Fake utility company (electric, gas, water) claiming a security deposit refund is ready and requiring bank account routing number verification via email to receive the credit — credential-harvest and bank-drain fraud; real utility deposit refunds are applied as account credits or mailed as checks, never via cold email routing-number collection.
utility-deposit-refund-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake utility company (impersonating electric, gas, water, or energy providers such as Con Edison, Pacific Gas & Electric, Duke Energy, National Grid, or regional utilities) claiming a security deposit refund is ready and requiring the target to verify their bank account routing number via email link to receive the credit — credential-harvest and bank-drain fraud. Real utility security deposit refunds are applied as a credit to the customer's bill, mailed as a check, or returned to the original payment method under state utility commission regulations; cold emails requesting bank routing number submission to "receive" a deposit credit are bank-account-takeover attacks. Distinct from rental-deposit-refund-phish (landlord/rental deposit modality) and utility-smart-meter-upgrade-phish (meter upgrade pretext) — this targets the utility company security deposit refund / routing number verification narrative. Detection: utility/electric/gas/water/energy + deposit refund ready/credit + verify bank account routing number vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +3. Source: GC1-R27; CPUC utility deposit refund regulations; FTC utility impostor scam advisory 2025; AARP utility deposit fraud alert.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started