How to report a crypto scam in New Zealand

If you have been scammed with cryptocurrency in New Zealand, do two things today: report it to Police through 105, and put the wallet addresses on the public record.

The Police report opens a criminal file. The public record works straight away — the address becomes visible to exchange compliance teams, to investigators, and to the next person about to send funds to it. Two different jobs, and neither covers the other.

The first hours matter more than anything that follows. Once the receiving addresses and hashes are written down, an exchange has something to act on, and that window closes fast.

Key takeaways

• Report the crime to New Zealand Police through 105 — online at the Police fraud, scam and cyber form, or by phone. That is the criminal complaint.
• A report to the National Cyber Security Centre at ncsc.govt.nz/report is a different act. The NCSC forwards your report to Police only if you consent to it.
• CERT NZ no longer exists as a reporting line. cert.govt.nz redirects to the NCSC and the 0800 CERT NZ number is gone. Everyone reports at ncsc.govt.nz/report or on 0800 114 115.
• Police will never phone you to ask about your crypto. Their July 2026 warning, on scammers posing as detectives to extract seed phrases: "Police will never make unsolicited requests for details about your crypto wallets, bank cards, PIN, seed phrases, or passwords on a phone call."
• The FMA publishes warnings and alerts on entities targeting New Zealanders — a before-you-pay check. Asked whether it can get your money back, the FMA answers: "No, we cannot help you to get your money back."
• Without destination addresses, transaction hashes and full screenshots, there is nothing in the report to work with.

What to do in the first hours

Stop sending money. Most people make one last payment because a tax, a fee, a "verification deposit" or a withdrawal release is supposedly outstanding. That money is gone, and the request itself tells you what you are dealing with.

Then, in this order:

1. Copy every destination address and transaction hash (TXID). They are in your wallet history or your exchange records. This is the most useful single item in the report.
2. Screenshot everything before it disappears. Full WhatsApp, Telegram or Messenger threads, the profile that contacted you, the platform's website, the dashboard showing your supposed gains. These sites come down within days.
3. Call your bank. If any part moved by bank transfer or card, tell them now and ask for a recall attempt. Banks work in hours.
4. Tell the exchange you bought or sent from. Give them the receiving address so they can flag it and act on it if the funds landed with them.
5. Report to Police through 105.

If you gave anyone your seed phrase, treat every wallet secured by it as compromised and move what is left to a new wallet with a new phrase. A seed phrase cannot be changed, only abandoned. And if you installed remote-access software on someone's instruction, remove it and change your passwords.

Where to report

New Zealand Police — 105

105 is the Police non-emergency number, and fraud, scam and cyber matters are explicitly among what it handles. Report online through the Police fraud/scam/cyber web form at webforms.police.govt.nz, or call 105. Use 111 if someone is in immediate danger.

One thing to know before you start. The Police form's own list of common online scams runs to phishing, job offers, death threats, inheritance and lottery — no investment or crypto category — and the evidence it names is bank statements, emails, texts and social media activity. Nothing asks for a wallet address. Put the addresses and hashes into the description yourself, with a timeline. Nobody will prompt you, and a report saying only "I was scammed online" carries no case.

If someone has been impersonating a Police officer, 105 is also how you check. The July 2026 campaign ran in two steps: a "detective" establishes whether and how you hold cryptocurrency, then hands you to a "representative" of the wallet or exchange, who walks you onto a fake support page and takes the seed phrase. Police advice: ask for the officer's details, hang up, ring 105 and ask that officer to call you back. Scammers spoof Police numbers and email addresses, so the callback is the only reliable test.

National Cyber Security Centre — ncsc.govt.nz/report, 0800 114 115

The NCSC takes reports from individuals as well as organisations; phishing makes up close to half of what it receives. It calls its approach "no wrong door": its partners include NZ Police, the Department of Internal Affairs, banks and telcos, and "if you need more help, and consent to it, we can forward your report to these agencies."

Read that clause carefully. An NCSC report is not a Police report — it becomes one only if you consent to the referral, and filing with 105 yourself is faster. Do both. The NCSC report feeds national alerts; the Police report is your case.

The CERT NZ question

If you have been told to report to CERT NZ, that advice has aged out. CERT NZ was folded into the NCSC, cert.govt.nz now redirects to ncsc.govt.nz, and the 0800 CERT NZ line went with the brand. One reporting line now serves everyone, individuals to critical infrastructure. Plenty of New Zealand scam guidance still names CERT NZ, and a victim following it loses an afternoon.

