New Zealand keeps its scam reporting simple, which is a virtue until you need to know which of the four routes actually does the thing you want. Money, crime, technical incident, and spam are four different desks.
The bank, in the first minutes
Consumer Protection puts it as plainly as any government page anywhere: contact your bank immediately, because the sooner the bank knows, the greater the chance of getting the money back. Use the number in your banking app, not one from any message you have received.
New Zealand banks have signed up to anti-scam commitments in their Code of Banking Practice, and if you are unhappy with how your bank handles your case, the Banking Ombudsman Scheme can review it once the bank’s own complaints process is finished.
105 is the police report
If you have lost money, report it to the Police on 105 — free, 24 hours, or online through the 105 service. Call 111 instead if it is happening right now or someone is in danger. Note that the old police scams advice page is gone; 105 is the route.
The NCSC, for the technical side
Report the incident itself — the phishing site, the account takeover, the malware — at ncsc.govt.nz. The National Cyber Security Centre absorbed CERT NZ, so if you are looking for CERT NZ, or find a government page still naming it, this is where it went. The NCSC helps you understand and contain the incident; it does not recover money or prosecute.
Spam texts and emails go to Internal Affairs
The Department of Internal Affairs enforces the spam rules and takes reports of scam TXT messages and emails at dia.govt.nz. Two limits worth knowing: it covers text, email and fax only, and it does not investigate unsolicited phone calls, postal mail or pop-ups. Investment offers from unlicensed operators belong with the Financial Markets Authority instead.
IDCARE if your identity is exposed
IDCARE is free and covers New Zealand on 0800 121 068. If a scammer has your passport, licence or IRD details, it will build you an ordered plan for replacing documents and notifying the right agencies, which is the part people find hardest to work out alone.
What to have ready
Screenshots of the messages and the site, the account or payee details you paid, the amounts and times, the number or address that contacted you, and your bank’s transaction reference. Take the screenshots before you block anyone.
The honest expectation
Consumer Protection does not soften it: most scams come from overseas, and it is very difficult to get money back once it has been sent there. That is an argument for speed on the day, not for skipping the report — the report is what makes the next person’s warning possible.
And the second approach
Official New Zealand advice lists this as a step in its own right: some scammers target people who have just been scammed, including by pretending to be an agency that can return all your money for a fee. Nobody legitimate will ever ask you to pay to get your money back.
The page itself
If the scam has a website, the fastest takedown is not a government one. The hosting provider serving the page and the registrar that sold its domain can both remove it, usually within hours of a clear report that names the exact address and what the page does.