{
  "model": "grayson-1",
  "state": {
    "case": {
      "case_id": "ATO-26-10-0395",
      "queue": "Payout review: account security",
      "opened": "2026-10-07T17:38:41Z",
      "records_as_of": "2026-10-07T17:52:00Z",
      "local_time": "Wednesday 2026-10-07, 11:52 a.m. MDT in Denver, CO"
    },
    "platform_controls": "Sign-in is email and password. A device not trusted in the last 30 days must also pass 2-step verification: an SMS code to the phone on file, or an authenticator app if the user has added one. The mobile app then signs in with Face ID or a fingerprint. 'Forgot password' emails a reset link to the email on file, and 2-step verification is still required after a reset. Changing the email or phone on file, adding or removing a 2-step method, and adding a payout destination each need a fresh 2-step code; we email the previous address and text the phone on file after each change. Payout destinations are business or owner checking accounts, verified by signing in to the bank through our account-verification provider (which returns the holder name and the account's open date) or by micro-deposits, and debit cards for instant payouts, checked with the card network's account name inquiry. Standard payouts go by ACH on the schedule the business picks and arrive the next business day. Instant payouts send up to $25,000 a day in minutes, to a debit card or a bank account on the real-time payments network, for a 1.5% fee, and cannot be recalled. Any payout to a destination added in the last 7 days, and any instant payout over $5,000 within 24 hours of a sign-in, contact or 2-step change, waits in this review queue. Staff with the point-of-sale role take payments on the shop's devices with a PIN and cannot see payouts or change settings.",
    "business": {
      "merchant_id": "mer_15532",
      "legal_name": "Fern and Ash Yoga LLC",
      "doing_business_as": "Fern & Ash Yoga",
      "business_type": "Single-member LLC; yoga studio, MCC 7997 (membership clubs)",
      "location": "Denver, CO; classes daily from 6 a.m.",
      "on_platform_since": "2022-01-10",
      "owner": {
        "name": "Hannah Lindqvist",
        "role": "Owner and only admin",
        "phone_on_file": "(720) 555-0144, since 2022-01-10",
        "email_on_file": "hello.fernandash@example.net, since 2022-01-10",
        "two_step_methods": "SMS to (720) 555-0144 since 2022"
      },
      "products": "Monthly memberships billed on the 5th to cards on file, class packs and drop-ins at the front desk, workshops sold online; weekly standard payouts; instant payouts since 2026-07",
      "monthly_card_volume_usd_last_12_months": "21,000 to 27,500",
      "payout_schedule": "Weekly standard payout every Friday for the previous Friday to Thursday",
      "disputes_12_months": 3,
      "account_status": "Active; no holds",
      "external_data": "The owner's email address appears in a 2025 breach of a fitness booking site (email and name only; no password in the breach data)"
    },
    "users": {
      "columns": [
        "user",
        "role",
        "added",
        "sign_in"
      ],
      "rows": [
        [
          "Hannah Lindqvist",
          "Owner (admin)",
          "2022-01-10",
          "email and password, 2-step"
        ],
        [
          "Rosa Delgado-Finch",
          "Point of sale",
          "2023-05-20",
          "PIN on the front-desk iPad only"
        ]
      ]
    },
    "devices": {
      "columns": [
        "device_id",
        "device",
        "user",
        "first_seen",
        "trusted",
        "last_seen"
      ],
      "rows": [
        [
          "dv_h1",
          "iPhone 15, our app (iOS 18)",
          "Hannah Lindqvist",
          "2023-11-04",
          "yes (Face ID)",
          "2026-10-07T14:10:02Z"
        ],
        [
          "dv_h2",
          "MacBook Air, Safari (macOS 13)",
          "Hannah Lindqvist",
          "2022-01-10",
          "trust expired 2025-09 (renewed 2026-08-11 with SMS code)",
          "2026-08-11T02:30:19Z"
        ],
        [
          "dv_h3",
          "iPad at the front desk, point-of-sale app",
          "shop device (staff PINs)",
          "2022-02-01",
          "yes (shop device)",
          "2026-10-07T11:34:43Z"
        ],
        [
          "dv_h8",
          "Windows 11, Edge",
          "attempted as Hannah Lindqvist",
          "2026-10-04T08:12:37Z",
          "no",
          "2026-10-04T08:12:37Z"
        ],
        [
          "dv_h9",
          "Windows 11, Chrome 129",
          "signed in as Hannah Lindqvist",
          "2026-10-07T17:31:12Z",
          "no (2-step passed; 'trust this device' not ticked)",
          "2026-10-07T17:38:40Z"
        ]
      ]
    },
    "credential_and_contact_changes": {
      "columns": [
        "ts",
        "change",
        "device_id",
        "ip",
        "verification"
      ],
      "rows": [
        [
          "2022-01-10T18:22:40Z",
          "Account opened; owner Hannah Lindqvist; email hello.fernandash@example.net; phone (720) 555-0144",
          "dv_h2",
          "203.0.113.150",
          "identity check passed"
        ],
        [
          "2022-01-12T16:05:31Z",
          "Payout destination added: checking x3346",
          "dv_h2",
          "203.0.113.150",
