{
  "model": "grayson-1",
  "state": {
    "case": {
      "case_id": "ATO-26-10-0381",
      "queue": "Payout review: account security",
      "opened": "2026-10-05T00:21:48Z",
      "records_as_of": "2026-10-05T00:34:10Z",
      "local_time": "Sunday 2026-10-04, 8:34 p.m. EDT in Portland, ME"
    },
    "platform_controls": "Sign-in is email and password. A device not trusted in the last 30 days must also pass 2-step verification: an SMS code to the phone on file, or an authenticator app if the user has added one. The mobile app then signs in with Face ID or a fingerprint. 'Forgot password' emails a reset link to the email on file, and 2-step verification is still required after a reset. Changing the email or phone on file, adding or removing a 2-step method, and adding a payout destination each need a fresh 2-step code; we email the previous address and text the phone on file after each change. Payout destinations are business or owner checking accounts, verified by signing in to the bank through our account-verification provider (which returns the holder name and the account's open date) or by micro-deposits, and debit cards for instant payouts, checked with the card network's account name inquiry. Standard payouts go by ACH on the schedule the business picks and arrive the next business day. Instant payouts send up to $25,000 a day in minutes, to a debit card or a bank account on the real-time payments network, for a 1.5% fee, and cannot be recalled. Any payout to a destination added in the last 7 days, and any instant payout over $5,000 within 24 hours of a sign-in, contact or 2-step change, waits in this review queue. Staff with the point-of-sale role take payments on the shop's devices with a PIN and cannot see payouts or change settings.",
    "business": {
      "merchant_id": "mer_20417",
      "legal_name": "Harbor Lane Bakery LLC",
      "doing_business_as": "Harbor Lane Bakery",
      "business_type": "Single-member LLC; bakery and cafe, MCC 5462 (bakeries)",
      "location": "Portland, ME; open Tuesday to Sunday, 6:30 a.m. to 3 p.m.; closed Mondays",
      "on_platform_since": "2021-05-14",
      "owner": {
        "name": "Denise Kowalczyk",
        "role": "Owner and only admin",
        "phone_on_file": "(207) 555-0163, since 2021-05-14",
        "email_on_file": "harborlane.payouts@example.com since 2026-10-05T00:11:52Z; harborlane.bakery@example.net from 2021-05-14 until then",
        "two_step_methods": "SMS to (207) 555-0163 since 2021; authenticator app added 2026-10-05T00:09:26Z"
      },
      "products": "In-person card payments at the counter, online invoices for wholesale cafe customers, weekly standard payouts",
      "monthly_card_volume_usd_last_12_months": "52,000 to 78,000 (summer high)",
      "payout_schedule": "Weekly standard payout every Monday for the previous Monday to Sunday",
      "disputes_12_months": 1,
      "account_status": "Active; no holds before tonight"
    },
    "users": {
      "columns": [
        "user",
        "role",
        "added",
        "sign_in"
      ],
      "rows": [
        [
          "Denise Kowalczyk",
          "Owner (admin)",
          "2021-05-14",
          "email and password, 2-step"
        ],
        [
          "Marco Bellini",
          "Point of sale",
          "2023-03-11",
          "PIN on the shop iPad only"
        ],
        [
          "Aisha Grant",
          "Point of sale",
          "2023-03-11",
          "PIN on the shop iPad only"
        ]
      ]
    },
    "devices": {
      "columns": [
        "device_id",
        "device",
        "user",
        "first_seen",
        "trusted",
        "last_seen"
      ],
      "rows": [
        [
          "dv_b2",
          "MacBook Air, Safari (macOS 14)",
          "Denise Kowalczyk",
          "2021-05-14",
          "yes, renewed 2026-08-17",
          "2026-09-28T15:02:28Z"
        ],
        [
          "dv_a1",
          "iPhone 13, our app (iOS 18)",
          "Denise Kowalczyk",
          "2022-09-30",
          "yes (Face ID)",
          "2026-10-04T23:43:02Z"
        ],
        [
          "dv_c3",
          "iPad 9th gen at the counter, point-of-sale app",
          "shop device (staff PINs)",
          "2023-03-11",
          "yes (shop device)",
          "2026-10-04T10:20:01Z"
        ],
        [
          "dv_x9",
          "Windows 10, Chrome 129",
          "signed in as Denise Kowalczyk",
          "2026-10-04T23:52:08Z",
          "no",
          "2026-10-05T00:21:47Z"
        ]
      ]
    },
    "credential_and_contact_changes": {
      "columns": [
        "ts",
        "change",
        "device_id",
        "ip",
        "verification"
      ],
      "rows": [
        [
          "2021-05-14T15:12:40Z",
          "Account opened; owner Denise Kowalczyk; email harborlane.bakery@example.net; phone (207) 555-0163",
          "dv_b2",
          "203.0.113.84",
          "identity check passed"
