Skip to main content
ThreatPhishing & impersonation

Fake government stimulus check, relief fund, or economic impact payment phishing — fraudulent email impersonating the IRS, Treasury Department, or a federal agency claiming the recipient has an approved stimulus check, unclaimed government relief fund, CARES Act payment, or economic impact payment ready to collect — directing them to click a link to claim funds, provide their SSN, bank account, routing number, or personal information to deposit the payment

fake-stimulus-government-payment-phish

What this tier means

High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.

How Gorganizer detects this

Phishing emails impersonating the IRS, Treasury Department, or a federal government agency — claiming the recipient has an approved stimulus check, unclaimed government relief fund, CARES Act payment, economic impact payment, taxpayer relief check, or pandemic benefit payment ready to collect — then directing them to click a link to claim funds, provide their SSN, bank account details, routing number, or personal information to deposit the payment. Stimulus payment phishing exploits public awareness of legitimate government payment programs. Key facts: (1) The IRS distributed over $800 billion in Economic Impact Payments (EIPs) during 2020–2021 across three rounds — millions of Americans received these payments, making "unclaimed stimulus payment" narratives highly credible to anyone who believes they may have been missed or is entitled to a retroactive payment; (2) The "unclaimed funds" framing is especially effective — scammers claim the recipient's payment was issued but returned unclaimed, creating a sense that real money is waiting and that the recipient needs to act to collect what they're owed before it expires; (3) Government-themed payment scams are perennial because new programs (COVID relief, inflation relief, tax credits, expanded child tax credits) regularly generate public awareness of potential payments — scammers simply rebrand old templates as each new program launches; (4) The IRS never initiates contact about tax refunds, stimulus checks, or government payments via email — all official payment notifications arrive by physical mail to the address on file; the IRS does not send emails with links to claim payments, and there is no online portal that requires SSN submission via email to release funds; (5) Stimulus scam losses exceeded $400 million in 2020–2021 combined according to the FTC, with seniors and low-income households disproportionately targeted because these groups had the strongest incentive to collect relief payments and the least experience with online fraud. Warning signs: unsolicited email about approved stimulus check or government relief payment, SSN or bank account requested via email, non-.gov or unknown sender domain, urgency about payment expiring.

False-positive guard

Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.

About the scoring engine

Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.

Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.

Ready to clean your inbox?

Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.

Get started