{"success":true,"data":{"id":"google-workspace-billing-suspension-phish","label":"Fake Google Workspace / Microsoft 365 billing suspension notice from off-brand domain — credential harvest targeting IT admins and business owners; real billing alerts come from official admin portals.","description":"Fake Google Workspace or Microsoft 365 billing suspension notice from a non-official domain — credential harvest and payment fraud targeting IT admins and business owners. Real Google Workspace billing alerts come from workspace.google.com authenticated email; Microsoft 365 billing alerts from microsoft.com. Off-brand sender claiming workspace suspension due to payment failure + \"update payment/verify billing\" CTA is phishing. Detection: Google Workspace/M365/Office 365 suspension vocabulary + update payment/verify billing/prevent suspension action + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R20; Google Workspace Trust & Safety advisory; Microsoft security bulletin.","tier":"danger","category":"phishing","isThin":false}}