A sophisticated smishing scam using technology never before seen in New Zealand has been disrupted in a coordinated, multi-agency effort, preventing widescale financial losses.
The Department of Internal Affairs (DIA) Digital Messaging and Systems Team was alerted to the scam in late July after irregularities were identified between information received via DIA's 7726 public reporting system and banking and mobile network early warning systems.
Police and DIA, supported by other government agencies, the banking and mobile phone sectors as well as Australia's AFP-led Joint Policing Cybercrime Coordination Centre, quickly launched Operation Orca.
A search warrant was executed at a residential address in central Auckland on Friday 23 August, resulting in the arrest of a 19-year-old man and the seizure of a smishing device.
The device, known as an SMS Blaster, is a false cell tower which tricks nearby mobile devices into connecting to a fraudulent network.
Smishing, which is a form of phishing, involves the SMS Blaster sending fraudulent text messages purporting to be from banks to trick people into sharing or verifying sensitive information, such as passwords or credit card details.
Police National Organised Crime Group Director Detective Superintendent Greg Williams says this is the first time an SMS Blaster has been found operating in New Zealand.
"By working together, we have been able to counter this technology, locate the alleged offender and prevent what could have been large-scale financial losses for many New Zealanders.
"The device in question is believed to have sent thousands of scam text messages, including around 700 in one night.
"The text claimed the recipient's bank account was being checked for fraudulent funds and urged them to click a verification link.
"This redirected the recipient to phishing sites, imitating official bank domains, where unsuspecting customers then entered their personal details, including customer ID and password.
"Almost 120 people are known to have been affected, however, I'm pleased to say no financial losses have been reported.
"Cyber-enabled scams are becoming increasingly prevalent, with unscrupulous fraudsters stopping at nothing in their attempts to swindle innocent people out of their hard-earned money.
"NZ Police recognise the life-changing impact of financial crime and will continue to work closely with partner agencies and private industries to keep New Zealanders safe."
DIA Manager Digital Messaging Joe Teo says this operation is a great example of government and industry working in fast-paced unison to achieve a single goal, protecting New Zealanders.
"We will continue to work closely with our domestic and international partners to combat the spread of harmful SMS messages.
"If you receive a scam SMS text message, please report it free of charge by forwarding the message to 7726 and following the prompts."
Telecommunications Forum CEO Paul Brislen says the speed of the response is good news for consumers.
"By working closely with banking and law enforcement we were able to identify and react quickly to this new threat, potentially saving thousands of customers from fraudulent activity."
ANZ NZ's Head of Customer Protection Alan Thomsen says the bank continues to monitor all customer transactional activity in real time to minimise risk and loss to their customers.
"This smishing scam is the latest version of one that has been around for several years, and sadly won't be the last.
"ANZ will never send our customers text messages asking them to click on a link to log into internet banking or provide their customer information."
ASB Executive General Manager for Technology and Operations David Bullock says the nature of this scam shows how important cross-sector collaboration is to keep New Zealanders safe.
"No one industry can solve the problem of scams working alone.
"We remind New Zealanders to exercise caution, not click on links in text messages, or provide personal information, log-in details or transfer any money after receiving a cold call or text message.
"If you think your account has been compromised, call your bank as soon as possible on its publicly listed phone number."
The arrested man has been charged with interfering with a computer system and is due to reappear in Auckland District Court on Tuesday 10 December 2024.
