Fake AI-vendor support / account-verification brand-spoof — "Your ChatGPT / Claude / Copilot / Gemini account requires verification within 24 hours or access will be suspended" via lookalike domain harvests AI-vendor account credentials. Sender domain NOT on the AI-vendor canonical allowlist (openai.com, anthropic.com, google.com, microsoft.com, mistral.ai, cohere.com, x.ai, meta.com, perplexity.ai). Air Canada chatbot ruling (BCCRT Feb 2024) + DPD chatbot incident (Jan 2024) + 2025 Microsoft Copilot prompt-injection findings prove jailbroken or hallucinating support bots can issue real commitments, lending the brand-spoof immediate credibility. Distinct from R8 agent-voice-clone (phone modality) — this is email-only. Distinct from R12 #4 (consumer ChatGPT/Claude renewal phish) — this is the support / account-verification spoof. Source: Red-Team R9 multi-agent council S5 (LLM-jailbroken-support specialist), Lead consensus C5.
fake-ai-vendor-support-spoof-lure
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake AI-vendor support / account-verification brand-spoof targeting users of OpenAI / Anthropic / Google AI / Microsoft Copilot / Mistral / Cohere / xAI / Perplexity / Meta-AI consumer or enterprise products. The phish narrative arrives as: "Your ChatGPT account requires immediate verification. Please verify your AI assistant account credentials within 24 hours or your access will be suspended. Sign in here to verify," or "Anthropic Claude support has flagged your account. Verify your AI assistant credentials immediately or your account will be suspended within 24 hours," or "Microsoft Copilot AI assistant security update requires you to verify your account immediately. Sign in within 24 hours or AI access will be suspended." Air Canada chatbot ruling (BCCRT Feb 2024) plus DPD chatbot incident (Jan 2024) plus 2025 Microsoft Copilot prompt-injection findings showed jailbroken or hallucinating support bots can issue real commitments, lending the brand-spoof a credible "AI customer-support" framing that did not exist in pre-LLM phishing. Distinct from R8 agent-voice-clone (phone modality) — this is email-only. Distinct from R12 #4 (consumer ChatGPT/Claude renewal phish — the billing pretext) — this signal is specifically the support / account-verification / suspension pretext. Sender domain NOT on the AI-vendor canonical allowlist (openai.com, anthropic.com, google.com, microsoft.com, mistral.ai, cohere.com, x.ai, meta.com, perplexity.ai). Fires when body references ChatGPT / OpenAI / Claude / Anthropic / Gemini / Copilot / Mistral / Cohere / Perplexity / Grok / x.ai / Meta AI / AI assistant / AI account AND contains support / security / verification / verify / account / sign-in / suspended / access / credentials framing AND verify / suspend(ed) / within N hours-days / 24 hours / immediately / urgent / action required / sign in urgency. Excludes the canonical AI-vendor domains. Auto-classified as danger via the `-lure` suffix. Source: Red-Team R9 multi-agent council S5 (LLM-jailbroken-support specialist), Lead consensus C5.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started