Fake Cash App / Zelle / Venmo / PayPal 1099-K AML/KYC threshold-flag lure — "Account flagged under FinCEN AML KYC review for the new 1099-K threshold; submit ID and SSN documents within 7 days or funds will be frozen pending Patriot Act review" cross-platform payment-app harvest. The TY2026 1099-K threshold dropped to $2,500 (down from $5K TY2025), giving attackers a real and credible compliance pretext. Real Cash App / Zelle / Venmo / PayPal AML reviews never request SSN / ID upload via inbound email link; identity verification flows happen in-app or via the registered phone number. PII-credential-harvest cluster. Source: GC1 R8 multiagent council (S1 fin specialist).
fake-cashapp-zelle-venmo-1099k-aml-kyc-threshold-lure
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake Cash App / Zelle / Venmo / PayPal 1099-K AML/KYC threshold-flag lure targeting payment-app users. The phish narrative arrives as: "Your Cash App account has been flagged under the FinCEN AML KYC review for the new 1099-K threshold — submit ID and SSN documents within 7 days or funds will be frozen pending Patriot Act review," or "Zelle / Venmo / PayPal account limited under 1099-K threshold-review — verify identity and upload SSN documents to avoid freeze." The TY2026 1099-K threshold dropped to $2,500 (down from $5K TY2025 and $20K pre-American Rescue Plan), suddenly capturing tens of millions of small-dollar payment-app users in 1099-K reporting — that creates a freshly-engaged + recently-confused target population vulnerable to "your account is now subject to AML KYC review under the new threshold" framing. Lookalike payment-app review portals harvest SSN, government-ID images, full name + DOB + address, and bank-account information — sufficient data for downstream synthetic-identity creation, tax-refund redirect, and bank-account takeover. Real Cash App / Zelle / Venmo / PayPal AML reviews never request SSN / ID upload via inbound email link; identity verification flows happen in-app or via the registered phone number. The Patriot Act / FinCEN / AML / KYC vocabulary cluster lends regulatory legitimacy to the phish but is functionally exclusive to financial-services compliance, keeping FP very low. PII-credential-harvest cluster. Distinct from `fake-stripe-radar-rfi-account-restriction-spoof` (Stripe-merchant 1099-K scope) and from generic IRS-tax phish — this signal is specifically the payment-app 1099-K threshold framing across the major retail platforms. Fires when body references 1099-K / payment app / Cash App / Zelle / Venmo / PayPal / AML / KYC / Patriot Act / FinCEN AND contains flagged / frozen / submit-ID / submit-SSN / verify-identity / account-limited / threshold-review / action-required urgency. Excludes cash.app, zellepay.com, venmo.com, paypal.com, fincen.gov, irs.gov, and the broader .gov umbrella. Auto-classified as danger via the `-lure` suffix. Source: GC1 R8 multi-agent council (S1 fin specialist).
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started