{"success":true,"data":{"id":"usps-redelivery-fee-cross-domain","label":"Fake USPS \"package could not be delivered — pay redelivery fee\" notice sent from a non-USPS domain demanding card payment via embedded link — credential-harvest and card-skim cross-domain phish; real USPS redelivery is free under Form 3849 and never via cold-email payment. Real USPS mail originates from usps.com / informeddelivery.usps.com only.","description":"Fake USPS (United States Postal Service) \"package could not be delivered — pay redelivery fee or address-correction surcharge\" notification sent from a non-USPS sending domain (From / Reply-To / link domains do not align with usps.com / usps.gov / informeddelivery.usps.com) demanding the recipient click an off-domain link to schedule redelivery, pay an address-correction fee, or confirm shipping details — credential-harvest and card-skim cross-domain phish. Real USPS redelivery notifications come from usps.com / informeddelivery.usps.com / @email.usps.com with DMARC-aligned signing and never require payment via cold-email link: USPS Form 3849 redelivery is free. Cold inbound emails demanding even small redelivery fees with off-domain payment links are smishing-style attacks. USPS impersonation is the #1 brand for SMS+email package-delivery phishing per FBI IC3 2024 and FTC consumer alerts. Distinct from delivery-failure-lure-from-noncourier (subject-only) and dhl-redelivery-fee-cross-domain (DHL / international) — this targets the USPS-specific brand + redelivery-fee / address-correction-surcharge / pay-small-fee pretext with off-domain href. Detection: USPS brand vocabulary (USPS, United States Postal Service, redelivery, package could not be delivered) + redelivery / fee / address-correction urgency + sender or link domain ≠ usps.com / usps.gov / informeddelivery.usps.com + no DMARC alignment. Trash score: +5. Source: GC1-R32; FBI IC3 2024 IC3 Report (USPS smishing #1); FTC consumer alerts USPS impersonation 2024–2025; USPS Postal Inspection Service anti-phishing guidance; CISA shipping-carrier phishing advisory.","tier":"warning","category":"other","isThin":false}}