{"success":true,"data":{"id":"sender-display-name-all-caps","label":"From display name is all-caps multi-word — scare-tactic spam fingerprint (\"URGENT ACCOUNT UPDATE\")","description":"The From header's display name is a multi-word, all-uppercase string — e.g. `\"URGENT ACCOUNT UPDATE\" <x@random-host>` or `\"FINAL NOTICE\" <spam@evil>`. Spam and scare-tactic marketing emails lean on ALL CAPS display names because they read as \"shouting\" in the inbox list and grab attention before the user registers the sender. Legitimate senders use title case or sentence case — \"Amazon\", \"Sarah Jones\", \"Stripe Support\". Detection requires three conditions: the display name has 2+ whitespace-separated tokens (single-word brands like \"WALMART\" or \"IBM\" are excluded); the letter count is ≥ 6 after stripping punctuation (excludes very short multi-word names like \"US TAX\"); every letter is uppercase with no lowercase letters anywhere (distinguishes from mixed-case \"NBC News\"). A few legit brands write multi-word names all-caps (\"BANK OF AMERICA\", \"UNITED STATES POSTAL SERVICE\", \"US ARMY\"), so the weight is kept at +2 moderate-low — the signal pairs with other evidence like DMARC pass or trusted-sender-type whitelist protection rather than solo-triggering on BoA emails.","tier":"warning","category":"sender","isThin":false}}