Online safety and scams
How to spot a fake email claiming to be from Waitaki District Council
We're aware of phishing emails being sent to our community pretending to be from Council. Here's how to tell what's real, what's not, and what to do if you've clicked something you shouldn't have.
How Waitaki District Council will actually contact you
Genuine emails from us will always come from an address ending in @waitaki.govt.nz. If an email claims to be from Council but the address doesn't end this way, it's not from us.
What we will do
- Send emails from an address ending in @waitaki.govt.nz
- Refer you to information already on our official website, https://www.waitaki.govt.nz
- Give you time to respond - we won't demand instant action
- Identify a specific reason for contacting you, like a consent, rates account, or service request you've already raised with us
What we will never do
- Ask you to pay rates, fines, or fees using gift cards, cryptocurrency, or bank transfer to a personal account
- Ask for your internet banking login, credit card number, or PIN by email or text
- Ask you to click a link and "urgently confirm" personal or account details
- Threaten immediate disconnection, prosecution, or arrest if you don't act right now
- Send unexpected attachments asking you to enable macros
Warning signs of a phishing email
Phishing emails are designed to look genuine. Scammers often copy real logos and formatting, so appearance alone isn't proof. Look for these signs instead.
Check the sender's address
Don't just check the display name, check the full email address. Scammers use addresses that look close to ours but aren't, for example:
- waitakidc.co.nz (wrong domain ending)
- waitaki.govt.nz.info-update.com (our name tacked onto another domain)
Urgency and pressure
Scam emails often create pressure to act fast, such as threats of penalties, cut-off services, or a limited-time offer. Genuine Council communications give you reasonable time to respond.
Requests for personal or financial details
Be wary of any email asking you to confirm your bank details, login, IRD number, or driver licence number by email or through a link.
Generic greetings and poor language
Watch for "Dear Customer" instead of your name, odd phrasing, spelling mistakes, or unusual formatting. Not all phishing emails have obvious errors though, so don't rely on this alone.
Suspicious links
On a computer, hover your mouse over a link (without clicking) to see the actual web address at the bottom of your screen. On a phone, press and hold the link to preview it. If the address doesn't clearly go to waitaki.govt.nz, don't click it.
Unexpected attachments
Be cautious with attachments you weren't expecting, especially ZIP files, or documents that ask you to "enable content" or log in to view them.
Quick comparison: genuine vs phishing
| Genuine Waitaki District Council email |
Likely phishing email |
| Sent from an address ending in @waitaki.govt.nz |
Sent from a look-alike or unrelated domain |
| Addresses you by name where we hold your details |
Uses a generic greeting like "Dear Ratepayer" |
| Links go to waitaki.govt.nz pages |
Links go to an unfamiliar or misspelled web address |
| Doesn't ask for your bank login or card PIN |
Asks you to "confirm" banking or card details |
| Gives you a reasonable amount of time to respond |
Demands urgent action or threatens penalties |
What to do if you've clicked a link or shared details
If you think you've responded to a phishing email, act quickly. It's nothing to be embarrassed about - these scams are designed to catch people out, and reporting it helps protect others too.
- Don't panic, but act quickly. Disconnect the device from the internet if you can, to help stop any malware from communicating further.
- If you entered banking details or made a payment, contact your bank straight away. They can help freeze your account or reverse a payment.
- Change your passwords for any account where you used the same or similar password, starting with your email account. Turn on two-factor authentication (2FA) where you can.
- Run a security scan on your device using up-to-date antivirus software to check for malware.
- If you shared your driver licence, passport, or other ID details, contact the Department of Internal Affairs (for passports) or Waka Kotahi NZ Transport Agency (for driver licences) to ask about your options.
- Check your accounts over the following weeks for anything unusual, and consider a free credit check to see if any accounts have been opened in your name.
- Report it - see the reporting section below. This helps stop the scam reaching others in our community.
Try it yourself: can you spot the phish?
Test what you've just learned. This mock email has 6 warning signs hidden in it - click or tap on the parts that look suspicious to you and see if you can find them all.
How to report a phishing email
Report the scam email
Report phishing emails to the National Cyber Security Centre (NCSC) through https://www.ncsc.govt.nz/report/business-and-individuals/, the government's online safety service. They can advise on next steps and help stop the scam reaching others.
If you got a scam text message, forward it free to 7726. A service managed by the DIA.
Report it to us too
If an email is pretending to be from Waitaki District Council, please let us know. This helps us warn others in our community and take action where we can.
Email us at service@waitaki.govt.nz or call us on +64 3 433 0300.
If money has been stolen or you suspect fraud
Report it to New Zealand Police by calling 105, or online at police.govt.nz/105support. If there's immediate danger or a crime in progress, call 111.
Not sure if an email is really from us?
Check with us directly
If you've received an email that claims to be from Waitaki District Council and you're not sure it's genuine, don't click any links. Contact us directly using details you already know are correct - not the ones in the email.
Our team can confirm whether we've sent you anything, and help you report it if it's a scam.