{"success":true,"data":{"id":"save-plan-forbearance-phish","label":"Fake SAVE plan / Federal Student Aid forbearance urgency phishing targeting student loan borrowers","description":"Fake Federal Student Aid / SAVE plan forbearance urgency phishing targeting student loan borrowers. The SAVE (Saving on a Valuable Education) income-driven repayment plan faced court injunctions in 2024-2025 that created widespread confusion among 8M+ enrolled borrowers about payment obligations, forbearance periods, and re-enrollment deadlines. Attackers exploit this confusion with phishing emails impersonating Federal Student Aid, the Department of Education, or loan servicers (Mohela, Aidvantage, Navient, Nelnet) claiming: \"Your SAVE plan enrollment is at risk due to the court injunction — re-enroll now to avoid interest capitalization,\" or \"Your forbearance period is ending — update your income information immediately to avoid loan default.\" Real student loan servicer communications arrive from verified .gov or known servicer domains; unsolicited emails with urgent SAVE plan action requests from non-.gov senders are a phishing tell. The signal fires when: (1) body references the SAVE plan, Federal Student Aid, income-driven repayment, or a loan servicer brand AND (2) forbearance urgency, re-enrollment deadlines, or loan-default avoidance framing is present AND (3) sender is NOT from a .gov, @mohela.com, @aidvantage.com, @navient.com, or @nelnet domain AND (4) no List-Unsubscribe or In-Reply-To header. Source: GC1 R13 council #7; CISA SAVE-plan phishing advisory 2025; Federal Student Aid fraud alert 2025.","tier":"danger","category":"phishing","isThin":false}}