Council pays $300k to scammers. The invoice looked genuine

Author: Mike Tweed,
Publish Date: Fri, 4 Sep 2026, 7:44am

Whanganui District Council have warned that organisations are not immune to scams. Photo / Bevan Conley

A nearly $310,000 scam targeting Whanganui District Council shows “anybody can fall victim”, Netsafe says.

The council identified in January 2023 that an international payment made the previous December had been sent to a fraudulent bank account.

The payment was meant to go to German-based company Velotrack, which was contracted to resurface the city’s velodrome.

Council chief strategy officer Sarah O’Hagan said scammers gained access to the company’s emails, intercepted an invoice and altered the bank account details to their own.

“Scams are increasingly sophisticated and organisations are not immune,” she said.

“We expected the invoice and it appeared to come from the business we were dealing with.”

Netsafe chief online safety officer Sean Lyons said the incident was not great for Whanganui ratepayers but showed anybody could fall victim to a scam.

“It’s not about not knowing enough, it’s not about your age, it’s not about all the things that people assume,” he said.

“In the right conditions and the right moment, we can be susceptible.”

Invoice manipulation was not uncommon and there was “an enormous amount of creativity” among scammers, Lyons said.

In February 2025, NZME reported a Waikato couple almost lost $270,000 after their lawyer’s email was hacked from the UK and payment was requested to a fraudulent account.

A bank teller prevented the transfer, but police confirmed the account had successfully scammed two other victims out of at least $250,000.

Netsafe chief online safety officer Sean Lyons.

“The distressing thing for us all is that scams like these are money-spinners for those at the other end,” Lyons said.

“People wouldn’t be doing this if it wasn’t worth their time and effort.

“This is one incident, but the same scam might have netted them five, 10 or 20 amounts that were similar or bigger.”

O’Hagan said as soon as the council became aware of the issue it was reported to police, national agency Cert NZ, the bank, insurers and Velotrack.

“Insurance, together with a $35,000 goodwill payment from Velotrack, covered most of the original $309,654 loss, reducing the council’s net loss to $24,654.”

Velotrack completed the $2.5 million job in September 2023.

Details of the incident could not be publicly disclosed at the time because of investigative and recovery processes, but it was publicly reported at a livestreamed risk and assurance committee meeting in May 2024, she said.

“A review of the incident resulted in improvements to processes which later helped stop an attempt to fraudulently obtain a payment.”

A report from the May 2024 meeting said there was another attempt to misdirect a $568,600 contract payment in March 2023.

It was from the same overseas party but targeted a New Zealand-based supplier.

“Council alerted the supplier and assisted them to engage with Cert and the police and to take the necessary action to secure the integrity of their systems.”

Netsafe said reports of scammers impersonating banks rose from 21 in July to 46 in August, and is urging people not to respond to unexpected calls, texts or emails claiming to be from their bank.

Scams could occur at different levels, from hacking company accounts to “a more scattergun” approach, such as spoofing an email and sending out invoices, Lyons said.

“If it’s a business invoice scam, ring the company and check their bank account details,” he said.

“Scammers will try and push us to act now. It’s a real hallmark of what they do.

“Take the time and resist the pressure, because that’s what can save you an awful lot of heartache.”

Mike Tweed is a multimedia journalist at the Whanganui Chronicle. Since starting in March 2020, he has dabbled in everything from sport to music. At present his focus is local government, primarily Whanganui District Council.