Detects inbound email messages attempting to obtain W-2 tax documents by combining social engineering cues with tax-related language and sender impersonation signals. The rule targets messages with common administrative local-part senders (e.g., contact, no-reply, noreply, info, admin) and checks for mismatched reply-to addresses or DMARC/SPF authentication failures to expose spoofing. It requires subject lines containing tax-related terms (e.g., wage, tax form/statement, W-2, IRs) and body content referencing wage statements or W-2 variations. NLP-based analysis (ML NL U classifier) must identify a "request" entity in the thread text, while excluding benign intents with high confidence. Legitimate senders and domains are filtered out, including high-trust domains when DMARC passes or known corporate services (e.g., microsoft.com, sharepoint.com, jotform.com). The rule also compares the sender domain root against org domains to reduce false positives, and thus avoids flagging internal or trusted external domains with valid authentication. Overall, the rule combines header analysis (sender local part, reply-to mismatches, DMARC/SPF results), content analysis (subject/body term matching, obfuscated forms), and NLP-based entity detection to detect BEC attempts involving tax document requests while suppressing highly trusted or legitimately authenticated traffic.