AI scam fears drive shift in New Zealanders' online behaviour - BNZ research

Fears about AI‑powered scams are changing how New Zealanders interact online, with three in five Kiwis now checking communications and links more carefully, and 7% even setting up safe words with family and friends to guard against voice‑cloning scams, according to new BNZ research.

BNZ's annual scam survey found that 62% of New Zealanders are now more cautious when checking communications or links, while 55% are limiting what they share online and 50% are fact‑checking news to reduce the risk of fake‑news scams.

BNZ Head of Fraud Operations, Margaret Miller, says the findings show AI has emerged as a significant new concern for New Zealanders.

"AI is making scams more sophisticated and harder to spot – from highly personalised phishing emails and fake websites, through to voice cloning and deepfakes used in impersonation scams."

"What makes AI particularly concerning is the scale and speed at which scammers can now operate. They can create convincing content that mimics legitimate organisations or trusted individuals much more easily than before," she says.

AI‑powered phishing was a top concern, with 64% of respondents worried about highly personalised and convincing phishing emails created using AI. Deepfakes were the second biggest concern at 58%, followed by AI voice cloning at 53%.

Deepfakes are AI‑generated videos or images that look real but show things that never happened. Voice‑cloning uses AI to mimic a person's voice, making scammers sound like trusted individuals.

The survey found some New Zealanders have found a creative way to help protect themselves against these sorts of scams.

"7% of New Zealanders have set up family safe words with loved ones – a pre‑agreed word or phrase to help verify identity in unexpected situations," Miller says.

"When someone you know contacts you out of the blue asking for money, whether by text, call, email or social media, having a way to verify who you're really talking to can help you make better decisions."

"With AI making it easier to create convincing impersonations, that extra step can be really valuable."

Fewer NZers being targeted, but scam tactics evolving

The proportion of New Zealanders targeted by scams has gradually declined over the last three years, from 88% in 2023 to 87% in 2024 and 84% this year.

However, scammers are evolving their tactics. Social media (26%) has now overtaken email (22%) as the most common scam channel. This represents a significant shift since 2023, when email was the dominant channel at 40%.

"While it's positive that the percentage of New Zealanders being targeted has declined overall, scammers continue to find new ways to reach people, particularly through social media platforms," says Miller.

"We encourage all New Zealanders to take their time to stop and think before responding to unexpected requests for money or personal information, even if they appear to come from someone you know. That moment of caution could make all the difference," Miller says.

Banks are responding to these evolving threats with enhanced security measures. BNZ uses multiple layers of authentication to verify customers and has introduced small, smart elements of friction into its app to help customers slow down when scammers want them to speed up.

"Scammers are more successful when people are rushing," Miller says.

"We've designed our app to help customers break out of autopilot. Our UX uses cues like pause alerts and switched button placement to prompt a quick double‑check at critical moments."

Customers also have access to tools like the online banking lock, which allows them to immediately disable all online banking activity if they suspect their account has been compromised.

"Staying safe from scams is a shared responsibility – individuals, government, banks, social media companies, and telcos all play a part," Miller says.

"While organisations continue to strengthen their security measures, individuals can make a real difference through simple precautions like taking time to verify unexpected requests, keeping software updated, never sharing their personal data or banking credentials, and contacting their bank immediately if something doesn't feel right."