Business email compromise in NZ: what to do in the first hour, and how to keep a loan payout safe

Business email compromise in New Zealand usually shows up as a strange phone call. A supplier asks why you emailed new bank details. A customer says they paid the invoice you sent last week, but you never sent one. Or you spot a sent email you did not write.

However you find out, the next hour matters more than the next week. This guide gives you the order to work in, what to check on screen, and what changes if a business loan is partway through.

What is business email compromise, exactly?

Own Your Online, the National Cyber Security Centre’s public advice site, describes it as an attacker getting access to an employee’s email account “without their permission, to carry out attacks or scams” (Own Your Online). The usual way in is a password: weak, reused, leaked in an old data breach, or typed into a fake login page.

Once inside, the attacker rarely makes noise. They read. They learn who you pay, who pays you, and when the big amounts are due. Then they send one well-timed email, from your real address, with new bank details.

It is not a rare problem. In the July to September 2025 quarter, the NCSC said it had “received a number of reports of significant financial losses resulting from business email compromises”, and reported direct losses jumped 118% to $12.4 million (NCSC). In the April to June 2026 quarter, unauthorised access accounted for about $1.3 million, roughly half of all reported direct losses. Just 49 incidents of $10,000 or more made up 91% of the quarter’s losses (NCSC Q2 2026).

Read that last number again. Criminals are not after lots of small payments. They want one big one. A loan payout or a settlement is exactly that.

The first hour: what order do you do things in?

People tend to start with the password. Start with the money instead.

Minutes 0–10: stop any money that is moving

• Has a payment gone out to new bank details in the last few days? Call your bank’s fraud line now. Ask them to contact the receiving bank. Every minute counts, because stolen funds are usually moved on quickly.
• Is a payment queued or scheduled? Cancel or hold it until you have confirmed the account by phone.
• Is a customer about to pay you? Ring your biggest debtors and tell them your bank details have not changed, and to ignore any email that says otherwise.

Minutes 10–25: take the account back

Do this from a device you trust. If you think your own laptop has malware on it, use a different one.

1. Change the email password to a long, new passphrase you have never used anywhere else.
2. Sign out of every session. Most business email services have a “sign out everywhere” or “revoke sessions” option in the security settings. Without it, the attacker can stay logged in on their device.
3. Turn on two-factor authentication, preferably with an authenticator app. If it was already on, check which phones and apps are registered and remove any you do not recognise.
4. Check recovery details. Make sure the backup phone number and backup email address are still yours. Attackers change these so they can reset the password again later.

Minutes 25–40: find the attacker’s hooks

This is the step most people miss, and it is why some businesses get hit twice.

• Forwarding and filter rules. Open your mail settings and look at every rule. A classic attacker rule forwards anything with “invoice”, “payment”, “remittance” or “bank” to an outside address, or quietly moves replies to an obscure folder so you never see the supplier asking questions. Own Your Online’s business guidance specifically warns about rules you did not set up. Delete them.
• Connected apps. Remove any app or add-in that has permission to read your mailbox and that you did not install.
• Sent and deleted items. Scroll back through both. Attackers often delete their sent emails, so check the deleted folder too.
• Other accounts that use this inbox for resets. Your banking, Xero or MYOB, and the domain registrar all send password resets here. Change those passwords and check for recent changes, starting with any edited payee or supplier bank details.

Minutes 40–60: warn the right people, the right way

Phone first, email second. A warning email from a compromised account can look like another trick.

• Suppliers and customers you have emailed recently about money: tell them what happened and that you will never change bank details by email.
• Your accountant or bookkeeper, who may have received fake requests too.
• Your lender, if you have a loan application or facility in progress (more on this below).

If you are partway through a loan with us, the number to ring is the one your specialist gave you on the first call. Not sure where you stand yet? Check your options here once the account is safe. It takes about a minute.

What if a business loan is in the middle of all this?

An online loan is an email-heavy journey. The offer, the e-signing link, the settlement instructions and confirmation of where the money will be paid all travel through your inbox. Here is what each stage needs from you after a compromise.

