Fake TSA PreCheck / Global Entry renewal phishing — non-government sender impersonates TSA, CBP, or the Trusted Traveler Program claiming membership has expired or been suspended and demands a $78–$100 renewal fee plus passport number and date of birth on a fraudulent portal
fake-tsa-precheck-global-entry-renewal-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Phishing emails impersonating TSA, U.S. Customs and Border Protection (CBP), or the Trusted Traveler Program (TTP) claiming the victim's TSA PreCheck, Global Entry, or NEXUS membership has expired, been suspended, or requires a background check renewal. The email directs victims to a fraudulent portal to pay a $78–$100 "renewal fee" and submit sensitive PII — passport number, date of birth, and payment card details. Key facts: (1) FTC advisory (February 2024): fake TSA PreCheck renewal phishing surged 300% in 12 months, targeting the 18+ million active PreCheck members; (2) The U.S. government NEVER collects travel document fees or renewal payments via links in unsolicited emails — all legitimate TSA PreCheck and Global Entry renewal is done exclusively through the official Trusted Traveler Programs portal at ttp.cbp.dhs.gov or through approved enrollment providers (IDEMIA, Telos); (3) Real TSA/CBP communications come from @dhs.gov, @tsa.gov, or @cbp.gov domains — any other domain is fraudulent; (4) The combination of payment card data + passport number + date of birth enables comprehensive identity theft, not just financial fraud. Warning signs: non-.gov sender domain, renewal fee payment link in email, request for passport number or date of birth, urgency framing ("deactivated," "suspended," "expires in 30 days").
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started