TL;DR: In early 2026, Netsafe said unauthorised billing scams, where fraudsters pose as domain, hosting or trusted providers, had taken $58,744 from Kiwis, over $26,500 of it in January alone, and fake website scam reports jumped 35% from February to March. In March, the Domain Name Commission told .nz registrars to warn customers about phishing emails impersonating registrars, asking people to renew via a link or pay a fake invoice. Never renew from an email link: log in to your registrar directly. Individuals can also hide their contact details from the public .nz WHOIS with the IRPO privacy option.
The numbers
From Newstalk ZB (1 April 2026), reporting Netsafe’s figures:
| Scam | 2026 so far (to 1 April) |
|---|---|
| Unauthorised billing (posing as domain, hosting or trusted providers) | $58,744 lost |
| Of which in January | $26,500+ |
| Fake website scams | $5,862 lost; reports up 35%+ February to March |
| Total | Almost $65,000 |
What Netsafe said
Alex Yi, Netsafe’s digital harms services manager: "Scammers are no longer just pretending to be organisations." They’re copying domain names, websites, invoices and account renewals, which are the very things that normally make an organisation look legitimate.
Netsafe described three types:
- Unauthorised billing: fake domain or hosting renewals and invoices from "providers."
- Fake websites and login pages that steal logins and payments.
- Multi-step scams: a social media ad leads to a realistic site, then a phone call or email closes the deal.
Domain renewal emails make perfect bait. Most people renew once a year, by which time nobody remembers who the registrar is. Scammers are counting on that fog.
The Domain Name Commission’s warning
On 6 March 2026, Domain Compare reported that the Domain Name Commission (DNC) had told all .nz registrars to watch for phishing email campaigns impersonating registrars and to pass the warning on to domain holders. Several registrars had reported the emails. They:
- appear to come from a legitimate registrar;
- ask .nz holders to renew their domain by clicking a link;
- may ask you to pay a fraudulent invoice;
- aim to collect payment or login details.
The DNC’s advice: "Always think twice before clicking links in emails, and check the email address of the sender," and "contact your registrar for them to confirm whether it’s genuine or not."
The paper version: "invoices" that aren’t
Not every renewal scam is a phishing link. The DNC has also warned about mailouts from an outfit trading as "Domain Names NZ," which it said wasn’t a known authorised registrar. Its letters, printed to look like an invoice or renewal notice, offered to register a version of your existing name. The DNC pointed out that authorised .nz registrars aren’t allowed to specify a particular domain name in this way, and that "doing nothing will not affect their current domain name."
So if a letter or email looks like an invoice for a domain you don’t recognise, or comes from a company you’ve never dealt with, you can simply ignore it.
How scammers find you: WHOIS
The DNC’s warning notes that .nz contact details are publicly visible through WHOIS unless you’ve applied privacy protection, and "scammers can use this to get your contact email for phishing attempts."
The fix, if you’re an individual, is the Individual Registrant Privacy Option (IRPO). According to the DNC:
- it’s for .nz names registered to individuals not involved in significant trade;
- it hides your address, phone number and email from public WHOIS, and people can still contact you through a message form;
- you ask your registrar to apply it, then check the WHOIS lookup to confirm.
How to spot a fake renewal
- Urgent "renew now or lose your website and email" messages
- An invoice from a provider you don’t recognise, or for a service you don’t use
- Links to log in or pay
- A sender address that doesn’t match your registrar’s real domain
- Slightly wrong web addresses on the payment page
Netsafe’s advice
- Be wary of urgent requests to renew domains, pay invoices or update details.
- Don’t click links in unsolicited emails; go to the official site yourself.
- Check web addresses carefully.
- Turn on multi-factor authentication for important accounts.
- Verify payment requests independently, through a channel you trust.
For small businesses: a 10-minute fix
- Keep a simple list: registrar, host, renewal dates and how each bills you.
- Route all invoices to one person who checks them against that list.
- Never pay from an email link; log in to the provider instead.
- Turn on MFA for your registrar account, because a stolen login can mean a stolen domain (how to recover one).
Australia has the same problem: see fake audit and invoice emails. Phishing lists are often built from breached email addresses. A free exposure check shows if an email address is in breach data.
Frequently Asked Questions
What are unauthorised billing scams?
Scams where fraudsters pose as domain name providers, hosting services or other trusted organisations to collect payments.
How much have Kiwis lost to unauthorised billing scams in 2026?
Netsafe said $58,744 by the start of April 2026, including over $26,500 in January.
Is that .nz domain renewal email real?
Don’t click the link. Log in to your registrar directly or contact them to confirm. The Domain Name Commission warned in March 2026 about phishing emails impersonating registrars.
What happens if I ignore a domain "invoice" letter from a company I don’t know?
The DNC has said that doing nothing will not affect your current domain name.
How do I hide my details from the .nz WHOIS?
If the domain is registered to you as an individual and isn’t used for significant trade, ask your registrar to apply the Individual Registrant Privacy Option (IRPO).
Sources
- Newstalk ZB: Netsafe urges extra checks as wave of sophisticated scams emerges (1 Apr 2026)
- Domain Compare: Domain Name Commission warns of rising phishing scams (6 Mar 2026)
- Domain Name Commission: Individual Registrant Privacy Option
- Domain Name Commission: Domain Names NZ mailouts