Quick answer
Upload loan documents only through the encrypted portal or link your lender or broker sends after you have spoken with them, never by plain email or messaging apps. Use original PDFs exported from your bank, Inland Revenue or accounting software, name each file clearly, and check the web address before you log in. A genuine portal asks for documents; it never asks for passwords.
Key points
- Use the secure portal link from your specialist, not an email attachment
- Upload original, unedited PDFs straight from the source
- Check the web address and padlock before logging in
- A portal collects documents; it never needs your banking or myIR password
The upload step is where an online loan application collects your most sensitive paperwork: bank statements, tax records, financial reports and identity documents. It is also the step that scammers most like to imitate. A few habits keep it quick and safe.
What does a genuine upload portal look like?
A proper document portal has a few tell-tale features:
- It arrives after a conversation. You spoke with a specialist, they explained what is needed, and then the link came. Not the other way round.
- The web address is right. It uses a domain that matches the lender, broker or a well-known document platform they named on the call.
- It is encrypted. The address starts with https and shows a padlock.
- It asks for documents, not passwords. Nothing on the page should request your internet banking, Xero or myIR login.
- It explains itself. You can see what is requested and why.
If a link arrives out of the blue, pushes you to act fast or asks for a login, stop. Check with the person you spoke to, using a phone number you already have, before uploading anything. The online loan scams page lists the common tricks.
Why not just email the documents?
Email is convenient, but plain email is not designed for sending identity documents and financial records. Messages can sit in multiple inboxes indefinitely, be forwarded by mistake or be intercepted if an account is compromised. Business email compromise is a well-documented route for fraud in New Zealand, and a scammer who gets into an inbox full of statements and licence photos has everything they need. An encrypted portal limits who can see the files and keeps a record of access.
Which files should you upload, and in what format?
| Document | Best format | Where to get it |
|---|---|---|
| Bank statements | PDF, original | Internet banking export |
| GST and income tax summaries | myIR | |
| Profit and loss, balance sheet | Xero, MYOB or your accountant | |
| Aged receivables (for invoice finance) | PDF or CSV | Accounting software |
| Photo ID | Inside the verification app, or clear JPG | Your licence or passport |
| Property details (secured loans) | Rates notice, title, existing mortgage statement |
Use the document upload checklist to build your exact list by loan type. Already know what you need? Start the enquiry and you will get the portal link after your first call.
How should you name and organise files?
Lenders process dozens of files a day. Clear names make yours easy to check and reduce the chance of a “please resend” request:
- “Westpac-business-Apr-Sep-2026.pdf”
- “GST-account-myIR-Sep-2026.pdf”
- “PL-FY2026-Xero.pdf”
- “Director-licence-front.jpg”
One document per file is better than a combined PDF. Do not edit, annotate or crop documents. Lenders run authenticity checks, and an edited bank statement can end an application outright, even when the change was innocent.
What about uploading from a phone?
Fine, with care. Download PDFs from your banking app or myIR to your phone’s files, check they open properly, then upload. Use your mobile data or a trusted network rather than open public Wi-Fi. Keep your phone’s software up to date and protected by a passcode — the same basic advice the National Cyber Security Centre gives every business. Our phone safety checklist covers the rest.
What happens to your documents afterwards?
Under the Privacy Act 2020, an organisation should collect only what it needs, keep it secure, use it for the purpose it was collected and not keep it longer than necessary. You have the right to ask for access to the personal information held about you and to ask for corrections. If the loan does not proceed, ask what will happen to your files.
Worked example (illustrative): a Wellington physiotherapy clinic owner receives an email, apparently from “the lender”, asking her to re-send her licence and statements to a Gmail address because “the portal is down”. She calls the specialist on the number from the first conversation. The portal is fine; the email was fake. Nothing is lost because she checked first.
Are there things you should never upload?
Yes. Never upload passwords, PINs, one-time codes, full card numbers or screenshots of your banking app showing login details. No lender needs those. If a form asks for them, close it.
How do you know an upload actually worked?
A good portal confirms each file as it arrives, showing its name and size. Check the list before you close the page. If a file shows zero bytes or an error, upload it again. Then send your specialist a short message saying what you uploaded, using the channel you already trust. That way nothing sits unnoticed in a folder, and if something is missing you hear about it the same day rather than the following week.
Who should do the uploading?
Whoever holds the original documents. A director can upload their own ID and bank statements; a bookkeeper might upload accounting reports. Keep logins personal rather than sharing one account.
The safe way to start
Every secure application begins with a conversation, and ours begins with a 60-second enquiry. No credit check is run when you send it, your details are not passed to a queue of lenders, and a real specialist reads it before sending you a genuine upload link. Fill it in accurately and you will only be asked for the documents that matter. See if you qualify online.
Frequently asked questions
Is it safe to email my bank statements to a lender?
Plain email is not a secure way to send identity documents or financial records. Use the encrypted upload portal provided, and only after confirming you are dealing with the genuine lender or broker.
What file types should I upload?
PDF is the standard for statements, tax records and reports. Photos of ID should be clear JPG or PNG files, or captured inside the verification app. Avoid screenshots of documents where possible.
Can I upload from my phone?
Yes. Most portals work on mobile. Download the PDFs from your banking or myIR app first, then upload from your phone's files.
What happens to my documents after the loan is decided?
They are kept as long as needed for the purpose they were collected and any legal requirements, then securely destroyed. You can ask what is held about you under the Privacy Act 2020.
I uploaded the wrong file. What should I do?
Tell your specialist straight away so they can remove it, then upload the correct one.