        ],
        [
          "2021-05-17T13:30:02Z",
          "Payout destination added: checking x2290 (the bakery's bank since 2015)",
          "dv_b2",
          "203.0.113.84",
          "bank login through verification provider; holder HARBOR LANE BAKERY LLC"
        ],
        [
          "2022-09-30T23:41:18Z",
          "App trusted on new phone dv_a1 (iPhone 13)",
          "dv_a1",
          "203.0.113.84",
          "SMS code"
        ],
        [
          "2023-03-11T11:08:55Z",
          "Staff users added: Marco Bellini, Aisha Grant (point-of-sale role)",
          "dv_b2",
          "198.51.100.36",
          "SMS code"
        ],
        [
          "2023-03-11T11:20:40Z",
          "Shop iPad dv_c3 set up for point of sale",
          "dv_c3",
          "198.51.100.36",
          "owner approval in app"
        ],
        [
          "2024-02-03T15:44:21Z",
          "Password changed",
          "dv_b2",
          "203.0.113.84",
          "current password"
        ],
        [
          "2024-11-09T14:10:06Z",
          "Payout schedule changed from daily to weekly (Mondays)",
          "dv_b2",
          "203.0.113.84",
          "SMS code"
        ],
        [
          "2026-10-05T00:03:44Z",
          "'Forgot password' requested; reset link emailed to harborlane.bakery@example.net",
          "dv_x9",
          "198.51.100.77",
          "none required"
        ],
        [
          "2026-10-05T00:06:58Z",
          "Password reset through the emailed link (link opened 00:06:31Z from 198.51.100.77)",
          "dv_x9",
          "198.51.100.77",
          "email link"
        ],
        [
          "2026-10-05T00:09:26Z",
          "2-step method added: authenticator app (on a device we can't see)",
          "dv_x9",
          "198.51.100.77",
          "SMS code to (207) 555-0163, entered 00:09:20Z"
        ],
        [
          "2026-10-05T00:11:52Z",
          "Email on file changed to harborlane.payouts@example.com",
          "dv_x9",
          "198.51.100.77",
          "authenticator app code"
        ],
        [
          "2026-10-05T00:12:30Z",
          "Notification settings: payout, sign-in and security emails turned off",
          "dv_x9",
          "198.51.100.77",
          "none required"
        ],
        [
          "2026-10-05T00:16:05Z",
          "Payout destination added: checking x4471 at an online bank, enabled for instant payouts",
          "dv_x9",
          "198.51.100.77",
          "authenticator app code; bank login through verification provider"
        ],
        [
          "2026-10-05T00:18:40Z",
          "Default payout destination changed from x2290 to x4471",
          "dv_x9",
          "198.51.100.77",
          "authenticator app code"
        ]
      ]
    },
    "payout_destinations": [
      {
        "destination": "checking x2290",
        "added": "2021-05-17",
        "status": "was default until 2026-10-05T00:18:40Z",
        "ownership_check": "Bank login through verification provider, 2021-05-17: holder HARBOR LANE BAKERY LLC (matches the legal name)",
        "account_opened": "2015-08-04",
        "payouts_received": "All 271 payouts since 2021-05, none returned"
      },
      {
        "destination": "checking x4471 at an online bank",
        "added": "2026-10-05T00:16:05Z",
        "status": "default since 00:18:40Z",
        "ownership_check": "Bank login through verification provider, 2026-10-05T00:15:48Z: holder TREVON A MILLS (no match to the business, the owner or any user)",
        "account_opened": "2026-08-21, per the verification provider",
        "payouts_received": "None yet",
        "seen_elsewhere_on_platform": "Not linked to any other business on our platform"
      }
    ],
    "sign_in_history": {
      "period": "2026-07-07 to 2026-10-05T00:34:10Z",
      "ip_addresses": {
        "198.51.100.36": "Business cable ISP, Portland ME (the bakery's Wi-Fi)",
        "203.0.113.84": "Residential cable ISP, Portland ME",
        "198.51.100.77": "Residential proxy network, exit in Portland ME (not the owner's ISP)"
      },
      "staff_point_of_sale_sign_ins": "78 staff PIN sign-ins on dv_c3 from 198.51.100.36, one each open day between 6:00 and 6:25 a.m. local time, all successful (Aisha Grant 28, Marco Bellini 26, Denise Kowalczyk 24); last 2026-10-04T10:20:01Z",
      "columns": [
        "ts",
        "device_id",
        "ip",
        "method",
        "result",
        "activity"
      ],
      "rows": [
        [
          "2026-07-09T23:45:55Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-07-12T00:51:20Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-07-14T01:13:11Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-07-14T19:05:50Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-16T23:56:38Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-07-27T01:39:25Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-27T14:28:41Z",
