Fake SEC Reg NMS Rule 605/606 execution-quality disclosure lure — "Q1 2026 Rule 606 disclosure rejected, re-submit order-routing data within 7 days to avoid deficient-filing penalty" or "Rule 605 PFOF disclosure deadline approaching, file via FINRA Gateway" targeting broker-dealer compliance / supervisory staff. Real Rule 605/606 filings go through firs.finra.org / FINRA Gateway with username/password issued through FINRA on-boarding, never via inbound email link. Pure B2B-broker scope (very low FP). Quarterly recurring cycle (Q1, Q2, Q3, Q4) gives attackers four priming windows per year. Source: GC1 R8 multiagent council top-5 (S1 fin specialist).

Fake SEC Reg NMS Rule 605 / Rule 606 execution-quality disclosure lure targeting broker-dealer compliance + supervisory staff. The phish narrative arrives as: "Q1 2026 Rule 606 disclosure rejected — re-submit order-routing data within 7 days to avoid deficient-filing penalty," or "Rule 605 PFOF (payment for order flow) disclosure deadline approaching — file via FINRA Gateway." SEC Reg NMS Rule 605 (market-center execution-quality reports) and Rule 606 (broker order-routing disclosures) were amended in March 2024 (Release No. 34-99679) with phased effective dates running through 2026 — every quarter, every broker that meets the de-minimis threshold MUST publish the prescribed report. The recurring quarterly cycle (Q1, Q2, Q3, Q4) gives attackers four priming windows per year, and the amendments are CURRENT enough that real "your filing is non-compliant under the new amendments" emails ARE going out from FINRA, lending the phish credibility. Real Rule 605/606 filings flow through firs.finra.org / FINRA Gateway with username + password issued through FINRA on-boarding, never via inbound email link. Compromised broker credentials are catastrophic: post-compromise the attacker accesses CRD records (broker-dealer central registration depository), supervisory control reports, and customer-account-level routing data — all of which has both reputational impact and downstream insider-trading abuse potential. Pure B2B-broker scope (very low FP because Rule 605/606 vocabulary is functionally exclusive to securities-industry compliance). Distinct from `fake-finra-arbitration-statement-of-claim-spoof` (dispute resolution / wire fraud) — this signal is specifically the regulatory-filing rejection narrative with FINRA Gateway / firs.finra.org as the impersonation target. Fires when body references Reg NMS / Rule 605 / Rule 606 / order routing / execution quality / payment for order flow / PFOF / FINRA Gateway AND contains rejected / re-submit / deficient-filing / deadline / SEC enforcement / action-required urgency. Excludes finra.org, firs.finra.org, sec.gov, sec.report, efts.sec.gov, and the broader .gov umbrella. Auto-classified as danger via the `-spoof` suffix. Source: GC1 R8 multi-agent council top-5 (S1 fin specialist).