Fake utility company claiming a final disconnection notice for unpaid bills with service shutoff within 2–4 hours unless payment is made via email link — credential-harvest attack; real utility disconnection notices require 10–30 days advance written notice under state PUC regulations, never same-day shutoff via cold email.
utility-disconnection-final-notice-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake utility company (electricity, gas, water, or broadband) claiming it is issuing a final disconnection notice for unpaid bills and threatening to shut off service within 2–4 hours unless payment is made immediately via email link — credential-harvest and advance-fee fraud targeting residential and business utility customers. Real utility disconnection notices are delivered via USPS certified mail, automated phone, and authenticated customer portal under state Public Utilities Commission regulations requiring advance written notice of 10–30 days; cold emails threatening same-day service shutoff within hours for unpaid utility bills are government/utility-impersonation attacks. The "final notice — pay within 2 hours or power/gas/water disconnected today" pretext is consistently listed by FTC and AARP as a top utility-impersonation scam pattern. Distinct from account-balance-urgency-phish (generic balance urgency) — this targets the utility company final disconnection notice / pay within hours or service disconnected today vocabulary. Detection: final disconnection notice + pay within hours + electricity/gas/water/service shut off today + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +5. Source: GC1-R30; FTC utility impersonation advisory 2025; AARP utility scam tracker; NARUC state PUC disconnection rules; CISA critical-infrastructure impersonation patterns.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started