The cowboy used to be the bloke with a cheap quote and no licence. These days he might be a stranger sitting inside your supplier’s email, a “top 10 builders” website run from offshore, or someone quoting your LBP number to a building inspector.
The National Cyber Security Centre (NCSC) received 4,673 incident reports in the year to 30 June 2026 and recorded $23.8 million in direct financial losses. Scams and fraud was the biggest category, and 39 of the incidents handled through its general triage process were in construction. The NCSC notes that not all losses get reported or recorded.
Its Cyber Threat Report 2026 says AI is now part of the cybercrime toolkit, making phishing, scams and social engineering more convincing. Catriona Robinson, who heads the NCSC, says criminals are already using AI to increase the speed, scale and sophistication of attacks.
Business email compromise has been behind some of the biggest losses reported to the NCSC. The NCSC describes it as a criminal getting into an email account, then sending fake invoices or changing payment details so money lands in their own account. In its September 2025 quarter report, it said it had received a number of reports of significant losses from it.
For a building firm the risk runs both ways. If a supplier’s email is compromised, you pay the scammer and may still owe the supplier, Own Your Online warns. If yours is, your clients pay someone else, and the business being imitated could take a financial and reputational hit.
Own Your Online, the NCSC’s advice site, says to treat any request to change bank details as suspicious. Confirm it by phone on a publicly listed number or the one you usually call, never the number on the invoice. It also recommends two-factor authentication on business systems.
The banks have added a check. New Zealand’s retail banks finished rolling out Confirmation of Payee in April 2025, which tells you whether the account name matches the number, according to the New Zealand Banking Association. Under the updated Code of Banking Practice, scam compensation is limited to customers who were a consumer, as defined in the Consumer Guarantees Act, when they used the bank’s services.
If money has gone, Own Your Online says to contact your bank immediately. Then report it to the NCSC, which can alert the company being impersonated.
Own Your Online’s Cyber Smart Week material says AI can help criminals write convincing messages, impersonate people and personalise scams with information they find online. A scam could look or sound like someone you know. Its business guide adds that AI can be used to scrape public data off a company’s website.
The NCSC’s 2023/2024 threat report said fraud would likely become more frequent and sophisticated as AI tools such as voice cloning develop. So an urgent call from “the supplier” asking for money to a new account gets the same callback as a dodgy email, on a number you already hold.
The NCSC’s 2026 survey of small and medium businesses found 43% now think they’re vulnerable to a cyber attack, up from 34% the year before. Almost a third (32%) do nothing to train staff. The NCSC’s basics are keeping software updated, using multi-factor authentication, backing up data and making sure staff know how to recognise and respond to threats.
Not every con comes through the inbox. The Commerce Commission has taken High Court action against Top Reviews and Auckland Magazine, alleging the sites approach New Zealand businesses for favourable rankings while presenting their reviews as independent. It says the sites operate from overseas, and some “staff writers” were real people who didn’t know their identities were being used.
“Small businesses shouldn’t be misled into paying for favourable online rankings or feel pressured to pay because they believe their competitors are doing the same,” says Anne Callinan, the Commission’s deputy chair. The Commission is seeking declarations under the Fair Trading Act and an injunction, and the court hasn’t ruled on its claims.
Gaming your own reviews carries risk too. The District Court ordered The TV Shop to pay a $1,104,000 penalty for conduct that included staff posting positive reviews without disclosing their link to the business.
Your licence number is worth guarding as well. The public LBP register lets anyone check that a person is licensed, see their licence history and find out if they’ve been disciplined in the last three years.
Scams can be reported to the NCSC through Own Your Online, and businesses approached by ranking sites can report it to the Commerce Commission on 0800 943 600. The NCSC’s survey found 58% of businesses that didn’t report a threat thought it wasn’t significant enough, and it says even minor reports help it warn others.
Stay updated with the latest news by subscribing to our newsletter. Don’t miss out on valuable insights and exciting updates—sign up now to stay connected!
