{"success":true,"data":{"id":"student-loan-forgiveness-action-required-phish","label":"Fake Department of Education or federal loan servicer claiming student loan forgiveness has been approved but requires bank account details submitted within 48 hours to receive the credit — bank-account-takeover attack; real forgiveness notifications come through authenticated studentaid.gov accounts, never cold email banking requests.","description":"Fake Department of Education or federal student loan servicer (impersonating Federal Student Aid, MOHELA, Navient, AIDVANTAGE, Nelnet, or EdFinancial) claiming the target has been approved for student loan forgiveness, cancellation, or discharge but must verify bank account details or submit personal information via email link within 48 hours to receive the credit or disbursement — bank-account-takeover and PII-harvest attack exploiting high national salience of student loan forgiveness programs. Real student loan forgiveness notifications come through authenticated FSA accounts at studentaid.gov and official servicer portals; cold emails claiming \"your loans are forgiven — submit bank details within 48 hours\" are account-takeover attacks. The combination of \"forgiveness approved\" with a 48-hour action deadline for banking details is a consistent fraud pattern flagged by the CFPB, DOE Office of Inspector General, and FTC. Distinct from irs-tax-refund-deposit-phish (tax refund pretext) — this targets the student loan forgiveness approved / submit bank account details / 48-hour action required pretext. Detection: student loan forgiveness approved + bank account details + action required within 48 hours + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R30; CFPB student loan forgiveness scam alert 2025; DOE OIG student aid fraud advisory; FTC student loan relief scam tracker.","tier":"danger","category":"phishing","isThin":false}}