          "bank login through verification provider; holder FERN AND ASH YOGA LLC"
        ],
        [
          "2022-02-01T15:40:02Z",
          "Front-desk iPad dv_h3 set up for point of sale",
          "dv_h3",
          "198.51.100.205",
          "owner approval in app"
        ],
        [
          "2023-05-20T17:12:48Z",
          "User added: Rosa Delgado-Finch, point-of-sale role",
          "dv_h2",
          "198.51.100.205",
          "SMS code"
        ],
        [
          "2023-11-04T03:01:19Z",
          "App trusted on new phone dv_h1 (iPhone 15)",
          "dv_h1",
          "203.0.113.150",
          "SMS code"
        ],
        [
          "2025-03-08T16:44:00Z",
          "Password changed",
          "dv_h1",
          "203.0.113.150",
          "current password"
        ],
        [
          "2026-07-06T13:58:21Z",
          "Debit card x8812 added for instant payouts",
          "dv_h1",
          "203.0.113.150",
          "SMS code; card network name inquiry: HANNAH M LINDQVIST (matches the owner)"
        ],
        [
          "2026-10-07T17:35:26Z",
          "Payout destination added: personal checking x6075 at an online bank, enabled for instant payouts",
          "dv_h9",
          "203.0.113.201",
          "SMS code to (720) 555-0144, entered 17:35:09Z; bank login through verification provider"
        ]
      ]
    },
    "payout_destinations": [
      {
        "destination": "checking x3346",
        "added": "2022-01-12",
        "status": "default; weekly payouts",
        "ownership_check": "Bank login through verification provider, 2022-01-12: holder FERN AND ASH YOGA LLC (matches the legal name)",
        "account_opened": "2021-11-30",
        "payouts_received": "All 247 payouts since 2022-01, none returned"
      },
      {
        "destination": "Visa debit x8812",
        "added": "2026-07-06",
        "status": "instant payouts only",
        "ownership_check": "Card network account name inquiry: HANNAH M LINDQVIST (matches the owner)",
        "issuer": "A large national bank",
        "payouts_received": "2 instant payouts (2026-07-06, 2026-09-07)"
      },
      {
        "destination": "personal checking x6075 at an online bank",
        "added": "2026-10-07T17:35:26Z",
        "status": "not default; chosen for the instant payout under review",
        "ownership_check": "Bank login through verification provider, 2026-10-07T17:34:52Z: holder HANNAH M LINDQVIST (matches the owner's name; a personal account, not the LLC's)",
        "holder_address_at_bank": "An apartment in Aurora, CO; not the home or studio address we hold for her, and not in her identity check at onboarding",
        "holder_phone_and_email_at_bank": "Not returned by the provider",
        "account_opened": "2026-09-29, per the verification provider",
        "balance_at_verification_usd": 0,
        "seen_elsewhere_on_platform": "Not linked to any other business on our platform"
      }
    ],
    "sign_in_history": {
      "period": "2026-07-09 to 2026-10-07T17:52:00Z",
      "ip_addresses": {
        "198.51.100.205": "Business cable ISP, Denver CO (the studio's Wi-Fi)",
        "192.0.2.88": "Mobile carrier, Denver CO",
        "203.0.113.150": "Residential cable ISP, Denver CO",
        "198.51.100.244": "Commercial VPN service, exit in Denver CO",
        "203.0.113.201": "Business fiber ISP, Denver CO (a coworking space network; 11 other businesses on our platform sign in from it)"
      },
      "staff_point_of_sale_sign_ins": "91 staff PIN sign-ins on dv_h3 from 198.51.100.205, one each open day between 5:30 and 5:55 a.m. local time, all successful (Rosa Delgado-Finch 59, Hannah Lindqvist 32); last 2026-10-07T11:34:43Z",
      "columns": [
        "ts",
        "device_id",
        "ip",
        "method",
        "result",
        "activity"
      ],
      "rows": [
        [
          "2026-07-09T19:23:51Z",
          "dv_h1",
          "192.0.2.88",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-07-10T13:09:11Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-07-10T23:01:48Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-11T13:20:09Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-07-12T13:57:24Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-13T14:37:13Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-07-13T23:45:33Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-07-15T13:42:51Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-18T14:08:59Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-19T13:38:19Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-20T13:20:56Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-07-21T19:52:44Z",
          "dv_h1",
          "192.0.2.88",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-22T13:45:22Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-24T23:26:28Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-07-26T13:30:33Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-07-27T14:50:47Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-07-28T13:34:01Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-07-30T00:06:30Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-07-30T13:03:34Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-01T01:33:15Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-08-01T14:42:21Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-05T14:26:35Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-08-06T14:42:39Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-08-10T23:41:29Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-08-11T02:30:19Z",
