{"success":true,"data":{"id":"uscis-fee-deficiency-status-phish","label":"Fake USCIS or DHS immigration authority claiming an immigration application has a fee deficiency requiring immediate payment via email link or the case will be administratively closed or denied — credential-harvest and advance-fee attack; real USCIS fee deficiency notices are delivered by USPS and through authenticated myUSCIS accounts, never cold email payment links.","description":"Fake USCIS (U.S. Citizenship and Immigration Services) or DHS immigration authority claiming the target's immigration application has a fee deficiency, missing payment, or status alert that requires immediate action via email link or payment portal to prevent the case from being administratively closed, denied, or abandoned — credential-harvest and advance-fee attack exploiting the extreme anxiety associated with immigration status. Real USCIS fee deficiency notices are delivered via USPS first-class mail and through authenticated myUSCIS accounts at uscis.gov; cold inbound emails threatening case closure or denial for fee deficiency have been specifically flagged by DHS-CISA as a top government-fraud threat vector. The fee deficiency / case administratively closed / denied / pay immediately to preserve status pretext is particularly effective because immigration application errors can have life-altering consequences. Distinct from immigration-status-phish (general immigration pretext) and passport-renewal-phish (passport pretext) — this targets the USCIS fee deficiency / case administratively closed or denied / immediate payment required vocabulary. Detection: USCIS/immigration + fee deficiency/missing payment + case administratively closed/denied + pay immediately + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +5. Source: GC1-R30; DHS-CISA USCIS impersonation advisory 2025; USCIS anti-fraud bulletin; FTC immigration fee scam tracker; DOJ Office of Immigration Litigation fraud patterns.","tier":"danger","category":"phishing","isThin":false}}