{"success":true,"data":{"id":"aca-health-insurance-cancel-phish","label":"Fake ACA marketplace or health insurance administrator claiming coverage will be cancelled unless income or enrollment is verified via email link — credential-harvest attack; real ACA coverage changes are communicated through healthcare.gov or state marketplace portals, never cold email links demanding income verification to prevent cancellation.","description":"Fake ACA (Affordable Care Act) marketplace administrator or health insurance notice claiming the recipient's marketplace health insurance plan will be cancelled unless income or enrollment details are verified via email link to maintain coverage — credential-harvest attack targeting health insurance anxiety. Real ACA enrollment changes, income reconciliation, and coverage decisions are communicated through the official federal marketplace (healthcare.gov) or state marketplace portals (e.g., Covered California, NY State of Health); they never require income or enrollment re-verification via cold inbound email link threatening imminent cancellation. Distinct from medicare-advantage-switch-period (Medicare Advantage enrollment) and employee-benefits-open-enrollment-phish (employer plan enrollment) — this specifically targets the individual ACA marketplace cancellation pretext. Detection: ACA/affordable care act/marketplace plan/health insurance cancel/suspend + verify income/enrollment to maintain coverage vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +3. Source: GC1-R25; CMS ACA marketplace consumer protections; HHS OIG health insurance fraud advisory 2025; FTC ACA impersonation scam patterns.","tier":"danger","category":"phishing","isThin":false}}