New Zealand’s scam crisis: Are we falling behind?

We think the companies providing services that scammers use to conduct their scams should face greater liability for scam losses. Doing so would not only provide greater protection for scam victims but also drive innovation in preventing scams in the first place.

We’ve looked at the measures being taken to protect consumers from scams by world leaders in scam protection efforts, Singapore and the United Kingdom, as well as our neighbour Australia to see how New Zealand measures up.

Preventing scammers reaching consumers

Nearly everyone affected by scams agrees it’s better to prevent scams before they happen than to try and recover the money after the event.

Internationally, Singapore is the leader when it comes to cutting off scammers from their victims.

Since October 2022, mobile networks in Singapore have been required to filter the content of text messages for telltale signs of scams, such as malicious links or key words and phrases known to be used by scammers. The introduction of this technology has coincided with a decline in text message-based scams, while scams on other platforms have grown drastically. Text scams in Singapore fell by 39% after filters were made mandatory, while phone and messaging scams grew by 100% and 63% respectively.

Text message scams have declined in Singapore while other methods have grown

Source: Singapore Police Force, Annual Scams and Cybercrime Brief, 2023

Building on this success, in December 2024, Singapore implemented an unprecedented piece of legislation known as the “Shared Responsibility Framework”. The framework applies to phishing scams conducted by text message and spreads responsibility across the chain of the scam. If a mobile network’s anti-scam text filter fails, for example, allowing a scammer to steal money from a victim, the mobile provider can be held liable for the loss.

Australia and the United Kingdom impose no legal requirements on telecommunications companies to filter the content of text messages. But, in both countries, a provider has started offering anti-scam content filtering – Telstra in Australia and EE in the United Kingdom. Since implementing its scam filter in 2021, EE reports it has blocked 281 million texts.

Blocking scams on messaging platforms

Singapore’s experience illustrates a common phenomenon in scam prevention – when one scamming avenue shuts down, scammers adopt other ways to reach people.

In response, Singaporean law enforcement agencies have collaborated with Open Government Products to develop ScamShield. ScamShield is an app designed to detect and block scam phone calls and text messages and allow users to easily report both. Because scammers have migrated to other messaging platforms, they have developed ScamShield Bot, which can be added to WhatsApp and performs a similar role.

Spark and 2degrees provide anti-scam text message filtering in New Zealand

In New Zealand, both Spark and 2degrees launched content filters in 2024, providing their customers with an additional layer of protection from scammers. While this is a welcome development, at present in New Zealand, telecommunication companies continue to have no liability for scams orchestrated on their networks.

Protecting consumers’ money

With scammers constantly developing new methods, it is important that when a scammer does manage to reach a consumer, the consumer’s bank’s infrastructure can identify and prevent the loss of funds.

Confirmation of payee

In New Zealand, a large proportion of scams involves tricking a victim into making a payment to a scammer. Common examples include sending a false invoice or impersonating a family member in distress to request money. These scams are known as authorised push-payment scams because the victim has authorised the payment, even if it’s not going to who they think it is.

Confirmation of payee is a technology-based security measure designed to mitigate this type of scam. It works by alerting people if the name of the payee they think they’re sending money to does not match the name on the bank account.

Confirmation of payee was first used in the Netherlands in 2017, then was adopted by United Kingdom banks in 2019. In both cases, the technology has had a significant impact on scams. As of 2022, in the Netherlands, it led to an 81% decline in the number of fraudulent domestic bank transfers. In the United Kingdom, there was a 35% reduction in authorised push-payment scams over the first year of use when compared with providers not using the service.

Confirmation of payee also drives scammers from services that use it to services that don’t. In the 3 months after it was introduced in the United Kingdom, banks not using the technology experienced a 60% increase in authorised push-payment scams. Later, 2022 research by the United Kingdom’s Lloyds Bank showed that transfers made without using confirmation of payee were up to 100 times more likely to be fraudulent than those made using the technology.

Singapore has a similar system to confirmation of payee that operates on its real-time payments network, while Australian consumers are likely to be covered by confirmation of payee by the end of 2025.

New Zealand has finally caught up

New Zealand’s banks began to roll out confirmation of payee in November 2024 with the process due to be complete by Easter 2025. This is an undoubtedly positive development, but it is instructive of many of our frustrations with New Zealand’s banking sector. You can read more in our online article What you need to know about online banking changes.

In September 2023, the New Zealand Banking Association (NZBA) said that it was instigating an industry-wide confirmation of payee service, before announcing in April 2024 that banks were on track to roll out the technology before the end of the year.

