{"success":true,"data":{"id":"studentaid-save-injunction-phish","label":"Fake SAVE Plan court injunction / student loan forgiveness status notice from non-official sender targeting federal borrowers — \"your SAVE payments are suspended — recertify your loans / update your income\" urgency harvesting FSA ID, SSN, and banking data","description":"Fake notice about the SAVE Plan court injunction and student loan forgiveness status from a non-official sender, targeting federal student loan borrowers. The SAVE (Saving on a Valuable Education) income-driven repayment plan was blocked by federal court injunctions in 2024-2026, creating widespread borrower confusion about payment status, forgiveness eligibility, and account recertification requirements. Attackers exploit this confusion with fake \"your SAVE Plan payments are suspended due to the court injunction — you must recertify your income / update your account by [date] or your loans will enter default\" emails impersonating studentaid.gov or loan servicers (MOHELA, Nelnet, Aidvantage, EdFinancial). The goal is harvesting FSA ID credentials, SSN, income documentation, and banking account details. Legitimate loan servicer communications use authenticated portals and never request credential updates via inbound email links. The signal fires when: (1) body references the SAVE plan, income-driven repayment, student loan forgiveness, loan cancellation, or PSLF AND (2) SAVE suspension / court injunction / recertification / payment restart urgency is present AND (3) sender is NOT studentaid.gov, ed.gov, mohela.com, nelnet.com, aidvantage.com, or edfinancial.com AND (4) no List-Unsubscribe or In-Reply-To. Source: GC1 R15 council #5; FTC student loan forgiveness scam alerts 2024-2026; CFPB SAVE plan borrower advisory Q2 2026.","tier":"danger","category":"phishing","isThin":false}}