Cyber scams are becoming increasingly sophisticated, and scammers are now impersonating trusted organisations such as the New Zealand Police to trick people into making payments or exposing personal information.
Recently, we came across a fraudulent text message claiming to be from the New Zealand Police regarding an “overdue traffic infringement notice.” The message attempted to pressure the recipient into making an urgent payment through a suspicious website.
What the Scam Message Claimed
New Zealand Police: Your traffic infringement notice remains unpaid and is now overdue.
To avoid additional late fees or enforcement action, please make payment immediately.
Failure to pay may result in the matter being referred to the District Court without further notice.
Further action may include licence suspension, vehicle registration holds, vehicle seizure, or additional penalties.
Pay securely online now: https://<some_junk_text_to_disable_link>police-penalty.work/nz
New Zealand Police
(Please reply “Y” then close this message. Reopen it, tap the link, or copy and paste it into Safari to continue.)
The message stated that:
- A traffic infringement notice was overdue
- Immediate payment was required
- Failure to pay could result in:
- Additional penalties
- Licence suspension
- Vehicle seizure
- District Court action
- The recipient was instructed to pay through a website link
- The message included unusual instructions such as replying “Y” before opening the link
At first glance, the message may appear convincing because it uses fear, urgency, and the name of a trusted government organisation.
However, several warning signs clearly indicate that this is a scam.
The Message Originated From an Overseas Number
One of the clearest warning signs in this scam attempt was the sender’s phone number:
The country code +212 belongs to Morocco.
This immediately raises suspicion because the message claimed to be from the New Zealand Police, yet it originated from a foreign mobile number outside New Zealand.
Legitimate New Zealand government agencies generally do not send infringement notices from overseas mobile numbers.
This mismatch between:
- The claimed organisation
- The sender’s country
- The suspicious payment website
is a strong indicator that the message is fraudulent.
How to Identify This Scam
1. Suspicious Website Address
The message directed users to the following website: https:// p o l i c e – p e n a l t y.work/nz (spaces included to avoid accidental click)
This is a major red flag.
Official New Zealand government and police websites use trusted domains such as: govt.nz, police.govt.nz
Scammers often create fake domains that sound official but are completely unrelated to government infrastructure.
Tip:
Always carefully inspect the full web address before clicking any link.
2. Fear and Urgency Tactics
The message attempts to create panic by threatening:
- Court action
- Licence suspension
- Vehicle seizure
- Additional penalties
Scammers rely on emotional pressure to make people act quickly without properly verifying the information.
Legitimate organisations usually provide:
- Official reference numbers
- Multiple verification methods
- Secure communication channels
- Clear dispute processes
3. Strange Instructions
The message instructed the recipient to:
“Reply ‘Y’ then close this message…”
This is highly suspicious and not standard practice for legitimate government agencies.
Scammers sometimes use these instructions to bypass mobile security protections or encourage interaction with malicious links.
4. Generic Messaging
The text message did not include:
- Your name
- Vehicle registration details
- Infringement number
- Specific offence details
Official infringement notices generally contain identifiable information and formal references.
Generic messages are commonly used in mass phishing campaigns.
5. Unexpected SMS from an Unknown Sender
If you were not expecting a notice, always verify independently.
Do not trust links sent through unexpected SMS messages — even if they appear official.
Scammers know that many people react quickly when they see messages involving police, banks, taxes, or fines.
Why These Scams Work
Scammers exploit:
- Fear
- Urgency
- Trust in authority
- Curiosity
- Lack of awareness
Many people are busy and may click links before properly checking the details.
That is why cybersecurity awareness is essential for both individuals and businesses.
What You Should Do If You Receive This Message
Do NOT:
- Click the link
- Reply to the message
- Enter personal information
- Enter banking or card details
- Download anything from the website
Instead:
- Delete the message
- Report it as spam
- Verify independently through official websites
- Warn friends and family members
- Contact your bank immediately if you interacted with the scam
You can verify New Zealand Police information through their official website:
New Zealand Police Official Website
How Businesses Can Protect Staff
Businesses should regularly educate employees about:
- SMS phishing (“smishing”)
- Email phishing
- Fake payment requests
- Suspicious links
- Domain verification
- Social engineering attacks
Even a single click on a malicious link can potentially expose:
- Personal information
- Banking credentials
- Business systems
- Company emails
- Customer data
At AgileMind.nz, we help businesses improve cybersecurity awareness, strengthen IT security practices, and reduce exposure to online threats.
Final Thoughts
If a message creates panic and pressures you to act immediately, pause and verify first.
Cybercriminals continuously evolve their tactics, but awareness remains one of the strongest defences.
Always remember:
- Check the sender
- Check the website domain
- Check the country code
- Verify independently before acting
Stay cautious. Stay informed. Stay secure.