          "dv_h2",
          "203.0.113.150",
          "password + SMS code (30-day trust renewed)",
          "success",
          "tax report export"
        ],
        [
          "2026-08-11T13:39:41Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-08-12T14:25:45Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-08-12T23:56:19Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-18T13:30:53Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-08-19T14:57:42Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-20T13:18:35Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-21T13:12:20Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-08-25T14:17:36Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-26T13:31:13Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-08-27T13:50:15Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-28T14:30:45Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-30T14:50:36Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-08-31T13:27:27Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-08-31T23:30:08Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-09-01T14:48:28Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-03T18:18:25Z",
          "dv_h1",
          "192.0.2.88",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-07T13:48:05Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "instant payout to debit card x8812"
        ],
        [
          "2026-09-08T13:38:00Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-09-10T18:53:22Z",
          "dv_h1",
          "192.0.2.88",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-11T14:26:58Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-09-11T23:01:24Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-09-13T13:30:01Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-14T14:39:09Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-09-15T13:56:05Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-09-17T01:49:43Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-09-17T13:28:15Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-09-18T13:26:28Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-09-18T19:02:51Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "support chat"
        ],
        [
          "2026-09-22T14:55:38Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-09-23T13:24:34Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-24T13:15:24Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-09-26T14:13:23Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships"
        ],
        [
          "2026-09-27T14:26:56Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-29T01:49:29Z",
          "dv_h1",
          "198.51.100.205",
          "Face ID (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-10-01T14:55:05Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-10-01T18:19:27Z",
          "dv_h1",
          "192.0.2.88",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-02T13:11:17Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-04T08:12:37Z",
          "dv_h8",
          "198.51.100.244",
          "password",
          "failed: wrong password",
          ""
        ],
        [
          "2026-10-05T14:21:09Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "memberships (renewals)"
        ],
        [
          "2026-10-06T13:45:35Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "class bookings"
        ],
        [
          "2026-10-06T13:55:30Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary; payouts viewed"
        ],
        [
          "2026-10-07T14:10:02Z",
          "dv_h1",
          "203.0.113.150",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-07T17:31:12Z",
          "dv_h9",
          "203.0.113.201",
          "password + SMS code (new device)",
          "success",
          "payout destinations; payout destination added; instant payout requested"
        ]
      ]
    },
    "device_intelligence": {
      "vendor": "Your device intelligence vendor, scored on every sign-in and sensitive change",
      "reason_code_meanings": {
        "NEW_DEVICE": "Device not seen on this account before",
        "NEW_LOCATION": "IP location not seen on this account in 90 days",
        "PROXY_RESIDENTIAL": "IP belongs to a residential proxy network",
        "VPN": "IP belongs to a commercial VPN service",
        "TZ_MISMATCH": "Device timezone doesn't fit the IP location",
        "FP_INCONSISTENT": "Browser fingerprint attributes contradict each other (anti-detect browser suspected)",
        "FRESH_PROFILE": "Browser has no stored cookies or history",
        "DIRECT_NAV": "Went straight to payout settings after sign-in",
        "RESET_THEN_CHANGE": "Password reset followed by contact or payout changes in the same session",
        "BEHAVIOR_MISMATCH": "Typing and pointer behavior differ from this user's profile",
        "SIM_RECENT": "SIM change or port on the phone on file in the last 7 days"
      },
      "recent_sessions": {