This felt like an incredibly optimistic estimate and was accompanied by some cagey language from NZBA chief executive officer Roger Beaumont, who said, “Rolling out confirmation of payee is not as simple as flicking a switch … It’s difficult to say when the solution will be available for all retail customers until the finer technical details of the solution and an implementation timeline for each bank have been agreed. This work is underway, and we will continue to provide updates as it progresses.”

The industry should be commended for the rapid rollout of confirmation of payee between September 2023 and the end of 2024, but the government should take note: it’s not that the banking industry cannot move fast, it’s that it won’t unless pressure is applied.

New Zealanders’ payments now have a greater level of protection than they did in 2024, but this will be little comfort to the countless scam victims whose losses could have been prevented if confirmation of payee had been implemented sooner.

Faster, smarter payments

Over the past 20 years, there has been a significant push globally to speed up banking processes, with real-time payment networks now allowing customers to make account-to-account transfers to individuals or businesses, 24/7, in real time.

Payments made on these networks are cheaper than using Visa and Mastercard, with their accompanying surcharges, and safer than using a service like POLi, which likely represents a breach of your bank’s terms and conditions. Further, these networks can carry a lot more information within a transaction, and this makes it much easier to identify patterns – such as those associated with a scam – when a payment takes place.

The United Kingdom has had its real-time payments network in place since 2008. Singapore’s has been in place since 2014, with Australia’s launched in 2018.

Instant, data-rich transactions create greater opportunities to spot patterns associated with fraud, offering significant opportunities to make networks more secure, according to Karen Silk, the assistant governor and general manager economics, financial markets and banking at the Reserve Bank of New Zealand. Real-time payments networks are safer, Silk says, “because you’re transferring information and doing verification at the same time as you’re doing the payment itself. It can drive a better, safer experience for consumers.

New Zealand has been left behind by the rest of the world on real-time payments

In a report released by the World Bank Group in 2021, most of Europe, and much of the Americas, Middle East, Asia and Sub-Saharan Africa were listed as having fast payment systems already up and running. New Zealand’s fast payment system was listed as “under development”, alongside those of Georgia, the Maldives and Yemen. You can read more about this in our online article New Zealand left behind by rest of the world on payment technology.

Payments NZ, the bank-owned entity responsible for New Zealand’s payments infrastructure, says that our real-time network should be in place by 2030; that’s 22 years after the United Kingdom’s network was launched and 12 years after Australia’s.

Once a scam has happened: reimbursing victims

Reimbursement is not just about helping victims recover. It's about making banks (and other sectors) liable for losses resulting from scams, incentivising innovation, which can prevent scams happening in the first place.

New Zealand is doing better than Singapore and Australia in this regard, where banks are not obligated to reimburse scam victims for losses. Yet although New Zealand has reimbursement policies, they fall significantly short of those enjoyed by consumers in the United Kingdom, the current world leader in reimbursing scam losses.

Unauthorised access scams

An unauthorised access scam is where someone accesses your bank account without your permission. In the United Kingdom, if someone accesses your account using internet banking, you should be reimbursed for any losses, unless the bank can prove you made the payment or acted fraudulently or with “gross negligence” that goes “beyond ordinary carelessness”.

New Zealand’s rules resemble the United Kingdom’s, with a couple of key distinctions. Firstly, in New Zealand, the threshold for liability is simply “negligence” rather than “gross negligence”. Further, in New Zealand, your bank can refuse to reimburse you if you breach its terms and conditions. In both cases, it’s up to your bank to judge whether you’ve acted negligently or breached terms, and this can be open to interpretation.

In response to these issues, in October 2023, the Banking Ombudsman Scheme released guidance on interpreting words like “allow” and “disclose”, stating that these words imply that a customer knows and intends the consequences of disclosing information.

Authorised push-payment scams

If you are tricked into making a payment directly to a scammer, New Zealand banks have no obligation to reimburse you unless they have missed obvious “red flags”. This is similar to the situation in Singapore and Australia but is in stark contrast to how United Kingdom banks treat push-payment scam victims.

In 2019, following pressure from consumer advocacy groups, the United Kingdom banking industry introduced a voluntary code, setting out when victims of authorised push-payment fraud should be reimbursed. The code led to a drastic increase in reimbursements – from 19% in the first half of 2019 to 69% in the first half of 2023.

