Fake ACA marketplace or health insurance administrator claiming coverage will be cancelled unless income or enrollment is verified via email link — credential-harvest attack; real ACA coverage changes are communicated through healthcare.gov or state marketplace portals, never cold email links demanding income verification to prevent cancellation.
aca-health-insurance-cancel-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake ACA (Affordable Care Act) marketplace administrator or health insurance notice claiming the recipient's marketplace health insurance plan will be cancelled unless income or enrollment details are verified via email link to maintain coverage — credential-harvest attack targeting health insurance anxiety. Real ACA enrollment changes, income reconciliation, and coverage decisions are communicated through the official federal marketplace (healthcare.gov) or state marketplace portals (e.g., Covered California, NY State of Health); they never require income or enrollment re-verification via cold inbound email link threatening imminent cancellation. Distinct from medicare-advantage-switch-period (Medicare Advantage enrollment) and employee-benefits-open-enrollment-phish (employer plan enrollment) — this specifically targets the individual ACA marketplace cancellation pretext. Detection: ACA/affordable care act/marketplace plan/health insurance cancel/suspend + verify income/enrollment to maintain coverage vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +3. Source: GC1-R25; CMS ACA marketplace consumer protections; HHS OIG health insurance fraud advisory 2025; FTC ACA impersonation scam patterns.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started