Old-school cons outpace cyberattacks, costing businesses thousands
Half of New Zealand’s small and medium-sized businesses have engaged with a scam attempt in the past year, even as many admit they struggle to prioritise scam education and cyber training for staff, according to BNZ’s latest SME scam survey.
The research shows 64% of SMEs believe scam activity has increased over the last 12 months, yet 45% do not consider cyber education a key priority, raising concerns that staff are becoming the new frontline for scammers.
The survey found 50% of businesses responded to a scam in the last year by clicking a link, opening an attachment or replying to a scam message.
Margaret Miller, BNZ head of fraud operations, said scammers are exploiting these gaps.
"Business owners are alert to the danger, but they are also time-poor and juggling multiple priorities," Miller said in a media release. "The reality is that scammers are becoming increasingly sophisticated in their tactics.
"Scammers know that breaking through technical security is difficult, so in many cases they’re bypassing the technology entirely and targeting the person sitting at the keyboard.
"Business owners are generally doing well with technical defences like antivirus software and firewalls, but criminals are going around that, targeting the busy human at the desk who is clearing invoices or answering the phone."
The findings land just as new scam protections and compensation rules take effect under New Zealand’s updated Code of Banking Practice, adding pre-payment warnings and tighter bank responsibilities for scam losses.
$5,000 average hit as ‘old school’ scams surge
For SMEs where an attempted scam becomes an actual breach, the financial and data impacts can be serious.
Of the businesses that fell victim to an online scam, 21% suffered a business financial loss and 26% a personal financial loss, while 30% reported data loss.
“For those that did suffer a financial hit, the average loss was just over $5,000,” Miller said.
“Scammers aren't just after your business accounts. The data shows they are often successful in targeting personal finances or the business’s data, even if they don't manage to steal money directly from the company accounts.”
Contrary to the image of sophisticated hacks, most attacks are traditional deception and social engineering, not ransomware or advanced exploits.
While only 2% of businesses were targeted by ransomware, more common scams included:
- 27% of businesses targeted by cold calls requesting sensitive company information
- 17% facing bank impersonation attempts
- 10% encountering invoice scams involving altered bank details
“Scammers prey on the fact that when we’re rushed, distracted, or juggling multiple things we’re more likely to act first and think later,” Miller said.
The findings also highlight the risk of complacency: 53% of business owners rated themselves as “prepared” for a scam, yet 49% of that same group still engaged with a scam attempt.
BNZ urges SMEs to pair tech defences with staff education
Miller said BNZ is pushing SMEs to close the gap between technology and human behaviour.
"We’re investing heavily in systemic defences, but we also provide specific tools for businesses. This includes two-step authentication for logins, and the ability to require two separate approvals for any payment," Miller said.
"Technology is a vital layer of defence, but an educated team is just as important. When staff feel confident spotting the signs, they become the business’s best asset against scams and fraud.
"We encourage all business owners to use free resources to upskill their teams —whether that is through the Own Your Online platform operated by the National Cyber Security Centre, Netsafe, or the tailored scam information for businesses available on the BNZ website. It is one of the most effective ways to protect your business from financial loss."
Stay informed with the latest housing market trends and mortgage insights — subscribe to our free daily newsletter.