        "columns": [
          "ts",
          "device_id",
          "vendor_score",
          "reason_codes",
          "proxy_or_vpn",
          "remote_access_tool",
          "emulator_or_automation",
          "timezone_vs_ip",
          "behavior"
        ],
        "rows": [
          [
            "2026-09-07T13:48:05Z",
            "dv_h1",
            64,
            [],
            "no",
            "none",
            "no",
            "UTC-06:00, fits Denver CO",
            "consistent with profile (0.90)"
          ],
          [
            "2026-10-04T08:12:37Z",
            "dv_h8",
            702,
            [
              "NEW_DEVICE",
              "VPN"
            ],
            "commercial VPN",
            "none",
            "no",
            "UTC-06:00, fits Denver CO",
            "1 wrong password, then left the page"
          ],
          [
            "2026-10-06T13:55:30Z",
            "dv_h1",
            41,
            [],
            "no",
            "none",
            "no",
            "UTC-06:00, fits",
            "consistent (0.93)"
          ],
          [
            "2026-10-07T14:10:02Z",
            "dv_h1",
            38,
            [],
            "no",
            "none",
            "no",
            "UTC-06:00, fits",
            "consistent (0.92)"
          ],
          [
            "2026-10-07T17:31:12Z",
            "dv_h9",
            655,
            [
              "NEW_DEVICE",
              "FRESH_PROFILE",
              "DIRECT_NAV"
            ],
            "no",
            "none",
            "no",
            "UTC-06:00, fits Denver CO",
            "password pasted into the field (no password manager on this fresh browser); no laptop profile to compare with (owner uses the app; last web session 2026-08-11 on a Mac); opened payout settings 11 seconds after sign-in; picked the bank from the list and signed in to it on the first try"
          ]
        ]
      }
    },
    "phone_checks": [
      {
        "checked": "2026-10-07T17:31:00Z",
        "number": "(720) 555-0144 (on file since 2022-01-10)",
        "trigger": "2-step SMS at sign-in",
        "line_type": "mobile, postpaid",
        "subscriber_name_match": "match (Lindqvist)",
        "sim_change": "none in 90 days",
        "port_out": "none",
        "device_change": "same handset as at every check since 2023-11",
        "call_forwarding": "not active"
      },
      {
        "checked": "2026-10-07T17:35:00Z",
        "number": "(720) 555-0144",
        "trigger": "2-step SMS for the payout destination",
        "line_type": "mobile, postpaid",
        "subscriber_name_match": "match",
        "sim_change": "none in 90 days",
        "port_out": "none",
        "device_change": "none",
        "call_forwarding": "not active"
      }
    ],
    "security_notices": {
      "columns": [
        "ts",
        "channel",
        "to",
        "message",
        "outcome"
      ],
      "rows": [
        [
          "2026-07-06T13:58:22Z",
          "email",
          "hello.fernandash@example.net",
          "A debit card ending 8812 was added for instant payouts",
          "delivered"
        ],
        [
          "2026-08-01T12:00:00Z",
          "email",
          "hello.fernandash@example.net",
          "Your July statement is ready",
          "delivered"
        ],
        [
          "2026-08-11T02:29:40Z",
          "SMS",
          "(720) 555-0144",
          "Your verification code (renew trust on this computer)",
          "entered"
        ],
        [
          "2026-09-01T12:00:00Z",
          "email",
          "hello.fernandash@example.net",
          "Your August statement is ready",
          "delivered"
        ],
        [
          "2026-10-01T12:00:00Z",
          "email",
          "hello.fernandash@example.net",
          "Your September statement is ready",
          "delivered"
        ],
        [
          "2026-10-07T17:30:50Z",
          "SMS",
          "(720) 555-0144",
          "Your verification code. We'll never call to ask for it.",
          "entered 17:31:04Z on dv_h9 (14 seconds)"
        ],
        [
          "2026-10-07T17:31:13Z",
          "email",
          "hello.fernandash@example.net",
          "New sign-in from Windows, Denver CO",
          "delivered; not opened"
        ],
        [
          "2026-10-07T17:34:56Z",
          "SMS",
          "(720) 555-0144",
          "Your verification code to add a payout account. We'll never call to ask for it.",
          "entered 17:35:09Z on dv_h9 (13 seconds)"
        ],
        [
          "2026-10-07T17:35:27Z",
          "email",
          "hello.fernandash@example.net",
          "A payout account ending 6075 was added",
          "delivered; not opened"
        ],
        [
          "2026-10-07T17:35:27Z",
          "SMS",
          "(720) 555-0144",
          "A payout account ending 6075 was added. Not you? Call us.",
          "delivered; no reply"
        ]
      ]
    },
    "daily_sales": {
      "period": "2026-07-09 to 2026-10-06",
      "note": "Card payments by day, local time; memberships renew on the 5th",
      "columns": [
        "date",
        "payments",
        "gross_usd",
        "refunds_usd",
        "fees_usd",
        "net_usd",
        "disputes"
      ],
