The Government Card Alert That Lost Its Authentication in Transit

A targeted phishing/vishing message impersonating the Direct Express government card program was delivered via SendGrid/Conduent and relayed through a Cisco IronPort gateway; authentication passed upstream but failed at the recipient (SPF/DKIM/DMARC), the gateway flagged it as 'Phish' yet an allow-list caused SCL=-1 and the message landed in the inbox. The email contained a phone number and reference to the legitimate site (vishing lure), included a SendGrid tracking pixel confirming mailbox activity, and the report lists relevant IOCs and MITRE ATT&CK mappings.