CERT NZ Cautions of Rising SIM-Swap and Bank Impersonation Scams

28 October 2026

New Zealand has seen a surge in sophisticated SIM swap and bank impersonation scams, prompting coordinated action from authorities and financial institutions to protect consumers.

CERT NZ, the government's cyber security centre, has elevated its warnings around SIM swap fraud following a string of recent attacks. The agency explains SIM swap attacks, also known as SIM porting or hijacking, as a tactic where criminals convince mobile providers to transfer a victim's phone number to their own SIM card.

Financial losses from successful SIM swap incidents have climbed into the tens of thousands of dollars. Recent reports put the average loss at around NZ$30,000 per incident.

How do SIM swap attacks bring such large paydays for cyber criminals? Once an attacker's SIM receives the victim's calls and texts, that criminal can intercept two-factor authentication sent via SMS, effectively gaining access to online bank accounts or triggering fraudulent money transfers.

CERT NZ's reporting flagged an uptick in SIM swap activity hitting bank customers, including a major SMS phishing campaign. That operation, which compromised thousands of New Zealand phone numbers, highlights how SMS can be weaponized in this type of fraud.

Jaw-Dropping Phish Net 27,000

In late 2019, a mass SMS phishing operation snared 27,000 New Zealand phone numbers, with a significant portion belonging to customers of a major domestic bank. The attackers manufactured urgency by claiming the victims' accounts were compromised, then instructed recipients to click a link or confirm a one-time passcode. Clicking the link opened a phishing page that harvested login credentials.

CERT NZ coordinated a joint response with the targeted bank, New Zealand Police and the Department of Internal Affairs to shut down the SMS phishing campaign.

The department later noted that multi-agency efforts with CERT NZ and other bodies had successfully disrupted scam operations and reduced scam reporting numbers. Financial firms and telcos have since taken practical steps to combat phone spoofing and fraudulent SIM transfers.

Telecos Fortify Against SIM Swap

Telecoms have moved to slow or prevent SIM swaps being used in cyber fraud. Industry reports indicate mobile operators now require customers to visit stores to change SIMs, an inconvenience for legitimate users but a block for fraudsters. Providers also implemented a centralised system to verify number transfers.

The increased level of personal interaction required to manage these functions, combined with enhanced verification, helps to protect customers, according to industry representatives.

Banks have also taken active roles, with one warning customers about rising impersonation fraud. ASB Bank noted that fraudsters pose as banks and trusted brands to deceive customers, and cautioned about phishing via SMS, email and social media.

Ongoing Scam Alerts

Despite successes, CERT NZ remains vigilant, warning about a spike in scam calls spoofing New Zealand banks. In those calls, attackers demanded immediate action to supposedly secure the recipient's accounts, requesting financial data or remote access.

Frequently the con artists triggered SMS alerts on victims' phones, then falsely described the one-time codes as verification measures, tricking victims into reading the code to the attacker, who then used it to transfer funds.

While they specifically targeted banks, CERT NZ noted similar scams had hit cryptocurrency investors and online shoppers.

International authorities have reported similar trends, with Australian financial authorities issuing warnings about SIM swap fraud costing millions in just months.

Expert Advice for SIM Swap Victims

Consumer cybersecurity advisors recommend anyone targeted by SIM swap to take swift protective action. Top steps include contacting their mobile carrier, checking account access and informing relevant authorities like CERT NZ, which assists victims.

Official guidance recommends replacing SMS 2FA with app-based authentication, a more secure method against SIM swap fraud.

The agency encourages New Zealanders to report scams, stay aware of rising fraud tactics, and remain open to security advice from licensed experts.