{"success":true,"data":{"id":"freelance-w9-payment-phish","label":"Fake client/recruiter payment processing request demanding W-9 + ACH banking details via cold email — real freelance payments use authenticated AP portals (Bill.com / Tipalti / Coupa); cold W-9 + bank request is credential harvest.","description":"Fake client or recruiter payment processing request demanding W-9 tax form and ACH banking details via cold email — credential/banking detail harvest targeting freelancers and contractors. Real freelance payment processing uses authenticated accounts payable platforms (Bill.com, Tipalti, Coupa, Gusto) with verified vendor onboarding flows. Cold email from unknown or unverified sender demanding W-9 plus bank routing number \"to process your invoice\" is a banking detail theft lure. Detection: W-9 form/tax form vocabulary + ACH details/banking information/process payment action + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +3. Source: GC1-R20; IRS W-9 scam advisory; FBI contractor BEC advisory 2025.","tier":"danger","category":"phishing","isThin":false}}