{"success":true,"data":{"id":"pension-early-withdrawal-phish","label":"Fake pension fund, 401k, or 403b administrator claiming a hardship withdrawal or emergency lump-sum rollover has been approved and requiring bank account verification via email link — real retirement distributions never require email-link bank updates.","description":"Fake pension fund, 401k, or 403b plan administrator claiming a hardship withdrawal, emergency early access, or lump-sum rollover has been approved and requiring bank account and routing number via email link for disbursement — targets retirement savers. Real retirement distributions are initiated through authenticated plan administrator portals (Fidelity, Vanguard, Empower) and require written authorization; cold emails demanding bank credentials to disburse retirement funds are credential-harvest and bank-takeover attacks. Detection: pension/401k/403b hardship withdrawal/emergency/lump-sum approved + verify bank/provide routing/submit banking for retirement vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R23; DOL 401k phishing advisory; SEC retirement account credential harvest warning 2025.","tier":"danger","category":"phishing","isThin":false}}