Fake employer or payroll provider claiming W-2 tax documents are ready for download and requiring SSN or employee ID verification via email link to access them — PII-harvest fraud; real W-2 forms are distributed through authenticated payroll portals (ADP, Workday, Paychex, Gusto) or mailed, never via cold email credential requests.
w2-tax-document-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake employer, HR system, or payroll provider claiming the recipient's W-2 tax documents are ready for download and requiring SSN or employee ID verification via email link to access them — PII-harvest fraud. Real W-2 forms are distributed through authenticated payroll portals (ADP Workforce Now, Workday, Paychex Flex, Gusto) or mailed to the address on file under IRS requirements; cold emails demanding SSN or employee ID submission via link to access W-2 documents are credential-harvest attacks. Distinct from irs-direct-file-2026-amendment-lure (IRS refund narrative) and irs-cp2000-response-phish (IRS underreporter) — this targets the W-2 download / employee ID verification pretext. Detection: W-2 tax document ready/download/available + verify SSN/employee ID to access vocabulary + no List-Unsubscribe + no In-Reply-To + not protected sender. Trash score: +4. Source: GC1-R26; IRS W-2 distribution requirements (Publication 15); FTC payroll phishing advisory 2025; CISA payroll credential-harvest alert.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits 2,143+ signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 2,143+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started