Fake Google Workspace / Microsoft 365 / Slack / Zoom / Atlassian workspace admin invoice — sender domain does NOT match the claimed platform domain; urgency + billing-portal link redirecting to off-brand payment portal.
saas-workspace-admin-invoice-spoof
What this tier means
Warning signal — bulk / marketing / mild spam. Contributes to the trash score but is not by itself sufficient.
How Gorganizer detects this
Fake workspace admin invoice impersonating Google Workspace, Microsoft 365, Slack, Zoom, or Atlassian where the sender domain does NOT match the claimed platform domain. Workspace admins are P0 targets because they routinely receive billing emails and have authority to approve payments. The lure claims "your Google Workspace / Microsoft 365 licenses require renewal — N seats at $X/month — pay now or services will be suspended." Real workspace billing comes exclusively from the platform's verified billing domain and is always accessible from within the admin console, never via cold inbound email redirecting to a third-party payment link. Detection: workspace/license/seats vocabulary + billing urgency + admin/billing-portal language + off-brand href + sender NOT on the platform canonical allowlist (google.com, microsoft.com, slack.com, zoom.us, atlassian.com) + no In-Reply-To + no List-Unsubscribe. Source: GC1-R17; FBI IC3 BEC advisory 2025; Cybersecurity and Infrastructure Security Agency (CISA) workspace phishing advisory.
False-positive guard
Every signal in Gorganizer feeds a multi-module score — never a sole verdict. This is a warning-tier signal — bulk / marketing / mild spam. It contributes to the trash score but never triggers deletion on its own. Gorganizer requires multiple signals + a margin over the safety floor before any email is moved to trash.
About the scoring engine
Gorganizer's scoring engine emits over 1,800 signals across six modules — headers, sender, subject, body, attachments, and structural metadata. Every email is scored by every module independently; the final verdict requires multiple modules to agree and the trash score to beat the safety floor by a margin.
Sacred safety guards — never delete starred emails, replies, calendar invites, receipts/invoices, or attachments — apply unconditionally regardless of any signal.
Ready to clean your inbox?
Gorganizer scans your Gmail with this signal and 1,800+ others, then cleans everything in one click. $4.99 one-time, no subscription.
Get started