      "rows": [
        [
          "2026-07-09",
          15,
          388.12,
          0,
          12.17,
          375.95,
          0
        ],
        [
          "2026-07-10",
          8,
          221.3,
          0,
          6.89,
          214.41,
          0
        ],
        [
          "2026-07-11",
          22,
          532.7,
          0,
          16.85,
          515.85,
          0
        ],
        [
          "2026-07-12",
          23,
          606.93,
          55.43,
          18.99,
          532.51,
          0
        ],
        [
          "2026-07-13",
          14,
          373.74,
          0,
          11.68,
          362.06,
          0
        ],
        [
          "2026-07-14",
          16,
          360.64,
          0,
          11.52,
          349.12,
          0
        ],
        [
          "2026-07-15",
          12,
          289.71,
          0,
          9.17,
          280.54,
          0
        ],
        [
          "2026-07-16",
          13,
          312.89,
          30.69,
          9.9,
          272.3,
          0
        ],
        [
          "2026-07-17",
          9,
          248.52,
          109.97,
          7.73,
          130.82,
          0
        ],
        [
          "2026-07-18",
          24,
          637.52,
          0,
          19.93,
          617.59,
          0
        ],
        [
          "2026-07-19",
          13,
          335.44,
          0,
          10.52,
          324.92,
          0
        ],
        [
          "2026-07-20",
          21,
          550.33,
          48.59,
          17.23,
          484.51,
          0
        ],
        [
          "2026-07-21",
          18,
          440.07,
          38.91,
          13.9,
          387.26,
          0
        ],
        [
          "2026-07-22",
          10,
          283.42,
          0,
          8.79,
          274.63,
          0
        ],
        [
          "2026-07-23",
          18,
          418.54,
          0,
          13.31,
          405.23,
          0
        ],
        [
          "2026-07-24",
          10,
          267.3,
          0,
          8.35,
          258.95,
          0
        ],
        [
          "2026-07-25",
          47,
          1545.27,
          0,
          47.19,
          1498.08,
          0
        ],
        [
          "2026-07-26",
          19,
          501.07,
          0,
          15.68,
          485.39,
          0
        ],
        [
          "2026-07-27",
          13,
          309.21,
          0,
          9.8,
          299.41,
          0
        ],
        [
          "2026-07-28",
          15,
          343.29,
          0,
          10.94,
          332.35,
          0
        ],
        [
          "2026-07-29",
          12,
          312.83,
          139.86,
          9.8,
          163.17,
          0
        ],
        [
          "2026-07-30",
          19,
          474.51,
          0,
          14.95,
          459.56,
          0
        ],
        [
          "2026-07-31",
          16,
          401.28,
          51.82,
          12.64,
          336.82,
          0
        ],
        [
          "2026-08-01",
          20,
          468.96,
          0,
          14.9,
          454.06,
          0
        ],
        [
          "2026-08-02",
          23,
          617.82,
          0,
          19.29,
          598.53,
          0
        ],
        [
          "2026-08-03",
          19,
          486.21,
          76.29,
          15.27,
          394.65,
          0
        ],
        [
          "2026-08-04",
          19,
          432.33,
          173.86,
          13.79,
          244.68,
          0
        ],
        [
          "2026-08-05",
          107,
          12655.83,
          0,
          358.74,
          12297.09,
          0
        ],
        [
          "2026-08-06",
          17,
          431.82,
          0,
          13.58,
          418.24,
          0
        ],
        [
          "2026-08-07",
          15,
          379.91,
          0,
          11.95,
          367.96,
          0
        ],
        [
          "2026-08-08",
          23,
          553.76,
          0,
          17.53,
          536.23,
          0
        ],
        [
          "2026-08-09",
          14,
          346.73,
          38.6,
          10.94,
          297.19,
          0
        ],
        [
          "2026-08-10",
          21,
          526.16,
          153.52,
          16.57,
          356.07,
          0
        ],
        [
          "2026-08-11",
          14,
          328.61,
          0,
          10.44,
          318.17,
          0
        ],
        [
          "2026-08-12",
          13,
          296.3,
          0,
          9.45,
          286.85,
          0
        ],
        [
          "2026-08-13",
          15,
          360.18,
          0,
          11.4,
          348.78,
          0
        ],
        [
          "2026-08-14",
          9,
          217.19,
          0,
          6.87,
          210.32,
          0
        ],
        [
          "2026-08-15",
          25,
          549.79,
          0,
          17.62,
          532.17,
          0
        ],
        [
          "2026-08-16",
          23,
          583.71,
