TL;DR: If your IRD number or myIR account may be compromised, call Inland Revenue (number on its contact page). IRD will verify your identity, set up voice ID to protect your account, check what your IRD number was used for, and help fix false returns or debt. Then talk to IDCARE (free) on 0800 121 068 and report the scam. Didn’t click or share anything? Just report the message to IRD.
If you think you’ve been compromised
From Inland Revenue:
- Call IRD. They will:
- verify your identity;
- set up voice ID to access and protect your account;
- check what your IRD number may have been used for;
- help fix incorrect returns or debt.
- Speak with IDCARE. IRD may transfer you, or call 0800 121 068 (10am–7pm, Mon–Fri). Free help to respond and protect your information.
- Report the scam to the Commerce Commission (instructions on IRD’s page).
Signs your myIR is being misused
IRD’s signs of a scam page lists what to look for in your account:
- a bank account or address in myIR that isn’t yours;
- a notice of assessment for a return you didn’t file;
- an unfiled return showing as filed.
If you use a tax agent, ask them first whether they changed anything. If they didn’t, follow the steps above.
How to tell a real IRD message from a fake
| Real IRD | Scam |
|---|---|
| Texts come from 5678 or 4478 | Any other number |
| No refund links or amounts in emails or texts; log in to myIR yourself | "You’re owed $412.80, claim here" |
| Sites: ird.govt.nz, myir.govt.nz | Lookalike addresses |
| "We will never ask for your password" | Asks for your myIR password |
| Payment only through official methods | Gift cards, Bitcoin, money transfers |
| Social media: Facebook, LinkedIn, YouTube only | DMs asking for details; IRD has no X (Twitter) account |
IRD also says it never uses phrases like "dear citizen" or "NZ Govt Tax Refund". If you see those, you can stop reading.
If you got a suspicious message but didn’t click
Report it via IRD’s "Let us know about a scam" page. Done.
How IRD numbers leak
The usual suspects: fake refund emails linking to a copy of myIR (Kiwibank flagged one in September 2026), fake job onboarding forms, phishing texts, and data breaches. Our IRD refund scam guide has examples.
Tax refunds are the scammer’s favourite bait because nobody ever thinks "free money from IRD" sounds suspicious. It should.
Extra protection steps
- Change your myIR password and any reused passwords.
- Check bank details on your IRD account haven’t been changed.
- Suppress your credit file if ID documents also leaked (how).
- Check your credit report for new accounts (how).
- Report losses to Police (105) and Netsafe.
Where else is your data?
An IRD number rarely leaks alone. A free exposure check shows which breaches your email is in.
Frequently Asked Questions
What number do real IRD texts come from?
IRD says its texts to New Zealand mobiles come from 5678 or 4478. Texts from other numbers are likely scams.
How can I tell if someone is using my myIR account?
Look for a bank account or address that isn’t yours, a notice of assessment for a return you didn’t file, or a return marked filed that you didn’t submit.
What should I do if my IRD number is stolen?
Call Inland Revenue so it can verify your identity, set up voice ID, check how your number was used and fix any false returns. Then contact IDCARE.
What is IDCARE’s NZ phone number?
0800 121 068, 10am to 7pm, Monday to Friday.
What if I received an IRD scam message but didn’t click?
Report it through IRD’s "Let us know about a scam" page.
Can IRD protect my account after a scam?
IRD can set up voice ID to access and protect your account.
Sources
- Inland Revenue: Take action if you've been scammed
- Inland Revenue: Signs of a scam
- Kiwibank: Latest scams (IRD refund scam, Sep 2026)