Crypto is high risk. You can lose everything you put in. Nothing here is financial advice.
Keeping crypto safe in New Zealand: scams, security, and what to do when it goes wrong
Updated July 2026 · 9 min read
Most crypto losses in NZ are not exchange hacks, they are ordinary people talked or tricked out of their own money. The good news: a handful of boring habits stops nearly all of it. Here are the scams doing the rounds, the checklist, and the NZ-specific places to get help.
The scams actually hitting New Zealanders
1. The "investment manager" romance or friendship scam (pig butchering)
Someone friendly appears: dating app, Facebook, a wrong-number text that turns into a chat. Weeks of rapport, then a casual mention of their crypto trading success and an offer to show you. You "invest" through their platform, the dashboard shows beautiful profits, small withdrawals even work. Then comes the pressure to go big, and when you try to withdraw, there are suddenly "taxes" and "fees" to pay first. The platform was fake from minute one. This is the single biggest crypto loss category in NZ. Anyone who befriends you and then brings up investing is running this script. No exceptions.
2. Fake celebrity and news-site endorsements
Ads and spoofed news articles claiming a well-known Kiwi got rich on a trading platform. The linked "platform" is a scam that harvests deposits and card details. No celebrity endorsement of a trading platform you see in an ad is real.
3. Impersonation "support"
You post a question in a Telegram, Discord or Facebook group, and "support" DMs you offering help, eventually needing your seed phrase or remote access to "fix" things. Real exchange support never DMs first, never asks for your seed phrase, and never needs AnyDesk or TeamViewer on your machine.
4. Phishing sites and poisoned ads
Fake login pages for real exchanges, promoted to the top of search results. You type your credentials into the wrong mexc-dot-something and the real account is emptied. Bookmark your exchange once and only ever use the bookmark.
5. Giveaway and doubling scams
"Send 0.1 BTC, receive 0.2 back" from a hacked or lookalike account of someone famous. It is 100% theft, every time, and always will be.
The 20-minute security checklist
Unique password per exchange, from a password manager. Reused passwords are how "hacks" mostly happen.
App-based 2FA (Google Authenticator style) on every account. Not SMS: SIM-swap attacks defeat text codes.
Set an anti-phishing code where offered (MEXC and most majors have this) so genuine emails carry your chosen word.
Withdrawal allow-list: lock withdrawals to your own addresses so a thief with your login still cannot send funds anywhere new without a time-delayed approval.
Bookmark your exchange, never search for it.
Separate email for crypto, itself protected with 2FA. Your email is the master key to everything else.
Self-custody for long-term holdings, hardware wallet for real money. See wallets explained.
Seed phrase on paper or steel only. Never photographed, never in the cloud, never typed into a website.
Test transactions first, every time you send to a new address.
Keep quiet about your holdings. New Zealand is a village, and people who talk about their bags get targeted.
Trading somewhere with real security tooling matters
Whatever platform you use, it needs app 2FA, anti-phishing codes and withdrawal allow-lists. MEXC has all three, our review covers how to switch them on during signup.
Anyone asking for your seed phrase or 2FA codes, for any reason, ever.
Pressure and urgency: "the window closes tonight".
Payment demanded in crypto for anything unrelated (IRD bills, fines, visa fees: government agencies never take crypto).
A withdrawal that requires paying a "tax" or "release fee" first. That is the scam confirming itself.
Unsolicited contact about investing, full stop.
If something has already gone wrong
Stop all contact and send no more money, especially not "recovery fees". Fake recovery agents are the scam's second act.
Secure what is left: change passwords, rotate 2FA, move remaining funds to fresh addresses.
Tell your bank immediately if cards or transfers were involved, fast action sometimes claws money back.
Report it: CERT NZ (cert.govt.nz) for online incidents, Netsafe (netsafe.org.nz), the FMA (fma.govt.nz) for investment scams, and NZ Police via 105 for theft. Reports also protect the next person.
Be realistic about recovery: on-chain transfers are final. Anyone promising to get your crypto back for an upfront fee is scammer number two.
Security is not paranoia, it is a checklist you do once plus three habits: bookmark, test send, tell no one. Do that and you are safer than 95% of crypto users.