IRD News - April 2026

Two-step Verification helps contain cyber attack

Since October 2025, two-step verification (2SV) has been available for all myIR users. Inland Revenue Department (IRD) recently published an article explaining how 2SV helped contain a coordinated, automated attempt by cyber criminals to access myIR accounts.

In March 2026, IRD noticed a significant increase in malicious attempts to log on to myIR, with more than 500,000 attempts recorded.

Not all users had set up 2SV. Around 300 myIR accounts were accessed where 2SV was not enabled. IRD advises these accounts have been closed. IRD is also monitoring up to 900 accounts where a correct password was entered, but two-step verification prevented access.

IRD is contacting the 300 affected customers to notify them of the unusual activity. IRD believes that “people had used the same credentials (username and password) on their myIR account as they use on other, less secure, sites.”  Usernames and passwords from less secure sites are often shared and sold online. This is why it’s important to use a unique password for every account.

If you receive a message from IRD saying there has been a log on to your account and it wasn’t you, contact IRD immediately.

CG Comment:  If you haven’t set up 2SV on your myIR account, we recommend doing this as soon as possible. IRD’s step-by-step instructions are here. If you’re a client of Chester Grey and would like help, please give us a call.

Nonpayment of PAYE is a serious offence

Inland Revenue Department (IRD) is warning employers that deducting PAYE from an employee’s salary or wages, but not paying it to IRD, is a serious offence and can lead to a prison sentence.

IRD has issued a Revenue Alert on the failure by some employers to pay PAYE deductions. Revenue Alerts are issued by the Commissioner of Inland Revenue (CIR) to highlight significant or emerging tax issues.

Employers must pay PAYE and other amounts deducted from employees’ salary or wages to Inland Revenue by the due date. This includes deductions for KiwiSaver and student loans.

Making deductions and failing to pay them to Inland Revenue carries a maximum sentence of up to 5 years in prison.  Anyone who aids, abets, incites, or conspires with another person to do this also commits a criminal offence. For example, a company director who decides the company will not pay deductions to Inland Revenue may be prosecuted for the company’s failure to pay.

Inland Revenue has successfully prosecuted a number of people for this type of offending, and several were sent to prison.

In a case described as “the worst tax offending of its kind” seen in Christchurch, a woman was jailed for three years for taking $1,602,864.17 from employees’ wages and not passing it on to IRD.

A company director also returned from Australia last year to face PAYE charges rather than face extradition.

CG Comment: If you think you may not be able to pay by the due date, contact Inland Revenue before the due date (or as soon as possible). Inland Revenue may agree to a payment plan (an instalment arrangement) and will consider the options available based on your circumstances. If you would like more information about employer responsibilities and you are a client of Chester Grey, please contact your accountant to discuss.

Crypto Investors urged to get tax compliant

Inland Revenue Department (IRD) are reminding people who invest in crypto-assets that they need to get tax compliant now, so they don’t face an expensive surprise later.

IRD has identified 355,000 unique crypto-asset users in New Zealand, completing around 57 million transactions valued at $36 billion.

For tax purposes, crypto-assets are treated as property. Amounts earned from selling, trading, or exchanging crypto-assets may be taxable. Any profit is generally treated as income, added to your other annual earnings, and taxed at your marginal tax rate.

If you’re earning money from crypto-assets, make sure you understand (and meet) your tax obligations and the risks of not declaring taxable activity.

With increased access to data, IRD have been able to identify people with significant crypto-asset activity. New Zealand is also implementing the Crypto-Asset Reporting Framework (CARF).

Through CARF and annual exchanges of information with other tax authorities, IRD will also receive details of overseas crypto-asset transactions and transfers involving New Zealand tax residents.  Overall, CARF increases transparency in the crypto sector and supports tighter enforcement.

Inland Revenue will match this information to tax returns and follow up on any discrepancies. IRD also notes it has tools and analytics capabilities to identify and investigate crypto-asset activity.

IRD has sent an initial batch of letters to people who are usually assessed automatically and who IRD knows have traded on one or more crypto-asset exchanges.

The letter gives people who earned income from disposing of crypto-assets (including selling, swapping, or exchanging) an opportunity to review their tax position and correct any errors by filing an Individual income tax return (IR3).

More information is available on IRD’s webpage “Declare cryptoasset income or a loss”.

CG Comment:  If you have any questions about your crypto-assets, and are a client of Chester Grey, please contact your accountant to discuss.