Fake Progressive / GEICO / State Farm / Allstate / USAA / Liberty Mutual / Nationwide / Farmers / Travelers / American Family / Esurance / Root / Lemonade auto-insurance policy-EXPIRATION lure — "auto-pay failed / policy expiring in 24 hours / coverage will lapse, pay now or you will be driving illegally" targeting 230M+ US licensed drivers; post-2022-2024 auto-insurance rate-spike (+25-40% YoY), drivers are primed for "pay now" messaging; "driving illegally" framing triggers immediate compliance anxiety (uninsured driving is criminal in every state except NH — fines + license suspension + impound); harvests policy number + credit card ($300-500 "immediate reinstatement") + SSN + driver's license + VIN (enables DMV ID theft + title fraud); distinct from Round 141 quote-scam signal which targets NON-policyholders with "get a lower rate" framing

Fake "your Progressive / GEICO / State Farm / Allstate / USAA / Liberty Mutual / Nationwide / Farmers / Travelers / American Family / Esurance / Root / Lemonade auto insurance policy is expiring in 24-48 hours — your auto-pay failed, pay now or your coverage will lapse and you will be driving illegally" email targeting existing auto-insurance policyholders. The 50th new 2026 signal this session. Reach: 230M+ US licensed drivers (essentially every US adult). Why this lure converts at industrial scale: (1) real auto-insurance companies send expiration + auto-pay reminders constantly — every driver has seen 20+ legitimate emails of this exact shape over their driving life, so the template is deeply familiar; (2) threat framing "driving illegally" triggers immediate compliance anxiety because uninsured operation is a criminal offense in every US state except New Hampshire (fines + license suspension + vehicle impound); (3) typical 6-month policy value is $500-$2,000 (US average $1,500 per 6 months as of 2024), so a $300-$500 "immediate reinstatement payment" ask matches the mental model of what drivers expect to pay; (4) post-2022-2024 auto-insurance rate-spike of 25-40% YoY, drivers are primed for "your rate changed and you need to pay now" messaging — the inflation shock made fake urgency plausible across the entire driver demographic. Attack harvests: policy number (per-victim personalization for downstream phish), credit card for fake "immediate reinstatement payment", SSN (on appeal / "verify identity" forms), driver's license number (enables DMV identity theft), VIN (enables title fraud + fake registration resale). Distinct from `fake-auto-insurance-quote-personal-data-harvest-scam` (Round 141) which covers QUOTE scams ("get a lower rate, give us SSN") targeting NON-policyholders — opposite attack shape, different demographic cues (new-buyer vs existing-policyholder). Fires when body references Progressive / GEICO / State Farm / Allstate / USAA / Liberty Mutual / Nationwide / Farmers / Travelers / American Family / AmFam / Esurance / Root / Lemonade Car / Metromile / Mercury / The Hartford / SafeAuto / Dairyland / auto insurance / car insurance / vehicle insurance / auto policy / auto coverage AND contains expiring / expire / lapsed / auto-pay-failed / reinstate / driving-illegally / uninsured / pay-now / 24-hour urgency. Excludes progressive.com, progressivedirect.com, geico.com, statefarm.com, state-farm.com, allstate.com, usaa.com, libertymutual.com, libertymutualinsurance.com, nationwide.com, farmers.com, farmersinsurance.com, travelers.com, travelersinsurance.com, amfam.com, americanfamily.com, esurance.com, theroot.com, joinroot.com, lemonade.com, metromile.com, mercuryinsurance.com, thehartford.com, safeauto.com, dairyland.com. Auto-classified as danger via the `-lure` suffix.