NEW ZEALAND - Scammers posing as police detectives are stealing crypto from Kiwi wallet holders in a two-call scheme Police say has cost victims millions of dollars.
Police and the National Cyber Security Centre have both issued warnings, and reports on social media remain active.
New Zealand Police detective inspector Stuart Mills, Manager Intercept and Technology Operations for the National Criminal Investigation Group, told Cryptocurrency NZ police had received a large number of reports in recent weeks.
The scammers pose as detectives, Mills said, often claiming a victim's details, information or ID have been found on a person who has been arrested.
"The fake detective directs their questions towards establishing if and how the victim holds cryptocurrency, before arranging for a fake representative from the cryptocurrency company to contact the victim," Mills said.
"The fake representative then convinces the victim to hand over their passwords or seed phrases, often through a fake webpage resembling a legitimate cryptocurrency application."
The scam works in two stages - first the call, posing as police, that builds fear and authority, and checks whether the target actually holds assets worth pursuing.
The second call, posing as an exchange representative based on whatever information was revealed, supplies the technical credibility an officer cannot.
It walks the victim through a fake interface built to look like the real thing, where the victim is guided into handing over their seed phrase resulting in total loss of funds scraped from the user's wallet.
Inside the calls
One local anonymous source told Cryptocurrency NZ he was driving home a few weeks ago when he took a call from a local number.
The caller introduced himself as a detective from the cybercrime unit and said the man's information had been found in a data breach.
"I'm a bit iffy already but I'm like, OK sure, my data is all over the internet, why are you calling me about it," he said.
The caller said the breach related to cryptocurrency platforms, then started listing them - Coinbase, MetaMask, Binance - and asking which ones the man used.
He asked the caller for a badge number instead, and said he would ring 105 to verify before going any further.
"He gets a bit uppity about that and says, oh no it's OK, I can verify myself here on the call, I've just sent an email with the case reference, did you get it?"
The email had already arrived at his personal address. It displayed New Zealand Police as the sender.
"It was my actual personal email address. I thought, yeah, this would trick someone who isn't an opsec nerd for sure."
The underlying sender address was not a Police one. He told the caller he would confirm with Police directly and call back.
The caller hung up and did not contact him again.
"Definitely a spooky experience," he said. "Some older or less techy people would have just gone right along and had all their shit rizzled."
Not everyone hangs up in time.
A post to r/NZBitcoin described a near-identical approach, a call then an email, from someone claiming to be a detective investigating identity theft. The questions started routine before moving to which exchanges the person used, and which hardware wallet.
Nothing about the approach felt urgent or forced.
That is the pattern victims describe. Nothing on the call feels wrong at the time.
It is only afterwards, reading back a private number or a mismatched sender address, that it becomes obvious, and by then the details have been handed over.
One community member reported spending more than six minutes on the phone before the line of questioning started to seem unusual.
A member of Cryptocurrency NZ's Facebook group described losing access to a Trezor hardware wallet after a call claiming to be Police was followed by a second call claiming to be from Trezor, with losses believed to be around $100,000.
Another victim, commenting on the NZ Police scam warning, reported losing $30,000.
Police say reports received in recent weeks have resulted in victims suffering millions of dollars in losses.
Hook, line and sinker
Nothing a victim can check during the call reliably confirms who is on the other end.
The National Cyber Security Centre found scammers had spoofed 04 474 9499, the real number for Police National Headquarters.
Spoofing lets a caller fake the number and caller ID a phone displays, so the victim's screen showed New Zealand Police while the person on the line was the scammer.
The call does the heavy lifting. A detective, a case, a person arrested with your details on them - it arrives with enough authority that most people are already half-convinced before they think to check anything.
The email settles it. Several New Zealanders have described receiving one while still on the phone, sent from what appears to be a legitimate Police address, and it lands exactly when doubt would otherwise start to form.
It is spoofed, and it is not from Police.
But to someone confused and already on the back foot, a written record from a police.govt.nz address reads as proof rather than as part of the same operation.
"That's what caused us to drop our guard," one victim said.
Users on r/newzealand describe emails arriving from cybercrime@police.govt.nz and investigations@police.govt.nz, carrying a case file number and the name of an officer said to be assigned to the matter.
One person reported an email sent from investigations@police.govt, a domain that does not exist, with the reply-to field set to the genuine police.govt.nz address. Another noted the case file number supplied did not follow the yymmdd/#### format Police use for real file references.
Even asking for identification does not settle it.
A QID is the unique identifier New Zealand Police assign to officers and staff, but people who have taken these calls report the scammers supply QID numbers on request, and those numbers are fabricated.
The opening approach lands because it already contains real information, drawn from data exposed in prior breaches, according to NCSC.
Those details are what make the first call sound informed rather than random.
A tool run by NCSC, How Exposed Am I?, lets anyone check whether their own details appear in known breach data. It states more than 4.3 million New Zealand account records are currently exposed.
Even NCSC's own name isn't immune.
On July 29, the agency issued a separate alert warning that scammers were placing calls claiming to be from the NCSC itself.
Who is behind it
Mills said current intelligence indicates the offenders are based offshore rather than in New Zealand.
Reports suggest they often speak with British accents and use phone numbers that appear as the New Zealand Police through Caller ID, but are linked to VOIP calling services that can be operated from anywhere in the world.
He said neither an accent, a local-looking number, nor an apparently legitimate email should be taken as proof that a caller is who they claim to be, since all three can be faked or spoofed.
Mills said Police prioritise fraud investigations according to the harm caused, and that scams impersonating Police or other government agencies exploit public trust in those institutions, increasing both the likelihood of victims being deceived and the potential harm caused.
He said offending involving impersonation of Police is treated seriously and may warrant an enhanced investigative response.
What to do
Police are urging holders not to give cryptocurrency information to anyone they are not familiar with.
"This type of scam is on the rise, and we want the community to be alert," Mills said.
"There are instances where legitimate police officers will contact you as part of their duties, but New Zealand Police will never ask you sensitive financial details."
Mills said Police may occasionally discuss cryptocurrency with members of the public as part of a legitimate investigation, but that any unsolicited contact involving cryptocurrency should be treated with caution, particularly where the caller creates a sense of urgency to act or asks for sensitive information.
Police also advise:
- Police will never make unsolicited requests for crypto wallet, bank card, PIN, seed phrase, or password details over the phone
- Trust your instincts; if something feels off, or is too good to be true, it probably isn't true
- If contacted by someone claiming to be conducting a Police investigation into cryptocurrency, check in with a trusted friend or relative before acting
- Caller ID and email addresses can both be spoofed and should not be relied on to verify a caller's identity
- If still uncertain, ask for the officer's details, hang up, call 105, and request a callback from that officer
- Never share a seed phrase with anyone
Tricking someone into handing over cryptocurrency through false pretences is an offence under section 240 of the Crimes Act 1961, obtaining by deception, carrying a maximum penalty of seven years' imprisonment.
Posing as a police officer is a separate offence under section 48 of the Policing Act 2008, personation, carrying up to 12 months' imprisonment or a $15,000 fine.