{"success":true,"data":{"id":"fake-deel-contractor-payment-hold-lure","label":"Fake Deel contractor payment hold / KYC phishing — impersonates Deel with a payment-held or KYC-re-verification narrative harvesting contractor banking credentials + identity documents. Abnormal Security 2025-2026.","description":"Phishing emails impersonating Deel.com claiming a contractor payment has been held, frozen, or withheld pending KYC re-verification or compliance review, directing victims to a fake portal harvesting banking credentials and identity documents. Three-part detection: (1) Deel account / payment / contractor / compliance / KYC language, (2) payment-held / payout-frozen / KYC-required urgency, (3) submit-documents / complete-KYC / verify-identity CTA with off-deel.com link. Abnormal Security 2025-2026 documented Deel impersonation targeting freelancers and contractors; active campaigns confirmed. Deel processes payments for 35K+ companies across 150+ countries — payment-hold urgency is highly effective against contractors awaiting income.","tier":"danger","category":"scam","isThin":false}}