Fake IRS CP2000 (Automated Underreporter Inquiry) email requiring online response via link — real IRS CP2000 notices arrive exclusively by postal mail; the IRS never emails CP2000 links for payment or document upload.
irs-cp2000-response-phish
What this tier means
High-confidence threat indicator — phishing, impersonation, BEC, or scam pattern. Strong contributor to the trash decision.
How Gorganizer detects this
Fake IRS CP2000 (Automated Underreporter Inquiry) email requiring online response via a link. SACRED: 'cp2000' added to safety-keywords.ts to protect genuine CP2000 notices forwarded digitally by tax professionals. Real IRS CP2000 notices arrive EXCLUSIVELY by US postal mail — the IRS never sends CP2000 notices by email and never provides links for CP2000 payment, document upload, or online response. The CP2000 is sent when IRS records differ from the taxpayer's reported income (e.g., unreported 1099 income). Attackers exploit taxpayer anxiety about unreported income and potential penalties with "CP2000 automated underreporter inquiry — respond online within 30 days or penalty will apply." Detection: CP2000/automated underreporter vocabulary + IRS brand reference + click-to-respond/pay/upload urgency + off-brand href (not irs.gov) + sender NOT on irs.gov/.gov + no In-Reply-To + no List-Unsubscribe. Source: GC1-R17; IRS phishing advisory IR-2025; FTC IRS impostor scam report.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a threat-tier signal — it adds a strong contribution to the trash score. The full pipeline still requires convergence across multiple modules + a margin over the safety floor before deletion happens, and Gmail's trash (30-day recovery) is always used — never permanent delete.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started