          0,
          18.35,
          565.36,
          0
        ],
        [
          "2026-08-17",
          22,
          517.47,
          0,
          16.43,
          501.04,
          0
        ],
        [
          "2026-08-18",
          20,
          511.73,
          0,
          16.07,
          495.66,
          0
        ],
        [
          "2026-08-19",
          17,
          405.35,
          0,
          12.85,
          392.5,
          0
        ],
        [
          "2026-08-20",
          18,
          437.05,
          0,
          13.82,
          423.23,
          0
        ],
        [
          "2026-08-21",
          18,
          436.97,
          0,
          13.82,
          423.15,
          0
        ],
        [
          "2026-08-22",
          16,
          383.08,
          0,
          12.13,
          370.95,
          0
        ],
        [
          "2026-08-23",
          26,
          661.39,
          60.3,
          20.79,
          580.3,
          0
        ],
        [
          "2026-08-24",
          17,
          418.3,
          0,
          13.2,
          405.1,
          0
        ],
        [
          "2026-08-25",
          19,
          414.05,
          0,
          13.29,
          400.76,
          0
        ],
        [
          "2026-08-26",
          16,
          401.05,
          0,
          12.63,
          388.42,
          0
        ],
        [
          "2026-08-27",
          22,
          535.98,
          138.63,
          16.94,
          380.41,
          0
        ],
        [
          "2026-08-28",
          17,
          392.11,
          0,
          12.48,
          379.63,
          0
        ],
        [
          "2026-08-29",
          34,
          1203.56,
          0,
          36.5,
          1167.06,
          0
        ],
        [
          "2026-08-30",
          29,
          660.38,
          0,
          21.06,
          639.32,
          0
        ],
        [
          "2026-08-31",
          22,
          529.17,
          69.91,
          16.75,
          442.51,
          0
        ],
        [
          "2026-09-01",
          12,
          281.8,
          145.77,
          8.95,
          127.08,
          0
        ],
        [
          "2026-09-02",
          18,
          464.53,
          0,
          14.57,
          449.96,
          0
        ],
        [
          "2026-09-03",
          20,
          516.1,
          45.1,
          16.19,
          454.81,
          0
        ],
        [
          "2026-09-04",
          15,
          406.74,
          47.63,
          12.69,
          346.42,
          0
        ],
        [
          "2026-09-05",
          113,
          12985.24,
          0,
          368.39,
          12616.85,
          0
        ],
        [
          "2026-09-06",
          16,
          350.21,
          0,
          11.23,
          338.98,
          0
        ],
        [
          "2026-09-07",
          17,
          396.79,
          52.91,
          12.61,
          331.27,
          0
        ],
        [
          "2026-09-08",
          20,
          445.29,
          0,
          14.25,
          431.04,
          0
        ],
        [
          "2026-09-09",
          16,
          394.43,
          0,
          12.45,
          381.98,
          0
        ],
        [
          "2026-09-10",
          20,
          535.17,
          0,
          16.72,
          518.45,
          0
        ],
        [
          "2026-09-11",
          14,
          373.44,
          0,
          11.67,
          361.77,
          0
        ],
        [
          "2026-09-12",
          24,
          580.62,
          0,
          18.37,
          562.25,
          0
        ],
        [
          "2026-09-13",
          19,
          428.36,
          0,
          13.68,
          414.68,
          0
        ],
        [
          "2026-09-14",
          13,
          300,
          0,
          9.55,
          290.45,
          0
        ],
        [
          "2026-09-15",
          21,
          499.06,
          150.28,
          15.82,
          332.96,
          0
        ],
        [
          "2026-09-16",
          11,
          298.95,
          0,
          9.32,
          289.63,
          0
        ],
        [
          "2026-09-17",
          13,
          318.16,
          141.18,
          10.05,
          166.93,
          0
        ],
        [
          "2026-09-18",
          9,
          216.46,
          0,
          6.85,
          209.61,
          0
        ],
        [
          "2026-09-19",
          24,
          605.4,
          29.04,
          19.05,
          557.31,
          0
        ],
        [
          "2026-09-20",
          16,
          412.27,
          0,
          12.94,
          399.33,
          0
        ],
        [
          "2026-09-21",
          18,
          486.7,
          0,
          15.18,
          471.52,
          0
        ],
        [
          "2026-09-22",
          13,
          346.93,
          29.73,
          10.84,
          306.36,
          0
        ],
        [
          "2026-09-23",
          15,
          356.41,
          0,
          11.3,
          345.11,
          0
        ],
