Lawless says she was quickly able to identify the email as a scam, given it featured some characters in a foreign language.
She did, however, warn that it could easily catch someone less suspicious simply because it "looks legit".
In a tweet sent out earlier this morning, Lawless urges Kiwis to "warn your grandparents" about the scam.
She explained that those less familiar with the latest form of "technological bastardry" were most vulnerable to being caught out by a scam that appears this legitimate.
Data from Netsafe earlier this year showed that Kiwis lost $33 million to online scams and fraud last year - triple the amount stoled in 2017.
The average loss increased from $10,771 in 2017 to $21,140 in 2018. The smallest loss reported was $1 and the largest loss was $5m.
Netsafe chief executive Martin Cocker has warned on numerous occasions that scams are becoming more sophisticated, often emulating legitimate promotions or emails from reputable organisations.
When the scam first appeared, IRD spokeswoman Sharon Thompson said that while the scam looked real, there were tell-tale signs that people should look out for.
"Embedded links can look quite convincing at first glance as "ird.govt.nz" can be included within the address. But if you hover over those links, you'll see Inland Revenue is not the destination," she said.
The IRD is continuously taking steps to shut nefarious websites down, but the battle is never-ending.
IRD is prompting customers who receive this email to forward the fraudulent email to phishing@ird.govt.nz.
Inland Revenue's tell-tale signs of scams
• The scammer may pressure you to make a decision or do something quickly.
• The email, phone call or text may be threatening. The scammer might want to be paid in unusual ways such as gift cards, bitcoin or money transfer systems.
• A scammer may ask for your bank account details. IRD says: "We will never ask you to email or text us this information – we will always ask you to supply this through myIR."
• The scammers might ask for passwords to your online accounts. Legitimate organisations will never ask for passwords.
• Scammers often give website or email addresses that are wrong but look almost right. For example, they might send you to ird.co.nz, ird.qovt.nz or ird.gov.nz, instead of the correct ird.govt.nz
