Fake SAVE Plan court injunction / student loan forgiveness status notice from non-official sender targeting federal borrowers — "your SAVE payments are suspended — recertify your loans / update your income" urgency harvesting FSA ID, SSN, and banking data
studentaid-save-injunction-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake notice about the SAVE Plan court injunction and student loan forgiveness status from a non-official sender, targeting federal student loan borrowers. The SAVE (Saving on a Valuable Education) income-driven repayment plan was blocked by federal court injunctions in 2024-2026, creating widespread borrower confusion about payment status, forgiveness eligibility, and account recertification requirements. Attackers exploit this confusion with fake "your SAVE Plan payments are suspended due to the court injunction — you must recertify your income / update your account by [date] or your loans will enter default" emails impersonating studentaid.gov or loan servicers (MOHELA, Nelnet, Aidvantage, EdFinancial). The goal is harvesting FSA ID credentials, SSN, income documentation, and banking account details. Legitimate loan servicer communications use authenticated portals and never request credential updates via inbound email links. The signal fires when: (1) body references the SAVE plan, income-driven repayment, student loan forgiveness, loan cancellation, or PSLF AND (2) SAVE suspension / court injunction / recertification / payment restart urgency is present AND (3) sender is NOT studentaid.gov, ed.gov, mohela.com, nelnet.com, aidvantage.com, or edfinancial.com AND (4) no List-Unsubscribe or In-Reply-To. Source: GC1 R15 council #5; FTC student loan forgiveness scam alerts 2024-2026; CFPB SAVE plan borrower advisory Q2 2026.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started