Fake wallet security notice claiming the target's seed phrase or recovery phrase has been compromised and requiring them to enter their 12-word or 24-word phrase to migrate to secure storage — no legitimate wallet vendor ever requests a seed phrase via email; entering a seed phrase anywhere other than the physical device results in complete wallet drain.
crypto-wallet-seed-phrase-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake wallet security notice (impersonating MetaMask, Trust Wallet, Phantom, Coinbase Wallet, Ledger, or generic "wallet provider") claiming the target's seed phrase or recovery phrase has been compromised and requiring them to enter their 12-word or 24-word seed phrase to migrate their funds to secure storage — a SACRED-class signal; no legitimate wallet vendor ever requests a seed phrase via email, web form, or any channel other than the physical device during initial setup. Entering a seed phrase anywhere other than the physical hardware device or the original wallet app during first setup gives the attacker complete irrevocable control over the wallet and all its assets. This is the direct seed-phrase-harvest variant of wallet phishing, as opposed to the firmware-update pretext (hw-wallet-firmware-update-spoof-lure) or the hardware-wallet-specific modality (hw-wallet-seed-phrase-reveal-phish) — this targets the general software-wallet / seed-phrase-compromised / migrate-to-secure-storage pretext. Detection: seed phrase/recovery phrase compromised/exposed/stolen + enter 12-word/24-word phrase to migrate to secure storage vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +5. Source: GC1-R27; Chainalysis wallet drainer report 2024; MetaMask anti-phishing guidance; FBI IC3 crypto seed phrase harvest advisory.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started