Fake IRS statutory notice of deficiency claiming failure to respond within 30 days will trigger automatic tax assessment and instructing the target to call immediately to dispute — IRS impersonation fraud; the real IRS sends deficiency notices by certified postal mail, never by email.
fake-irs-cp3219-deficiency-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake IRS statutory notice of deficiency (impersonating the CP3219A Notice of Deficiency / 90-Day Letter) claiming that failure to respond within 30 days will result in an automatic tax assessment, with an instruction to call immediately to dispute — IRS impersonation fraud. The real IRS sends CP3219A statutory notices of deficiency exclusively via USPS certified mail from its Service Center; the IRS never initiates contact about tax deficiencies or assessments via email, and it never instructs recipients to call a phone number provided in an email to "dispute" an assessment. The "respond within 30 days or automatic assessment — call immediately to dispute" pressure shape is the defining pattern for IRS-impersonator deficiency attacks. Distinct from irs-direct-file-2026-amendment-lure (refund recalculation / direct-file narrative) and government-fine-penalty-payment-phish (generic government fine pretext) — this targets the IRS deficiency notice / 30-day response window / automatic assessment / call-to-dispute pretext. Detection: IRS/internal revenue service + deficiency/CP3219/notice of deficiency + respond within 30 days + automatic assessment + call to dispute vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +5. Source: GC1-R28; IRS CP3219A Notice of Deficiency procedures (IRC 6212); IRS impersonation scam consumer alert; FTC IRS impostor scam advisory 2025; TIGTA IRS phishing report.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started