New scam protections for NZ, but businesses are still on the hook

Scam losses now estimated at $2 billion annually

Scams are now costing New Zealanders an estimated $2 billion annually, including losses from phishing, investment fraud, and increasingly sophisticated business email compromise (BEC) and invoice redirection scams.

By contrast, the most recent Q4 2024 report from CERT NZ recorded just $6.8 million in reported scam losses—up 24% from Q3, but representing only a fraction of the broader picture. Just 72 of those reports came from businesses, despite New Zealand having over 600,000 registered enterprises as of 2024.

This underreporting suggests many scams are either going undetected or are being quietly absorbed as operational losses—leaving finance teams unaware of the true extent of the threat.

What the new reimbursement scheme covers

Under the revised Code, banks are now obligated to reimburse customers up to $500,000 in cases where they fail to issue adequate scam warnings, identify clear red flags, or prevent high-risk transactions.

These protections are being implemented across all NZBA member banks over the next seven months. However, they are designed for individual customers—not business accounts. For organisations, the risks remain.

Why business fraud protection still falls short

Consumer protections are an important first step. But they don’t reflect the fraud risks faced by medium to large enterprises—particularly those operating in sectors with large and frequently changing supplier networks.

Businesses remain exposed to:

• BEC scams, where attackers impersonate trusted contacts to divert funds
• Invoice redirection, often enabled by compromised supplier accounts
• Phishing, which continues to evolve in sophistication and reach

These scams are often highly convincing, using genuine-looking invoices, authentic email domains, and forged documentation to deceive finance teams. Reimbursement policies typically don’t apply in these contexts. A recent alert from New Zealand’s National Cyber Security Centre warned of phishing attacks exploiting Microsoft OneDrive and SharePoint links—underscoring the growing threat to business systems.

Lessons from the UK: Why New Zealand should pay attention

The UK was one of the first markets to introduce systemic scam protections. In 2020, it rolled out Confirmation of Payee (CoP), which verifies account names before a payment is processed. Today, it protects more than two million payments each day.

New Zealand’s reimbursement reforms mirror this shift in responsibility. But the UK experience shows that while these tools help, they aren’t enough. APP scams still rose by 22% the same year CoP was introduced, with nearly 150,000 cases reported.

The lesson is clear: even with system-wide protections in place, scams evolve. Technology alone can’t solve the problem—particularly when it comes to business payments.

What finance leaders can do

Relying on reimbursement or basic verification tools is not sufficient. CFOs and financial controllers must adopt proactive, layered strategies to safeguard payment processes.

Key actions include:

• Verifying supplier bank details before every payment, not just during onboarding
• Strengthening internal controls through segregation of duties and audit trails
• Equipping teams to identify and act on fraud indicators in real time
• Leveraging platforms like Eftsure, which provide real-time alerts, supplier verification, and integration with existing AP workflows

Final thoughts

New Zealand’s new scam reimbursement scheme is a step forward—but it’s not a safety net for businesses.

Finance teams in complex environments need more than after-the-fact remedies. They need visibility, control, and proactive tools to prevent fraud before funds leave the account. Like audit and compliance, fraud protection must be part of the finance function’s core capability—because the cost of inaction is growing, fast.

And now, there’s even more protection on the table.

Eftsure has spent over a decade helping business leaders safeguard payments from onboarding through to payment execution. Now, that protection expands with Eftsure Guarantee—offering up to $1 million in coverage for verified payments lost to social engineering scams.

Eftsure Guarantee includes:

• Up to $1 million protection on verified payments

• Proactive fraud prevention that validates vendor payment details before payment

• Seamless integration with Eftsure’s existing verification processes—no extra steps, just extra protection

See how Eftsure Guarantee can work for you.