Half of New Zealand’s small and medium-sized businesses have interacted with a scam attempt in the past year, raising concerns that staff are increasingly becoming the primary target for fraudsters.
New research from BNZ’s SME scam survey shows 64% of SMEs believe scam activity has increased over the past 12 months, yet 45% do not see cyber education as a priority. BNZ says this disconnect is leaving businesses exposed despite growing awareness of the risks.
Margaret Miller, BNZ head of fraud operations, said scammers are shifting their focus to people rather than systems.
She said: “Business owners are alert to the danger, but they are also time-poor and juggling multiple priorities. The reality is that scammers are becoming increasingly sophisticated in their tactics. Scammers know that breaking through technical security is difficult, so in many cases they’re bypassing the technology entirely and targeting the person sitting at the keyboard.” Miller said many business owners have strong technical controls, but criminals are targeting staff processing invoices or answering calls.
The consequences can be significant when an attempted scam becomes a breach. Of the SMEs that were successfully targeted, 21% suffered a business financial loss, 26% experienced a personal financial loss and 30% reported data loss.
Miller said: “For those that did suffer a financial hit, the average loss was just over $5,000. Scammers aren’t just after your business accounts. The data shows they are often successful in targeting personal finances or the business’s data, even if they don’t manage to steal money directly from the company accounts.”
The data shows scammers are relying on traditional tactics rather than sophisticated cyber-attacks. Only 2% of businesses were hit by ransomware, while 27% received cold calls seeking sensitive information, 17% faced bank impersonation attempts and 10% encountered invoice scams involving altered bank details.
Miller said fraudsters exploit busy periods and distraction. She noted that although 53% of business owners rated themselves as prepared, nearly half of that group still engaged with a scam.
BNZ is urging businesses to make better use of available tools and training to reduce the risk of human error.
Miller said the bank continues to invest in systemic protections but emphasised practical steps organisations can take. She said BNZ provides two-step authentication for logins and options requiring two separate approvals for payments, helping close the gap between technology and behaviour.