Useful tools
Small pieces of what we do, open to anyone. Paste, check, act. Site checks are kept under a job code so we can pick them up with you; pasted text is not kept, and the password one never leaves your browser.
These are quick checks, not audits. If one of them worries you, that is exactly what we are for: talk to us and a real person will look properly. How the website check keeps up with new threats, like PHP2Shell, is on the scanner page.
Scam alerts
Four things to watch this month, the one move that beats each of them, and a free check you can run in about a minute. Sources named on every card.
Netsafe reports of scammers pretending to be a bank more than doubled in August, from 21 to 46, a third of all scam reports. The fake IRD calls dried up as tax season ended and the same people changed costume.
Do this
Hang up. Ring the number on the back of your card. Nobody at your business moves money or reads out a code because of a call that came in.
The NCSC warns that normal, compromised websites are showing a fake Cloudflare or CAPTCHA check that copies a command to your clipboard and tells you to paste it to continue. Pasting it installs malware that steals saved passwords.
Do this
A real security check never asks you to paste or type a command. Close the tab. If you own a website, get it checked, because the sites doing this are ordinary ones running old plugins.
Thankyou Payroll customers had names, IRD numbers, bank details and payment histories accessed through a supplier's reporting tool, and Mathspace confirmed 1,079,819 students, parents and teachers affected. Scammers now have real details to quote back at people.
Do this
A caller or email knowing your real details is not proof they are who they say. Slow down on anything about pay, accounts or your kids' school. Paste the email into the scam check before you act.
The NCSC's SME tracker found three in four Kiwi businesses with 20 to 49 staff had a cyber incident in six months, and a third of small businesses do no staff training. The easiest way in is an email that looks like it came from the boss.
Do this
Find out whether anyone can send email as your domain. It takes a minute and the fix is usually a couple of DNS records.
Had one of these land? Paste it into the scam check before anyone clicks, or ask Atlas and she will open the right tool for you.