{"success":true,"data":{"id":"investment-portfolio-authorization-phish","label":"Fake brokerage or financial advisor requesting urgent email-link authorization for a portfolio rebalancing, IRA rollover, or withdrawal — real brokerages require authenticated portal approval.","description":"Fake brokerage, financial advisor, or wealth management firm requiring urgent email-link authorization for a portfolio rebalancing, IRA rollover, or large withdrawal — credential harvesting or unauthorized-transaction authorization attack. Real brokerages require authenticated portal approval and FINRA-mandated written authorization for large transactions; email-only approval requests are never valid. Detection: portfolio rebalancing/IRA rollover/investment transfer authorization vocabulary + authorize/approve/confirm transaction action + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R21; FINRA investment fraud advisory; SEC investor alert on unauthorized transaction emails.","tier":"danger","category":"phishing","isThin":false}}