The call sounds legit, the number is familiar. They say they are from a company you deal with every month. There is a problem with your account, and they can fix it if you just act now!
Once, a spelling mistake or clumsy layout might have given the game away. Now, a convincing impersonation can arrive looking polished and entirely plausible.
That changes the question we need to ask when new messages or calls are incoming. Not just: does this look real? But: how can I check that it actually is real?
This October, during Cybersecurity Awareness Month, Spark is encouraging New Zealanders to rethink the shortcuts we use to decide who to trust. Familiarity is useful. It is not verification.
“The hardest scams to spot are the ones that fit into your everyday life,” says Ross Dickson, fraud lead at Spark. “You’re expecting a bill, waiting for a delivery or juggling work and family. A believable message can catch you at exactly the wrong moment.”
A pause beats a polished logo
A recognisable name, logo or phone number is not enough to establish that someone is who they claim to be. Scammers can imitate the cues we have learnt to associate with legitimate organisations.
Instead, look at the situation. Were you expecting this contact? Does the request make sense? Why does it need to happen immediately?
An unexpected demand for payment, personal information, a password or a one-time security code deserves scrutiny, however professional the message looks.
Urgency should slow you down, not speed you up. Pressure to act before an account is closed or a discount can be claimed could be an attempt to push you past your normal judgement.
“If someone is trying to rush you, give yourself permission to stop,” Dickson says. “You don’t have to settle the question while they’re on the phone or while the message is open. Take the time to check independently.”
The key word here is ‘independently’. Calling a number supplied in a suspicious message can put you straight back in touch with the scammer behind it. Clicking a link provided can send you to a website that looks exactly like the real thing but is controlled by the scammers.
Contact the organisation through a separate channel, using details you have sourced yourself. Don’t let the person making the request also control the way you verify it.
Protection starts before the message arrives
Spark’s approach is not simply to tell customers to be more vigilant. Its safety and security programme includes network protections, scam detection, customer education and work with other organisations.
Blocking scam calls and texts helps reduce what reaches customers in the first place. Spark’s SMS Firewall has already blocked more than 1.75 million scam SMS texts from reaching customers’ phones.
But scammers have migrated to messaging apps like iMessage and WhatsApp that are sent directly over the internet, and impersonating legitimate phone numbers – hence the growing need for independent verification.
“No one should have to become a fraud expert just to answer their phone,” Dickson says. “Our job is to make it harder for scams to reach people, and easier for customers to recognise genuine contact when it does.”
Organisations cannot ask customers to distrust unexpected communications without also helping them identify the real thing.
Spark’s Verified Call is one example. For customers who have enabled the feature, incoming calls from Spark will display Spark’s name, logo, a visible verification badge, and the reason for calling on the phone screen, helping customers identify genuine Spark calls before answering.
It gives customers more information at the moment they are deciding whether to pick up. It is part of Spark’s response to impersonation scams, not a shield against every kind of fraud.
“A familiar name alone isn’t enough,” Dickson says. “We need to give customers stronger ways to recognise us, while making it clear that no single feature replaces every other precaution.”
Trust takes more than one layer
Scams are not a problem one customer, company or industry can solve alone. Spark also works alongside partners in the Anti-Scam Alliance, contributing to a wider, cross-sector response.
That work sits alongside its own network protections and the steps customers can take when an unexpected request arrives. Each plays a different role. None should be treated as the whole answer.
Spark’s Safety and Security Hub brings together scam information, practical guidance and support resources. It is somewhere customers can turn to build their confidence, rather than trying to assess every unfamiliar situation from scratch.
The advice is also worth sharing with friends and whānau, particularly those who are less tech-savvy. Talk about how you would check an unexpected call or message before you have to make that decision under pressure.
This is not about blaming people who are deceived. Convincing impersonations exploit trust, and trust is what makes everyday communication possible.
“The aim is not to make people suspicious of everything, but to make checking feel like an ordinary, sensible step,” says Dickson.
The new habit is straightforward: pause, check the request and verify through a separate, trusted channel. Looking genuine is a claim. Verification is the check that helps you decide what to do next.
For practical advice and support, visit Spark’s Safety and Security Hub.