{"success":true,"data":{"id":"nonprofit-donor-receipt-spoof","label":"Fake nonprofit / charity donation receipt from a freemail domain (gmail, yahoo, hotmail) with both urgency language and a payment link — real donation receipts are proof of payment already made and never contain payment links.","description":"Fake nonprofit or charity donation receipt sent from a freemail domain (gmail.com, yahoo.com, hotmail.com, outlook.com, icloud.com) with BOTH urgency language AND a payment link. This is a SACRED dual-nature signal — real nonprofit donation receipts are protected by safety-keywords.ts ('tax receipt', 'donation receipt'). This signal fires ONLY on the fake variant where all three conditions hold simultaneously: (1) sender is freemail, (2) charity/nonprofit/foundation/tax-receipt language, (3) urgency language, AND (4) a payment link in the body (donate, payment, give, contribute, gofundme, paypal, venmo, cashapp, etc.). Legitimate nonprofits send receipts from their own domain and NEVER include a payment link in a donation receipt — the receipt is proof of payment already made. A freemail sender with urgency + payment link + charity language is a donation-harvesting or charity-impersonation scam. Detection: freemail sender domain + charity/nonprofit vocabulary + urgency language + payment-link href + no In-Reply-To. Source: GC1-R17; FTC charity scam advisory 2025; IRS donor acknowledgment requirements.","tier":"warning","category":"scam","isThin":false}}