{"success":true,"data":{"id":"fake-claude-pro-billing-phish","label":"Fake Anthropic Claude Pro or Teams subscription billing failure or account suspension phishing","description":"Fake Anthropic / Claude Pro billing or account-suspension phishing. Claude Pro ($20/month) and Claude Teams ($25/seat/month) are growing high-value targets for billing-impersonation attacks. The phish narrative arrives as: \"Your Claude Pro subscription payment has failed — update your billing information within 48 hours or your Pro access will be revoked,\" or \"Anthropic Teams billing notice: an unauthorized charge was detected on your account. Verify your payment method to keep API access active.\" Real Anthropic billing emails originate from @anthropic.com or @claude.ai with Anthropic DKIM; impersonation emails arrive from generic hosting domains. The signal fires when: (1) body references Claude, Claude Pro, Claude Teams, Claude API, or Anthropic brand AND (2) a billing-failure / subscription-suspension / payment-update narrative is present AND (3) sender is NOT anthropic.com or claude.ai. Source: GC1 R12 council #4; Anthropic abuse reports 2025-2026; Cofense phishing intelligence Q2 2026.","tier":"danger","category":"phishing","isThin":false}}