{"success":true,"data":{"id":"irs-cp2000-response-phish","label":"Fake IRS CP2000 (Automated Underreporter Inquiry) email requiring online response via link — real IRS CP2000 notices arrive exclusively by postal mail; the IRS never emails CP2000 links for payment or document upload.","description":"Fake IRS CP2000 (Automated Underreporter Inquiry) email requiring online response via a link. SACRED: 'cp2000' added to safety-keywords.ts to protect genuine CP2000 notices forwarded digitally by tax professionals. Real IRS CP2000 notices arrive EXCLUSIVELY by US postal mail — the IRS never sends CP2000 notices by email and never provides links for CP2000 payment, document upload, or online response. The CP2000 is sent when IRS records differ from the taxpayer's reported income (e.g., unreported 1099 income). Attackers exploit taxpayer anxiety about unreported income and potential penalties with \"CP2000 automated underreporter inquiry — respond online within 30 days or penalty will apply.\" Detection: CP2000/automated underreporter vocabulary + IRS brand reference + click-to-respond/pay/upload urgency + off-brand href (not irs.gov) + sender NOT on irs.gov/.gov + no In-Reply-To + no List-Unsubscribe. Source: GC1-R17; IRS phishing advisory IR-2025; FTC IRS impostor scam report.","tier":"danger","category":"phishing","isThin":false}}