Fake PayPal notice claiming the account has been limited or put on hold due to suspicious activity, requiring information verification within 48 hours to restore access — credential-harvest attack; real PayPal account limitations are communicated through the authenticated PayPal Resolution Center, never via cold email links demanding 48-hour credential re-entry.
paypal-account-hold-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake PayPal security or account notification claiming the recipient's PayPal account has been limited or put on hold due to suspicious activity, requiring information verification within 48 hours via email link to restore access and lift the limitation — credential-harvest attack. Real PayPal account limitation notices are communicated exclusively through the authenticated PayPal dashboard (Resolution Center at paypal.com) and never require credential re-entry via cold inbound email link under a 48-hour restore-or-suspend deadline. The "your PayPal account has been limited — verify within 48 hours" pattern is one of the most consistent PayPal phishing templates across all APWG phishing reports since 2020. Distinct from fake-cashapp-zelle-venmo-1099k-aml-kyc-threshold-lure (KYC/AML 1099-K variant involving multiple platforms) — this targets the PayPal-specific account-limited / account-hold narrative. Detection: PayPal account limited/hold/restricted/suspended + verify information within 48 hours/restore access vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +5. Source: GC1-R26; APWG PayPal phishing report Q1 2026; Anti-Phishing Working Group PayPal impersonation trends; FTC PayPal impostor scam advisory.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started