This has now been taken further, and since October 2024, all United Kingdom payment service providers are required to reimburse victims of authorised push-payment fraud as long as the victims have not acted fraudulently or with gross negligence. Reimbursement costs will be split between the sending and receiving bank or payment provider, with victims to be reimbursed up to a £85,000 limit (NZ$187,000 at the time of writing) within 5 business days.

This not only gives consumers a vital new layer of protection against scams but, importantly, also provides what the United Kingdom Payment Systems Regulator describes as “a clear financial incentive for payment firms to do everything they can to limit a fraudster’s ability to access the UK banking system.”

In New Zealand, in August 2023, Parliament’s Finance and Expenditure Committee recommended the government urge the NZBA to “update its Code of Banking Practice to offer further measures that help protect consumers from scams and fraudulent activity” and investigate the possibility of a voluntary reimbursement scheme.

The government accepted these recommendations in March 2024. In response, the NZBA said it would review international best practice in this area by September 2024 and would consider updating the Code of Banking Practice.

Taking a holistic approach: cross-sectoral anti-scam centres

There is growing acknowledgement internationally that the problem of scams goes beyond victims and their banks. Leading nations are developing cross-sectoral anti-scam centres – bringing together stakeholders from multiple sectors to collaborate on scam prevention.

In Singapore, an anti-scam command (ASCom), established in March 2022, aims to consolidate anti-scam expertise and resources. Located within the police force, ASCom has partnerships with more than 90 (primarily financial) institutions. Bank and government staff work from the ASCom office, enabling rapid information sharing and account freezing. In the first half of 2023, ASCom froze more than 9,000 bank accounts and recovered about NZ$62.5 million for victims.

Australia launched its National Anti-Scam Centre in July 2023; a “virtual centre” sitting within the Australian Competition and Consumer Commission. The centre was funded by an A$58 million investment from federal government, with representatives on the centre’s advisory body drawn from the financial, digital and telecommunications sectors, as well as consumer advocacy and victim support groups.

Unlike Australia and Singapore, the United Kingdom does not have a centralised anti-scam centre. Instead, there is a patchwork of industry, police and government initiatives. While this represents a more collaborative environment than exists in New Zealand at present, a centralised anti-scam centre, run and funded by the government, would be a preferable model.

New Zealand’s banks have taken steps toward creating a cross-sectoral anti-scam centre, but they have voiced their support for greater government involvement. In September 2023, the NZBA said it would support establishing one similar to Singapore’s, to “provide a centralised and co-ordinated multi-sector approach to fighting scams”.

While the banks have announced their support for an anti-scam centre, repeated requests for government involvement appear to have gone unanswered. In February 2024, when Minister of Commerce and Consumer Affairs Andrew Bayly wrote an open letter to the banking industry, he said he was happy to outline his expectations for the sector but was less forthcoming in offering support to centralise a cross-sectoral approach to scams. In response, the banking industry correctly pointed out that international practice is for the government to own the ecosystem. It’s time for the government to put its money where its mouth is.

New Zealand needs a government-led response on scams

Scams are not a problem for banks to solve on their own, and other fraud-enabling sectors also have a role to play.

Yet, while scammers reach consumers through a host of methods, what’s constant is their efforts to move money from other people’s bank accounts to their own. Improving consumer protection – through robust reimbursement policies that incentivise banks (and others) to develop innovative anti-scam measures – is likely to be the most effective way to stamp out the broadest range of scams.

However, banks are unlikely to innovate on their own. The Commerce Commission’s retail banking market study found New Zealand’s banking industry has traditionally focused on maintaining its profit margins, resulting in an underinvestment in core technologies and low levels of innovation. Left to its own devices, the industry has failed to protect its customers from scams. It should no longer be allowed to dictate the pace of change.

The same is true for social media and the telecommunications industry. To date, these sectors have avoided serious scrutiny, yet there is more they could do to prevent scammers reaching consumers. We believe they should also have to pay up when their services are used to steal money from unsuspecting victims. Again, liability will provide an incentive for innovation.

Given the broad range of actors typically involved in scams, it is clear a centralised response is required. Yet, the government’s scam prevention actions so far have been limited to telling fraud-enabling sectors what to do.

The government became increasingly active in this regard throughout 2024, instructing the banking industry to update its code of practice and asking the telecommunications industry to proactively engage with the banking and digital platform sectors to better combat scams.

While we welcome increased government intervention, we think a more effective response would be to drive the development of a cross-sectoral anti-scam centre and to legislate to increase the liability for banks and other businesses that have not done enough to stop scammers stealing consumers’ money.