Fake USPS "package could not be delivered — pay redelivery fee" notice sent from a non-USPS domain demanding card payment via embedded link — credential-harvest and card-skim cross-domain phish; real USPS redelivery is free under Form 3849 and never via cold-email payment. Real USPS mail originates from usps.com / informeddelivery.usps.com only.
usps-redelivery-fee-cross-domain
What this tier means
Warning signal — bulk / marketing / mild spam. Contributes to the trash score but is not by itself sufficient.
How Gorganizer detects this
Fake USPS (United States Postal Service) "package could not be delivered — pay redelivery fee or address-correction surcharge" notification sent from a non-USPS sending domain (From / Reply-To / link domains do not align with usps.com / usps.gov / informeddelivery.usps.com) demanding the recipient click an off-domain link to schedule redelivery, pay an address-correction fee, or confirm shipping details — credential-harvest and card-skim cross-domain phish. Real USPS redelivery notifications come from usps.com / informeddelivery.usps.com / @email.usps.com with DMARC-aligned signing and never require payment via cold-email link: USPS Form 3849 redelivery is free. Cold inbound emails demanding even small redelivery fees with off-domain payment links are smishing-style attacks. USPS impersonation is the #1 brand for SMS+email package-delivery phishing per FBI IC3 2024 and FTC consumer alerts. Distinct from delivery-failure-lure-from-noncourier (subject-only) and dhl-redelivery-fee-cross-domain (DHL / international) — this targets the USPS-specific brand + redelivery-fee / address-correction-surcharge / pay-small-fee pretext with off-domain href. Detection: USPS brand vocabulary (USPS, United States Postal Service, redelivery, package could not be delivered) + redelivery / fee / address-correction urgency + sender or link domain ≠ usps.com / usps.gov / informeddelivery.usps.com + no DMARC alignment. Trash score: +5. Source: GC1-R32; FBI IC3 2024 IC3 Report (USPS smishing #1); FTC consumer alerts USPS impersonation 2024–2025; USPS Postal Inspection Service anti-phishing guidance; CISA shipping-carrier phishing advisory.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a warning-tier signal — bulk / marketing / mild spam. It contributes to the trash score but never triggers deletion on its own. Gorganizer requires multiple signals + a margin over the safety floor before any email is moved to trash.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started