 as BEC attacks surged. Scams and fraud has been the most reported incident category to the NCSC every quarter since Q4 2024.

The Payment Fraud Index compiles verified payment fraud statistics for New Zealand from authoritative sources including the NCSC, Payments NZ and MBIE. It is updated annually and covers total fraud losses, BEC trends, authorised and unauthorised payment fraud, and what the data means for finance and AP teams.

Payments NZ Reported Fraud Monitor 2025: key findings

New Zealanders lost NZ$265 million to fraud in the 12 months to October 2025.

The figure covers fraud reported across 12 of New Zealand's largest banks and represents the most comprehensive view of payment fraud losses in the New Zealand market.

NZ$126 million of the NZ$265 million total involved authorised payments, where individuals were manipulated into approving the transaction themselves.

Authorised payment fraud is the harder category to defend against because the transaction is technically approved by the account holder. It includes payment redirection fraud, where a supplier's bank details have been changed without the payer's knowledge.

NZ$139 million came from unauthorised transactions, where fraudsters accessed accounts without the account holder's knowledge.

Unauthorised fraud typically involves compromised credentials or card details. While significant in dollar terms, it is the authorised payment fraud category that most directly exposes finance teams, since the payment is made through normal approval channels.

NCSC Cyber Security Insights 2025: key findings

Total direct financial loss reported to the NCSC across 2025 reached NZ$29.1 million.

The annual total masks significant quarterly volatility. Q3 2025 alone accounted for NZ$12.4 million of that figure, driven primarily by a surge in business email compromise attacks.

Direct financial losses reported to the NCSC jumped 118% quarter on quarter, from NZ$5.7 million in Q2 to NZ$12.4 million in Q3 2025.

The NCSC attributed the spike to business email compromise attacks, where bad actors gained access to email accounts and sent fake invoices or changed payment details to redirect payments. BEC was the defining fraud event of Q3 2025 in New Zealand.

Scams and fraud was the most reported NCSC incident category every quarter since Q4 2024.

Consistent top ranking across four consecutive quarters confirms scams and fraud as a structural issue in New Zealand's cybercrime landscape, not a one-off spike.

NZ$7.8 million was lost to cybercrime in Q1 2025, the second-highest quarterly loss ever recorded by the NCSC.

Of the NZ$7.8 million total, NZ$6.5 million was attributed to scams and fraud specifically. The Q1 figure set the tone for a year in which cybercrime losses would reach their highest annual level on record.

Scams involving employment and business opportunities increased 50% in Q3 2025.

The 50% increase in business-opportunity scams in Q3 2025 points to a broadening attack surface beyond traditional invoice and payment redirection fraud, with scammers targeting employees through fake job offers and supplier onboarding processes.

Author

anonymous

Published

22 May 2026

FAQs

New Zealanders lost NZ$265 million to fraud in the 12 months to October 2025, according to the Payments NZ Reported Fraud Monitor, which covers 12 of New Zealand's largest banks. Of that total, NZ$126 million involved authorised payments where victims were manipulated into approving the transaction, and NZ$139 million came from unauthorised transactions. Separately, the NCSC recorded NZ$29.1 million in direct financial losses reported through its cybercrime reporting system across 2025. The two figures measure different reporting populations and should not be combined.

The NCSC attributed the largest quarterly loss spike in its recorded history to BEC. In Q3 2025, direct financial losses jumped 118% quarter on quarter to NZ$12.4 million, with the NCSC specifically citing business email compromise as the driver. BEC attacks in New Zealand follow the same pattern seen globally: a bad actor gains access to or spoofs a legitimate email account and sends fake invoices or changes supplier payment details to redirect funds.

The NCSC recorded NZ$29.1 million in total direct financial losses across 2025, with significant quarterly variation. Q1 2025 saw NZ$7.8 million in losses, the second-highest quarterly figure ever recorded, before losses fell to NZ$5.7 million in Q2. Q3 2025 then spiked to NZ$12.4 million, driven by a surge in BEC attacks. Scams and fraud was the most reported incident category in every quarter since Q4 2024. The NCSC also recorded a 50% increase in scams involving employment and business opportunities in Q3 2025.

From November 2025, New Zealand banks are required to reimburse scam victims for authorised payment losses up to NZ$500,000 under new commitments in the New Zealand Banking Association's Code of Banking Practice. The scheme covers authorised push payment fraud, where a customer was manipulated into approving a payment to a fraudulent account. Reimbursement is subject to the customer having taken reasonable care. The policy represents a significant shift in how fraud liability is allocated between banks and their customers in New Zealand.