        [
          "2026-09-24",
          14,
          353.65,
          0,
          11.13,
          342.52,
          0
        ],
        [
          "2026-09-25",
          18,
          409.98,
          0,
          13.07,
          396.91,
          0
        ],
        [
          "2026-09-26",
          44,
          1546.15,
          0,
          46.92,
          1499.23,
          0
        ],
        [
          "2026-09-27",
          17,
          430.97,
          0,
          13.55,
          417.42,
          0
        ],
        [
          "2026-09-28",
          14,
          344.7,
          51.2,
          10.88,
          282.62,
          0
        ],
        [
          "2026-09-29",
          17,
          399.38,
          0,
          12.68,
          386.7,
          0
        ],
        [
          "2026-09-30",
          16,
          396.16,
          0,
          12.49,
          383.67,
          0
        ],
        [
          "2026-10-01",
          19,
          494.9,
          34,
          15.51,
          445.39,
          0
        ],
        [
          "2026-10-02",
          13,
          349.21,
          0,
          10.9,
          338.31,
          0
        ],
        [
          "2026-10-03",
          26,
          611.86,
          0,
          19.43,
          592.43,
          0
        ],
        [
          "2026-10-04",
          18,
          448.81,
          0,
          14.14,
          434.67,
          0
        ],
        [
          "2026-10-05",
          109,
          13416.79,
          0,
          379.86,
          13036.93,
          0
        ],
        [
          "2026-10-06",
          19,
          412.06,
          9.83,
          13.23,
          389,
          0
        ]
      ]
    },
    "payout_history": {
      "columns": [
        "initiated",
        "type",
        "destination",
        "amount_usd",
        "covers",
        "status",
        "arrived"
      ],
      "rows": [
        [
          "2026-07-10T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          12210.6,
          "2026-07-03 to 2026-07-09",
          "paid",
          "2026-07-13"
        ],
        [
          "2026-07-17T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          2526.79,
          "2026-07-10 to 2026-07-16",
          "paid",
          "2026-07-20"
        ],
        [
          "2026-07-24T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          2624.96,
          "2026-07-17 to 2026-07-23",
          "paid",
          "2026-07-27"
        ],
        [
          "2026-07-31T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          3496.91,
          "2026-07-24 to 2026-07-30",
          "paid",
          "2026-08-03"
        ],
        [
          "2026-08-07T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          14744.07,
          "2026-07-31 to 2026-08-06",
          "paid",
          "2026-08-10"
        ],
        [
          "2026-08-14T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          2511.25,
          "2026-08-07 to 2026-08-13",
          "paid",
          "2026-08-17"
        ],
        [
          "2026-08-21T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          3120.28,
          "2026-08-14 to 2026-08-20",
          "paid",
          "2026-08-24"
        ],
        [
          "2026-08-28T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          2949.09,
          "2026-08-21 to 2026-08-27",
          "paid",
          "2026-08-31"
        ],
        [
          "2026-09-04T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          3660.37,
          "2026-08-28 to 2026-09-03",
          "paid",
          "2026-09-08"
        ],
        [
          "2026-09-07T13:52:12Z",
          "instant (debit card)",
          "Visa debit x8812",
          3100,
          "part of the available balance",
          "paid",
          "2026-09-07"
        ],
        [
          "2026-09-11T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          11818.49,
          "2026-09-04 to 2026-09-10",
          "paid",
          "2026-09-14"
        ],
        [
          "2026-09-18T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          2418.67,
          "2026-09-11 to 2026-09-17",
          "paid",
          "2026-09-21"
        ],
        [
          "2026-09-25T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          2631.76,
          "2026-09-18 to 2026-09-24",
          "paid",
          "2026-09-28"
        ],
        [
          "2026-10-02T15:00:00Z",
          "standard (ACH)",
          "checking x3346",
          3811.94,
          "2026-09-25 to 2026-10-01",
          "paid",
          "2026-10-05"
        ]
      ]
    },
    "support_history": {
      "columns": [
        "ts",
        "channel",
        "contact",
        "verification",
        "summary"
      ],
      "rows": [
        [
          "2025-11-21T16:30:00Z",
          "phone",
          "(720) 555-0144 (on file)",
          "SMS code",
          "Owner asked how to pause a member's recurring membership; explained"
        ],
        [
          "2026-04-02T21:15:00Z",
          "chat (app)",
          "dv_h1",
          "signed-in app",
