New Zealand
New Zealand’s bank scam compensation: what the Code of Banking Practice commitments mean for you
Since 30 November 2025, New Zealand banks have committed — through the amended Code of Banking Practice — to five anti-scam obligations, with compensation of up to NZ$500,000 for scam victims where a bank failed to meet them. NZ banks now carry direct financial exposure for the scams their controls miss.
Last reviewed: July 20, 2026
- NZ$500,000
- maximum compensation where a bank failed its anti-scam commitments under the amended Code of Banking Practice
- Source: NZBA
- 30 Nov 2025
- the amended Code’s five anti-scam commitments took effect
- Source: NZBA
- 23,000+
- malicious domains blocked in the cross-sector anti-scam pilot, alongside an estimated NZ$23.8m in prevented scam losses
- Source: MBIE / Anti-Scam Alliance
This is an industry code, not a statute — but it is a real commitment with real money attached, and the direction of travel is regulatory. The Ministry of Business, Innovation and Employment (MBIE) is coordinating the Anti-Scam Alliance, whose 2026 work programme includes building a framework for mandatory sector-specific scam codes. The cross-sector pilot that preceded it treated domain-level detection as a core intervention, blocking more than 23,000 malicious domains. For New Zealand banks and the brands scammers impersonate to reach their customers, the practical question is how quickly impersonation infrastructure is found once it goes live.
What changed on 30 November 2025
The amended Code of Banking Practice commits New Zealand banks to five anti-scam obligations — pre-payment warnings, responding to high-risk transactions, 24/7 scam reporting, inter-bank information sharing and payment freezing, and confirmation-of-payee checks. Where a bank failed those commitments and a customer lost money to an authorised-payment scam, compensation of up to NZ$500,000 can follow. It is an industry code rather than legislation — but it attaches direct financial liability to missed scams.
Where the regime is heading
The government’s Anti-Scam Alliance, coordinated by MBIE, published a 2026 work programme that includes building a framework for mandatory sector-specific scam codes — a move from voluntary commitments toward binding obligations, in the direction Australia has already taken. The cross-sector pilot that ran ahead of it blocked more than 23,000 malicious domains, evidence that New Zealand’s anti-scam approach treats domain-level detection as a core intervention rather than an afterthought.
How continuous detection maps to the commitments
Impersonation scams reach customers through lookalike domains and cloned pages carrying a bank’s or a brand’s identity. Detecting that infrastructure early — before it is used in an authorised-payment scam — is the front line of the prevention the Code commits banks to, and a documented detection record supports the response obligations when something does get through.
How impersona.io helps
impersona.io generates 180+ permutations of your domain and checks each against live DNS and registration data, captures takedown-ready evidence, and alerts you when a new lookalike or certificate appears. It works in English out of the box, is transparently priced and self-serve, and your first brand check is free.
Frequently asked questions
What is New Zealand’s scam compensation regime?
Since 30 November 2025, the amended Code of Banking Practice commits New Zealand banks to five anti-scam obligations, with compensation of up to NZ$500,000 where a bank failed those commitments and a customer lost money to an authorised-payment scam.
Is it law?
Not yet. The Code of Banking Practice is an industry code, not a statute. But MBIE’s Anti-Scam Alliance 2026 work programme includes building a framework for mandatory sector-specific scam codes, so a binding version is in the pipeline — we frame it honestly as a code with real financial commitments attached.
Does New Zealand’s approach treat domains as part of scam prevention?
Yes, in practice. The cross-sector pilot ahead of the Anti-Scam Alliance blocked more than 23,000 malicious domains — domain-level detection and blocking sit at the centre of New Zealand’s anti-scam programme.
Is impersona.io’s EU hosting a problem for a New Zealand buyer?
For most NZ buyers it is a non-issue. Data is stored and processed in the EU (Frankfurt) and encrypted in transit and at rest. If you need in-region hosting for a regulated use case, ask us — we will be straight about current limits rather than overpromise.
Do I have to talk to sales?
No. impersona.io is fully self-serve with transparent pricing — you can pay in your local currency at checkout — and your first brand check is free, no demo call required.
Other regions
See your own exposure first
Your first brand check is free. It generates roughly 160 permutations of your domain and checks them against live DNS and domain registration data.