Fake T+1 settlement-failure / FINRA Rule 4210 margin-call wire-pressure lure — "Your trade failed to settle on T+1; per FINRA 4210 margin call, wire same-day funds by 4pm or your position will be liquidated" spoofing Schwab / Fidelity / Vanguard / Robinhood. T+1 settlement (effective May 2024) plus FINRA Rule 4210 margin requirements give the lure narrative credibility; harvested wires go to attacker bank accounts, not the broker. Real T+1 fails-to-deliver and margin-call notifications come through the broker portal and registered phone, never via inbound email link demanding immediate wire transfer. Distinct from `fake-finra-arbitration-statement-of-claim-spoof` (Statement-of-Claim wire fraud) and `fake-reg-nms-rule-606-execution-quality-disclosure-spoof` (regulatory-filing rejection). Source: GC1 R7 multiagent council (S1 fin specialist).
brokerage-t-plus-1-settlement-failure-margin-call-lure
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake T+1 settlement-failure / FINRA Rule 4210 margin-call wire-pressure lure spoofing Schwab / Fidelity / Vanguard / Robinhood. The phish narrative arrives as: "Your trade failed to settle on T+1 — per FINRA Rule 4210 margin call, wire same-day funds by 4pm or your position will be liquidated," or "Failure to deliver reported on your account — send ACH same-day funds within 4 hours to satisfy the margin call." T+1 settlement (effective May 2024 per SEC Rule 15c6-1 amendment) compressed the equities settlement window from T+2 to T+1, creating a real population of settlement-fail events as buyside firms adjust. FINRA Rule 4210 governs broker margin requirements, and its lookahead language about "minimum-equity / 25% maintenance margin" gives attackers reusable vocabulary that legitimate margin-call notices ALSO use, making pattern-matching difficult for retail investors. The wire goes to attacker-controlled bank accounts rather than to the broker. Real T+1 fails-to-deliver and Rule 4210 margin-call notifications are surfaced through the broker portal (account dashboard at schwab.com / fidelity.com / vanguard.com / robinhood.com) AND a registered phone number on file; brokers never demand immediate wire transfers to third-party accounts via inbound email link, never set 4-hour deadlines via email, and follow Reg T / FINRA 4210 procedural rules that give the customer documented dispute paths. Compromised victims face direct wire loss ($1K-$100K+ depending on margin balance) plus subsequent attempts to harvest brokerage credentials for ACH fraud and account-takeover. Distinct from `fake-finra-arbitration-statement-of-claim-spoof` (FINRA Dispute Resolution Statement-of-Claim wire fraud) and `fake-reg-nms-rule-606-execution-quality-disclosure-spoof` (regulatory-filing rejection) — this signal is specifically the T+1-settlement / Rule 4210 margin-call wire-pressure framing. Fires when body references T+1 / same-day settlement / failure to deliver / FINRA Rule 4210 / margin call AND contains wire / ACH / same-day funds / by 4pm / liquidation / action-required urgency. Excludes schwab.com, fidelity.com, vanguard.com, robinhood.com, finra.org, sec.gov, and the broader .gov umbrella. Auto-classified as danger via the `-lure` suffix. Source: GC1 R7 multi-agent council (S1 fin specialist).
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started