          "Owner asked whether we offer business loans; told her she isn't eligible for an offer yet"
        ],
        [
          "2026-09-18T19:03:00Z",
          "chat (app)",
          "dv_h1",
          "signed-in app",
          "Owner asked whether instant payouts can go to a bank account instead of a card and whether the $25,000 daily limit can be raised. Agent: bank accounts on the real-time network can be added for instant payouts; limit stays $25,000"
        ],
        [
          "2026-10-07T17:44:10Z",
          "chat (web)",
          "dv_h9 at 203.0.113.201",
          "signed-in web session under review",
          "'Hi, my instant payout says it is in review. I need it today to pay my landlord, can you release it?' Agent: reviews usually finish within the hour. 'Ok please hurry, I can't take calls right now, I'm teaching all afternoon.' No reply since 17:46Z"
        ]
      ]
    },
    "rules_and_scores": {
      "rules_fired": [
        "PAY-02 Instant payout to a destination added today",
        "PAY-07 Instant payout over $5,000 within 24 hours of a new-device sign-in",
        "PAY-09 Instant payout more than twice the account's largest earlier instant payout"
      ],
      "platform_risk_model": "0.58 (0 to 1; our queue prioritizes above 0.80)",
      "device_intelligence_vendor_score": "655 (0 to 1,000, higher is riskier)"
    },
    "payout_under_review": {
      "requested": "2026-10-07T17:38:40Z",
      "session": "dv_h9 at 203.0.113.201, signed in 17:31:12Z with the current password and an SMS code",
      "type": "Instant payout (real-time payments network)",
      "amount_usd": 9850,
      "fee_usd": 147.75,
      "available_balance_usd": 14977.74,
      "covers": "part of the balance from 2026-10-02 onward, including the October 5 membership renewals",
      "destination": "personal checking x6075 at an online bank (added 2026-10-07T17:35:26Z)",
      "owner_usual": "Weekly standard payouts to x3346 on Fridays; instant payouts of $2,400 and $3,100 to debit card x8812, each from her iPhone at home within two days of the monthly renewals",
      "status": "Waiting in review since 17:38:41Z"
    }
  },
  "questions": {
    "takeover_likelihood": {
      "type": "score",
      "instructions": "How likely is it that someone other than the account holder or a user they authorized controls the session that requested the money movement under review, or the session that made the recent sign-in, contact, 2-step or payout change before it?",
      "criteria": [
        "Very unlikely (under 10%)",
        "Unlikely (10-40%)",
        "Uncertain (40-60%)",
        "Likely (60-90%)",
        "Very likely (over 90%)"
      ]
    },
    "access_route": {
      "type": "multi_choice",
      "instructions": "Which of these does the record show happened on this account in the last 30 days? Choose every one that applies, or only none_of_these.",
      "criteria": {
        "password_stolen": "Someone else signed in with the account holder's current password, without resetting it",
        "email_taken_over": "Someone else used the email account on file, for example to open a password reset link or receive change notices",
        "phone_taken_over": "Someone else took over the phone number on file (SIM swap or port-out) or replaced it with their own number",
        "support_tricked": "Our support team changed a sign-in detail, contact detail or 2-step method for someone posing as the account holder",
        "code_handed_over": "The account holder was tricked into reading out a one-time code or approving a sign-in for someone else",
        "remote_access": "Someone operated the account holder's own device through a remote-access or screen-sharing tool",
        "none_of_these": "None of these: the account holder or their authorized users made every recent change themselves"
      }
    },
    "destination_owner": {
      "type": "choice",
      "instructions": "Who owns and controls the bank account or card the money movement under review would pay into?",
      "criteria": {
        "holder": "The account holder: the business itself or its owner, in an account they control",
        "known_party": "A person or business with a real, earlier relationship to the account holder, such as a family member, employee or regular supplier",
        "unrelated": "Someone with no evident relationship to the account holder, including an account opened in the holder's name by someone else",
        "cannot_tell": "The records can't establish it: ownership checks are missing or inconclusive and nothing else ties the account to anyone"
      }
    },
    "action": {
      "type": "choice",
      "instructions": "What should happen to the money movement under review?",
      "criteria": {
        "allow": "Release it as requested",
        "step_up": "Release it only after the account holder confirms it with a 2-step method that existed before the recent changes and that the session under review did not use",
        "hold_and_call": "Hold it and call the account holder at a phone number that was on file before the recent changes; release it only if they confirm",
        "block_and_lock": "Cancel it, lock the account, end all sessions, undo the recent changes and contact the account holder through details on file before the changes"
      }
    }
  }
}