Fake retirement plan administrator claiming the target's retirement account beneficiary designation is missing or invalid and will revert to default distribution unless updated via email link within a deadline — credential-harvest; real beneficiary updates are managed through authenticated employer HR portals, never cold email link requests.
retirement-beneficiary-update-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake retirement plan administrator or HR benefits department (impersonating Fidelity, Vanguard, TIAA, Empower Retirement, Principal Financial, or generic "Retirement Plan Administrator") claiming the target's retirement account beneficiary designation is missing, invalid, expired, or out of date and requiring them to click a link to update their beneficiary information before a deadline or their account will revert to the plan's default distribution rules — credential-harvest attack targeting retirement account holders. Real beneficiary designation update requests come from authenticated employer HR portals or plan administrator platforms; cold emails with "your retirement beneficiary is missing/invalid — update via link or account reverts to default" exploit both the urgency of estate planning and the complexity of retirement plan rules to harvest credentials. Beneficiary designations control potentially large asset transfers, making this a high-value attack. Distinct from 401k-early-withdrawal-penalty-phish (hardship withdrawal pretext) — this targets the retirement plan beneficiary designation / missing or invalid / update via link / revert to default distribution pretext. Detection: beneficiary designation + missing/invalid + retirement account/401k + update via link + revert to default distribution vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R29; ERISA beneficiary designation rules; DOL retirement plan advisory; FTC retirement account fraud patterns 2025; FINRA beneficiary scam alert.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started