Fake USCIS or DHS immigration authority claiming an immigration application has a fee deficiency requiring immediate payment via email link or the case will be administratively closed or denied — credential-harvest and advance-fee attack; real USCIS fee deficiency notices are delivered by USPS and through authenticated myUSCIS accounts, never cold email payment links.

Fake USCIS (U.S. Citizenship and Immigration Services) or DHS immigration authority claiming the target's immigration application has a fee deficiency, missing payment, or status alert that requires immediate action via email link or payment portal to prevent the case from being administratively closed, denied, or abandoned — credential-harvest and advance-fee attack exploiting the extreme anxiety associated with immigration status. Real USCIS fee deficiency notices are delivered via USPS first-class mail and through authenticated myUSCIS accounts at uscis.gov; cold inbound emails threatening case closure or denial for fee deficiency have been specifically flagged by DHS-CISA as a top government-fraud threat vector. The fee deficiency / case administratively closed / denied / pay immediately to preserve status pretext is particularly effective because immigration application errors can have life-altering consequences. Distinct from immigration-status-phish (general immigration pretext) and passport-renewal-phish (passport pretext) — this targets the USCIS fee deficiency / case administratively closed or denied / immediate payment required vocabulary. Detection: USCIS/immigration + fee deficiency/missing payment + case administratively closed/denied + pay immediately + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +5. Source: GC1-R30; DHS-CISA USCIS impersonation advisory 2025; USCIS anti-fraud bulletin; FTC immigration fee scam tracker; DOJ Office of Immigration Litigation fraud patterns.