NEW ZEALAND - Scammers posing as police detectives are stealing crypto from Kiwi wallet holders in a two-call scheme Police say has cost victims millions of dollars.
Police and the National Cyber Security Centre have both issued warnings, and reports on social media remain active.
New Zealand Police detective inspector Stuart Mills, Manager Intercept and Technology Operations for the National Criminal Investigation Group, said police had received a large number of reports in recent weeks.
The scammers pose as detectives, Mills said, often claiming a victim's details, information or ID have been found on a person who has been arrested.
"The fake detective directs their questions towards establishing if and how the victim holds cryptocurrency, before arranging for a fake representative from the cryptocurrency company to contact the victim," Mills said.
"The fake representative then convinces the victim to hand over their passwords or seed phrases, often through a fake webpage resembling a legitimate cryptocurrency application."
The scam works in two stages - first the call, posing as police, that builds fear and authority, and checks whether the target actually holds assets worth pursuing.
The second call, posing as an exchange representative based on whatever information was revealed, supplies the technical credibility an officer cannot.
It walks the victim through a fake interface built to look like the real thing, where the victim is guided into handing over their seed phrase resulting in total loss of funds scraped from the user's wallet.
Hook, line and sinker
Nothing a victim can check during the call reliably confirms who is on the other end.
The National Cyber Security Centre found scammers had spoofed 04 474 9499, the real number for Police National Headquarters.
Spoofing lets a caller fake the number and caller ID a phone displays, so the victim's screen showed New Zealand Police while the person on the line was the scammer.
The email is the second layer.
Several New Zealanders have described receiving one while still on the phone to the fake detective, sent from what appears to be a legitimate Police address.
"That's what caused us to drop our gaurd", one victim said.
Users on r/newzealand describe emails arriving from cybercrime@police.govt.nz and investigations@police.govt.nz, carrying a case file number and the name of an officer said to be assigned to the matter.
One person reported an email sent from investigations@police.govt, a domain that does not exist, with the reply-to field set to the genuine police.govt.nz address. Another noted the case file number supplied did not follow the yymmdd/#### format Police use for real file references.
Receiving an official-looking email mid-call is what tips potential victims from suspicion into belief, arriving at the moment the scammer needs the victim to accept that the investigation is real.
Even asking for identification does not settle it.
A QID is the unique identifier New Zealand Police assign to officers and staff, but people who have taken these calls report the scammers supply QID numbers on request, and those numbers are fabricated.
The opening approach lands because it already contains real information, drawn from data exposed in prior breaches, according to NCSC.
Those details are what make the first call sound informed rather than random.
A tool run by NCSC, How Exposed Am I?, lets anyone check whether their own details appear in known breach data. It states more than 4.3 million New Zealand account records are currently exposed.
Even NCSC's own name isn't immune.
On July 29, the agency issued a separate alert warning that scammers were placing calls claiming to be from the NCSC itself.
Inside the calls
For one New Zealander, the scam looked ordinary until it didn't.
A post to r/NZBitcoin described being contacted by phone, then by email, by someone claiming to be a detective investigating identity theft.
The caller asked routine-sounding questions before shifting into more specific territory: which exchanges the person used, which hardware wallet.
Nothing about the approach felt urgent or forced.
Victims describe the same pattern: nothing that happens on the call feels wrong at the time.
It's only afterwards, reading back a private number or a mismatched email address, that the scam becomes obvious. By then the details have already been handed over.
Another community member reported spending more than 6 minutes on the phone to the scammers before they noticed that the line of questioning was unusual.
A member of Cryptocurrency NZ's Facebook group described losing access to a Trezor hardware wallet after a call claiming to be Police was followed by a second call claiming to be from Trezor, with losses believed to be around $100,000.
Another victim, commenting on the NZ Police scam warning, reported losing $30,000.
Who is behind it
Mills said current intelligence indicates the offenders are based offshore rather than in New Zealand.
Reports suggest they often speak with British accents and use phone numbers that appear as the New Zealand Police through Caller ID, but are linked to VOIP calling services that can be operated from anywhere in the world.
He said neither an accent, a local-looking number, nor an apparently legitimate email should be taken as proof that a caller is who they claim to be, since all three can be faked or spoofed.
Mills said Police prioritise fraud investigations according to the harm caused, and that scams impersonating Police or other government agencies exploit public trust in those institutions, increasing both the likelihood of victims being deceived and the potential harm caused.
He said offending involving impersonation of Police is treated seriously and may warrant an enhanced investigative response.
What to do
Police are urging holders not to give cryptocurrency information to anyone they are not familiar with.
"This type of scam is on the rise, and we want the community to be alert," Mills said.
"There are instances where legitimate police officers will contact you as part of their duties, but New Zealand Police will never ask you sensitive financial details."
Mills said Police may occasionally discuss cryptocurrency with members of the public as part of a legitimate investigation, but that any unsolicited contact involving cryptocurrency should be treated with caution, particularly where the caller creates a sense of urgency to act or asks for sensitive information.
Police also advise:
- Police will never make unsolicited requests for crypto wallet, bank card, PIN, seed phrase, or password details over the phone
- Trust your instincts; if something feels off, or is too good to be true, it probably isn't true
- If contacted by someone claiming to be conducting a Police investigation into cryptocurrency, check in with a trusted friend or relative before acting
- Caller ID and email addresses can both be spoofed and should not be relied on to verify a caller's identity
- If still uncertain, ask for the officer's details, hang up, call 105, and request a callback from that officer
- Never share a seed phrase with anyone
Tricking someone into handing over cryptocurrency through false pretences is an offence under section 240 of the Crimes Act 1961, obtaining by deception, carrying a maximum penalty of seven years' imprisonment. Posing as a police officer is a separate offence under section 48 of the Policing Act 2008, personation, carrying up to 12 months' imprisonment or a $15,000 fine.