Fake SAVE plan / Federal Student Aid forbearance urgency phishing targeting student loan borrowers
save-plan-forbearance-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake Federal Student Aid / SAVE plan forbearance urgency phishing targeting student loan borrowers. The SAVE (Saving on a Valuable Education) income-driven repayment plan faced court injunctions in 2024-2025 that created widespread confusion among 8M+ enrolled borrowers about payment obligations, forbearance periods, and re-enrollment deadlines. Attackers exploit this confusion with phishing emails impersonating Federal Student Aid, the Department of Education, or loan servicers (Mohela, Aidvantage, Navient, Nelnet) claiming: "Your SAVE plan enrollment is at risk due to the court injunction — re-enroll now to avoid interest capitalization," or "Your forbearance period is ending — update your income information immediately to avoid loan default." Real student loan servicer communications arrive from verified .gov or known servicer domains; unsolicited emails with urgent SAVE plan action requests from non-.gov senders are a phishing tell. The signal fires when: (1) body references the SAVE plan, Federal Student Aid, income-driven repayment, or a loan servicer brand AND (2) forbearance urgency, re-enrollment deadlines, or loan-default avoidance framing is present AND (3) sender is NOT from a .gov, @mohela.com, @aidvantage.com, @navient.com, or @nelnet domain AND (4) no List-Unsubscribe or In-Reply-To header. Source: GC1 R13 council #7; CISA SAVE-plan phishing advisory 2025; Federal Student Aid fraud alert 2025.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started