{"success":true,"data":{"id":"bank-account-reverification-phish","label":"Fake Plaid-style bank account re-link — \"linked bank account expired, reconnect now\" credential-harvest lure; real bank account linking is done inside the authenticated app, not via cold email.","description":"Fake Plaid-style bank account re-link email — \"your linked bank account has expired or disconnected, please reconnect it now\" credential-harvest lure. Real bank account linking is done inside the authenticated app or financial portal, not via cold inbound email. Attackers mimic Plaid, Yodlee, or bank brand aesthetics to steal OAuth tokens or credentials. Detection: bank account re-link/disconnected/reverify vocabulary + href present + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R19; Plaid security advisory; FBI financial credential theft advisory 2025.","tier":"danger","category":"phishing","isThin":false}}