Where the loan is	What could be targeted	What to do
Enquiry or assessment	Your documents and statements	Tell your lender, ask whether anything was sent to an address you did not use, and re-upload through the secure portal
Offer issued	A fake “updated offer” or fee request	Confirm the offer amount and any fees by phone. Our guide to a fake business lender covers the upfront-fee trick
E-signing	A look-alike signing link	Only open signing links you were told to expect on the phone. See how e-signing should look
Settlement	Your own bank account for the payout, or a creditor’s account	Confirm every account by voice, and ask about Confirmation of Payee results
After payout	A fake “new repayment account”	Repayment details do not change by email. Call to check

The payout is the moment to protect. A lender pays the account it has on file. If an attacker uses your email to “update” that account the day before online settlement, and nobody rings to check, the money can land somewhere else. Agree with your lender, out loud, that bank details for you and any creditors being paid will only be confirmed by phone. Then write it down.

It is also worth asking your lender to note that your email was compromised. That flags any unusual request on the file, and nobody will hold it against you. Lenders see this regularly.

Do you need to report it, and to whom?

The NCSC. Report through the NCSC’s online tool for individuals and small businesses, or call 0800 114 115. The line is free within New Zealand and open 7am to 7pm, Monday to Friday (NCSC). Reporting helps them spot campaigns that are hitting several businesses at once, and they can guide you through the clean-up.

Your bank. Even if no money moved, tell them your email was compromised. They may watch the account more closely.

The Privacy Commissioner, sometimes. If the attacker could see personal information about customers, staff or suppliers, think about whether the Privacy Act 2020 applies. A breach that “has caused (or is likely to cause) anyone serious harm” must be notified to the Commissioner and the affected people “as soon as you are practically able”, through the NotifyUs tool (Office of the Privacy Commissioner). Bank account numbers, IRD numbers and ID documents sitting in an inbox all raise the stakes.

The Police, if money has been lost.

Keep evidence before you tidy up: screenshots of the rogue rules, the fake emails (with full headers if you can export them), sign-in records and a timeline of what you did and when.

A worked example (illustrative)

A Hamilton landscaping business has been approved for a working capital loan. Settlement is booked for Thursday.

On Tuesday afternoon, the owner’s bookkeeper rings. She has received an email, from the owner’s real address, saying the business has “moved banks” and asking her to send the new account number to the lender.

What the owner does:

1. Rings the lender’s specialist on the number saved from the first call. The specialist confirms nothing has changed on the file and notes that only phone confirmation will be accepted from now on.
2. Changes the email password from the office desktop, signs out all sessions and sets up an authenticator app.
3. Finds a rule forwarding anything containing “loan” or “settlement” to an outside address. Screenshots it, then deletes it.
4. Changes the Xero and internet banking passwords and checks that no supplier bank details were edited.
5. Calls the three suppliers emailed most recently, and reports the incident to the NCSC.

Thursday’s settlement goes ahead. The specialist reads the account number back over the phone, the owner confirms it against a bank statement, and the funds land where they should. The delay was zero, because the call came before the money moved.

How do you stop it happening again?

You have already done the hard part. To keep it closed:

• Two-factor authentication on every mailbox, not just yours. Shared inboxes like accounts@ count too.
• A written payment rule: bank details are never changed on the strength of an email. Share it with suppliers and customers.
• A monthly look at forwarding rules and sign-in activity. Five minutes.
• A pre-application access check. Our 30-minute access audit walks through email, banking and accounting software before you connect anything to a loan.

The payment redirection fraud page covers the wider warning signs, and the online loan scams page explains the tricks aimed at borrowers specifically.

Inbox back under control? Here is the next step

A compromised email shakes your confidence in every message that follows. That is a healthy instinct when money is involved, and it is exactly how we work: anything to do with where funds go is confirmed with a real voice, not just an email.

If you need finance, whether to replace money lost to fraud, cover a gap while things settle, or for the plan you had before all this, our enquiry takes about 60 seconds. Asking leaves your credit file alone: there is no credit check when you first enquire. Your details stay with one team. We don’t pass them to a pile of lenders, so no stream of calls from strangers follows. A real lending specialist reads your enquiry, looks at your situation and calls you. Save that number. It is the one you will use to check anything later.

Please answer the form accurately, including roughly what you need and what it is for. Honest detail means the first option we suggest is the right one. Unsecured options typically run from $5,000 to $500,000, and property-secured lending from $20,000 to $5,000,000.

Find out where you stand →