{"success":true,"data":{"id":"auto-loan-balloon-phish","label":"Fake auto / vehicle loan balloon payment due-date lure — \"Your vehicle loan balloon payment of $X,XXX is due on [date] — pay now or your vehicle will be repossessed / reported to credit bureaus.\" Real balloon payment notices come from the lender's official domain established at loan origination, with proper account identification. Cold inbound email + balloon payment + repossession threat + off-brand payment link is a strong phishing indicator. Detection: balloon payment + auto/vehicle loan language + repossession/due urgency + no In-Reply-To + no List-Unsubscribe. Source: GC1 R16; CFPB auto loan fraud advisory 2025.","description":"Fake auto / vehicle loan balloon payment due-date lure impersonating a lender or captive finance company. Balloon payment auto loans have a large lump-sum due at term end — a stressful event making borrowers susceptible to urgency lures. Attackers claim \"balloon payment due now — pay or face repossession and credit bureau reporting.\" Real balloon payment notices come from the originating lender's official domain with proper account identification, never cold inbound email from an unknown domain. Signal fires when: (1) balloon payment AND (2) auto/vehicle/car loan AND (3) repossession / overdue / credit report urgency AND (4) no In-Reply-To AND (5) no List-Unsubscribe. Source: GC1 R16; CFPB auto lending fraud advisory 2025.","tier":"danger","category":"phishing","isThin":false}}