{"success":true,"data":{"id":"corporate-401k-enrollment-phish","label":"Fake 401(k) open enrollment window closure requiring portal credential entry — real 401k enrollment goes through the plan administrator's authenticated portal (Fidelity / Vanguard / Empower), not cold email.","description":"Fake 401(k) open enrollment window closure email requiring portal credential entry — \"enrollment window closes Friday, sign in now to confirm your contribution elections.\" Real 401k enrollment is conducted through the plan administrator's authenticated portal (Fidelity, Vanguard, Empower) — employees are NEVER asked to enter credentials via cold inbound email. Detection: 401k/retirement enrollment vocabulary + sign-in/login prompt + deadline urgency + no In-Reply-To + not protected sender. Trash score: +3. Source: GC1-R19; DOL 401k phishing advisory 2025; SHRM benefits security alert.","tier":"danger","category":"phishing","isThin":false}}