Online loan scams targeting New Zealand businesses, and how to spot them

Moving a business loan online has made borrowing faster and more convenient. It has also given scammers a playbook. They know business owners under cash pressure may move quickly, and they know how to make a fake website or message look convincing. Knowing the patterns is the best protection.

What do online loan scams look like?

Scam type	How it works	The giveaway
Upfront fee	“Approved!” — but a fee must be paid first to release funds	Genuine lenders deduct fees at settlement or add them to the loan
Cloned lender	A copy of a real lender’s site on a slightly different web address	The address is wrong; phone numbers do not match public records
Fake “verify” link	A text or email asks you to verify ID or bank details	You did not start an application, or the link is not from your specialist
Credential harvesting	A form asks for your internet banking, myIR or Xero password	No lender needs your passwords
Payment redirection	“Our bank details have changed” just before settlement	Unexpected change of account, urgency
Guaranteed approval	“No credit checks, everyone approved, any amount”	Real lenders assess every application
Social media lender	A profile offering quick business loans via direct message	No verifiable company details

What are the red flags?

Business.govt.nz lists common scam types that affect New Zealand businesses, including advance-payment scams that promise opportunities in return for an upfront fee, phishing messages asking for passwords or PINs, and false invoices sent from hacked email accounts. Netsafe’s warning signs overlap: unexpected contact, requests for passwords, upfront payments for rewards, pressure to act fast, and requests to pay with gift cards or cryptocurrency.

For loans specifically, stop if you see any of these:

• A fee before funds. Application, insurance, “processing” or “release” fees paid by transfer, card, gift card or crypto.
• Guarantees. No genuine lender can promise approval before assessing you.
• Password requests. Internet banking, myIR, accounting software or email logins. Also one-time codes sent to your phone.
• Urgency. “Offer expires in an hour.” “Pay today or lose the approval.”
• Odd channels. Loan offers via social media direct messages or messaging apps from unknown numbers.
• No verifiable company. No NZBN, no Companies Register entry, no physical address.

How do you check before you engage?

Search the company name plus “scam”. Look the company up on the Companies Register and the Financial Service Providers Register. Check the website address carefully, letter by letter. Call using a number you found independently, not the one in the message. Our step-by-step routine is on the checking a lender is real page. The Financial Markets Authority also keeps a warnings and alerts list worth checking.

When you are ready to start safely, use our enquiry form — it never asks for passwords and charges nothing.

What should you do if you think you have been scammed?

Act fast. The first hour matters most.

1. Call your bank immediately if money has been sent or bank details shared. Banks can sometimes stop or recall payments if told quickly.
2. Change passwords for any account you may have exposed, starting with email and banking, and turn on two-factor authentication.
3. Report it. Business.govt.nz directs businesses to the National Cyber Security Centre for scams, fraud and cyber incidents. Netsafe can also help on 0508 638 723. Investment and financial scams can be reported to the Financial Markets Authority.
4. Warn your team and, if your email was compromised, your customers and suppliers.
5. Keep records — screenshots, messages, account numbers and times.

Why are business owners targeted?

Because business owners move larger amounts, often under time pressure, and frequently handle finance alongside everything else. A loan scam lands when someone is stretched. That is exactly when a calm check matters most.

Worked example (illustrative): a Nelson boat-builder receives a text: “Your $85,000 business loan is pre-approved. Pay the $1,950 insurance bond to release funds today.” He has not applied anywhere. He searches the “lender” name and finds no company record and several warnings online. He deletes the text, reports it and tells his office manager to expect similar ones.

How do genuine lenders handle fees?

Legitimate lenders disclose fees in writing in your offer. Establishment and legal fees are typically deducted from the loan at settlement or added to the loan balance. You do not transfer money to a lender in order to receive money from them. If someone asks you to, read upfront fee scams before doing anything.

How do you protect the business long term?

The National Cyber Security Centre’s Own Your Online service recommends a handful of basics for every business: keep software updated, use two-factor authentication on key systems, back up data, verify unusual payment requests through a separate channel and collect only the data you need. Those habits defeat most scams before they start.

How can you protect your team from loan scams?

Scams do not only target owners. Office staff and bookkeepers handle invoices, open emails and answer the phone. Agree a short set of rules everyone follows: no payment details are changed without a call-back to a known number; nobody shares passwords or one-time codes with callers; unsolicited loan offers are deleted, not answered; anything urgent and unusual is checked with the owner first. Make it easy for staff to pause and ask, and thank them when they do.

Apply the safe way

Our enquiry is free, takes about a minute and asks for no passwords, no fees and no credit check. Your details go to one team rather than being passed around a pile of lenders, and you will speak with a real person whose number you can save and verify. Fill it in accurately, and call us if any later message ever seems off. Start a safe online enquiry.