The email looks like IRD. The link looks like IRD. And the login page looks exactly like myIR. For most New Zealanders, there are no visual cues that anything is wrong — until they check their bank account and find their tax refund has been redirected somewhere else entirely.
Fake myIR login pages are the delivery mechanism at the end of most IRD phishing campaigns. Understanding how they work — technically and psychologically — is what separates staff who get caught from staff who don't.
How attackers clone a login page
Creating a convincing fake myIR portal takes less than an hour with the right tools. The process:
Step 1: Clone the real page — Automated tools like HTTrack or simple browser developer tools allow attackers to download an exact copy of the myIR login page, including all HTML, CSS, images, and fonts. The visual result is pixel-perfect.
Step 2: Register a lookalike domain — The attacker registers a domain designed to pass a quick glance: 'myir-ird.nz', 'ird-myir.co.nz', 'inland-revenue.net.nz', or increasingly, internationalised domain names that use visually similar Unicode characters ('ırd.govt.nz' with a dotless i, for example).
Step 3: Host the clone — The cloned page is hosted, often on legitimate cloud infrastructure (AWS, Cloudflare, Google Cloud) to avoid IP-based blocklists.
Step 4: Capture credentials — The login form is modified so that when a victim enters their username and password, the details are sent to the attacker's server. The victim is then redirected to the real myIR site, where they log in successfully — believing the first attempt simply failed.
The entire credential capture happens in milliseconds. By the time the victim is looking at their real myIR dashboard, the attacker already has their login details.
Why even careful users get caught
Three design choices make fake myIR pages unusually effective:
The redirect to the real site — Most phishing awareness training teaches people to look for error messages or odd behaviour after logging in. When the fake page silently redirects to the real myIR and the victim successfully logs in, there's no obvious signal that anything went wrong. The tell is absent.
HTTPS and padlock icons — Many people have been taught that a padlock in the browser address bar means a site is safe. It doesn't — it means the connection is encrypted. Attackers routinely obtain valid SSL certificates for their fake domains. A padlock on 'myir-ird.nz' means your connection to a scam site is encrypted.
Mobile browsing hides the URL — On a smartphone, the browser address bar often shows only the page title or a truncated URL. The full domain — the one piece of information that would expose the scam — is hidden by default. This is why IRD smishing (which drives mobile traffic) converts at higher rates than desktop campaigns.
The one reliable check: the address bar
All of the visual similarity between the fake and real page collapses at a single point: the URL. The real myIR login page is at:
> 'https://myir.ird.govt.nz'
Any variation — any additional words, hyphens, different TLD, or character substitution — is a fake. Train staff to check the full URL before entering any credentials, on any device. This is the single most reliable defence against cloned login pages.
What to look for:
- 'myir.ird.govt.nz' ✓ Real
- 'myir-ird.govt.nz' ✗ Fake (hyphen added)
- 'ird.myir.co.nz' ✗ Fake (wrong TLD)
- 'myir.ird.net.nz' ✗ Fake (wrong domain)
- 'myir.ird.govt.nz.tax-refund.com' ✗ Fake (real domain as subdomain of scam domain)
The last example is particularly effective because it starts with the legitimate domain — most people stop reading after 'govt.nz'.
What attackers do with harvested myIR credentials
The most common use of stolen myIR credentials is immediate account manipulation:
Bank account redirection — The attacker logs in and changes the bank account number on file. IRD processes the legitimate refund, which goes to the attacker's account. By the time the victim notices, the funds are gone.
Identity document access — myIR contains a significant amount of personal information that can be used for further identity fraud: legal name, date of birth, address history, IRD number, employment history, and income data.
Business account access — If the victim is a business owner or accountant with access to employer accounts, the attacker gains access to employee payroll data, PAYE records, and potentially multiple IRD numbers.
Credential stuffing — The attacker tests the same email/password combination against banking apps, email providers, and other services. A significant proportion of New Zealanders reuse passwords across multiple accounts.
The broader lesson for businesses
Fake login pages aren't unique to IRD. The same technique is used for Microsoft 365, ANZ, BNZ, Westpac, myGov (Australia), and any other platform with a login page that's worth cloning. The defence is identical in every case: verify the domain in the address bar before entering credentials.
For businesses, the risk of an employee falling for a cloned login page extends beyond their personal IRD account. Password reuse means a compromised personal account can open a path into corporate systems. A staff member who enters their work email password into a fake Microsoft 365 login page has potentially handed an attacker access to your entire email tenant.
See our post on business email compromise in NZ for how attackers use credential harvesting as the entry point to BEC attacks.
Making this concrete in training
The most effective way to train staff on fake login pages is to show them one. A simulated phishing exercise using a cloned myIR-style page — where the "payload" is a training page rather than a credential harvest — gives employees the muscle memory of checking the URL before they're faced with the real thing.
SecureAZ simulations include cloned-page scenarios using NZ-specific templates. Start a free trial to run your first IRD-themed simulation before tax season.