What documentation to gather

• Every destination wallet address you sent to
• The transaction hash (TXID) for each payment, with date and time
• Full, uncropped screenshots of every conversation
• The exact URL of the platform, the profile, the advert and the withdrawal page
• Bank statements, transfer receipts and your crypto purchase records
• Names, phone numbers, emails and social handles used to contact you
• The number the "officer" or "broker" called from, and any name or badge number given
• A written timeline: first contact, each payment, last contact

Check before you pay — the FMA warnings and alerts list

The Financial Markets Authority publishes a warnings and alerts library at fma.govt.nz — in its own words, "a list of businesses and individuals we recommend investors be wary of" — covering cold-calling offers, fake product disclosure statements, cryptocurrency operations and recovery scams.

Search it before you transfer to a platform you found through a message, an ad or a stranger. A name appearing there ends the conversation. A name not appearing there means nothing either way.

Why the FMA is not where your case gets resolved

New Zealanders lose weeks to this one.

The FMA regulates financial markets and will act against a licensed provider breaching its obligations. What it will not do is act for you. Its own FAQ puts the question and answers it: "Can the FMA get my money back?" — "No, we cannot help you to get your money back." Elsewhere on the same site: "we cannot assist individual investors," and it "will not be able to help you get your money back if the company or individual is based overseas."

Read that last clause again, because it describes almost every crypto case. And note where the FMA sends you instead. Under "How to report identity theft, financial crimes or fraud", its answer is "Contact the NZ Police."

Can I get my money back?

Sometimes. Considerably less often than the advertising suggests.

It comes down to one question: did the funds reach a service with compliance obligations — a centralised exchange, a payment processor — before they were dispersed? If they did, and a Police report exists, there is a path. Through a mixer, across chains, or into a platform in a jurisdiction that does not cooperate, that path narrows to almost nothing.

The bank-rail leg is the more recoverable half, and it has the shortest clock. On-chain, once the funds are off a regulated platform, nobody in New Zealand has a lever left.

Nobody can give you a percentage honestly. Anyone who does it over the phone, without having seen a single transaction, is selling something.

Beware of "fund recovery" offers

Weeks on, someone offers to get it back. Sometimes lawyers, sometimes contacts inside an exchange, inside Police, or inside the FMA — which has published warnings on recovery scams and on scams impersonating the FMA itself.

It is the same network, or someone who bought the victim list. The tells:

• They contacted you
• Money is required before anything happens
• The outcome is guaranteed
• There are supposed insider contacts

No New Zealand government agency asks for an advance payment to return your money.

Why put the address on the public record

A criminal file moves at the speed of a criminal file. A public record works immediately.

Post the address, the hash and the website on Chainabuse and that entry is visible to exchange compliance teams, to investigators, and to anyone searching that address before they transfer. Chainabuse is free, open to everyone, and aggregates reports against the same address — so isolated cases become a visible pattern.

Often the person it saves is the one who searches two weeks later and finds the warning.

Frequently asked questions

1. Where do I report a crypto scam in New Zealand?

Report it to New Zealand Police through 105 — online via the Police fraud, scam and cyber form, or by phone. Use 111 if someone is in immediate danger. You can also report to the National Cyber Security Centre at ncsc.govt.nz/report, a separate act.

2. Is a report to CERT NZ or the NCSC the same as reporting to Police?

No. CERT NZ is fully integrated into the NCSC and cert.govt.nz redirects there, so reports go to ncsc.govt.nz/report or 0800 114 115. The NCSC forwards your report to Police only if you consent to it, so filing with 105 yourself is the reliable route.

3. Would Police ever ring me about my cryptocurrency?

No. In July 2026 Police warned about scammers posing as detectives to obtain wallet details, stating that Police will never make unsolicited requests for your crypto wallet details, bank cards, PIN, seed phrases or passwords on a phone call. If in doubt, hang up, call 105 and ask for a callback.

4. Can the FMA get my money back?

No. Asked that exact question, the FMA's own answer is "No, we cannot help you to get your money back," and it says it cannot assist individual investors. Its warnings and alerts list is a check to run before you pay. Your case goes to Police through 105.

5. I gave someone my seed phrase — what now?

Treat every wallet secured by that phrase as compromised. A seed phrase cannot be changed, only abandoned, so create a new wallet and move anything remaining. Then report to Police through 105.

6. Is it worth reporting if I only lost a small amount?

Yes. These operations run at scale and the same receiving address collects from dozens of victims. A small report can be the entry that links the rest.

7. Does reporting to Chainabuse replace the Police report?

No — do both. The 105 report opens a criminal file in New Zealand. The Chainabuse report makes the address visible to exchanges and investigators in every country the money might reach.