          "dv_b2",
          "203.0.113.84",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-07-29T01:38:49Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-07-30T01:01:05Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-30T18:22:10Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-01T00:21:34Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-08-01T23:42:49Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-03T13:30:02Z",
          "dv_b2",
          "203.0.113.84",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-08-04T01:58:54Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-08-06T01:54:05Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-08-06T18:43:22Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "staff timecards"
        ],
        [
          "2026-08-07T00:35:28Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-07T18:36:59Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-09T00:57:57Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-08-10T00:18:34Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-10T15:48:26Z",
          "dv_b2",
          "203.0.113.84",
          "password + trusted device",
          "success",
          "invoices"
        ],
        [
          "2026-08-12T17:58:03Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-14T00:45:09Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-15T01:41:58Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-08-17T13:51:13Z",
          "dv_b2",
          "203.0.113.84",
          "password + trusted device",
          "success",
          "weekly sales export for bookkeeping"
        ],
        [
          "2026-08-17T14:02:51Z",
          "dv_b2",
          "203.0.113.84",
          "password + SMS code (30-day trust renewed)",
          "success",
          "invoices"
        ],
        [
          "2026-08-19T19:00:57Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-19T23:37:24Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-08-22T23:38:10Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-08-24T01:28:20Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-08-24T13:20:22Z",
          "dv_b2",
          "203.0.113.84",
          "password + trusted device",
          "success",
          "weekly sales export for bookkeeping"
        ],
        [
          "2026-08-28T01:32:33Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-29T01:52:44Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-08-31T01:10:27Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-01T00:49:01Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-09-02T00:48:23Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-09-04T01:35:54Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-09-05T00:15:54Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-05T19:11:01Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-09-06T00:15:02Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-09-07T01:41:41Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-07T15:15:34Z",
          "dv_b2",
          "203.0.113.84",
          "password + trusted device",
          "success",
          "invoices"
        ],
        [
          "2026-09-08T00:05:52Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-09-08T17:42:09Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-09-09T00:36:09Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-09-10T00:58:17Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-09-11T01:33:54Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-12T00:49:16Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-12T23:49:08Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-14T00:18:50Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-14T13:03:25Z",
          "dv_b2",
          "203.0.113.84",
          "password + trusted device",
          "success",
          "invoices"
        ],
        [
          "2026-09-14T13:40:09Z",
          "dv_b2",
          "203.0.113.84",
          "password",
          "failed: wrong password",
          ""
        ],
        [
          "2026-09-14T13:40:31Z",
          "dv_b2",
          "203.0.113.84",
          "password + trusted device",
          "success",
          "weekly sales export for bookkeeping"
        ],
        [
          "2026-09-15T00:47:13Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-16T01:12:15Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-16T17:25:22Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "staff timecards"
        ],
        [
          "2026-09-17T01:13:23Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "items and prices"
        ],
        [
          "2026-09-17T23:31:45Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-09-19T18:11:53Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-20T01:00:01Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-21T00:54:39Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-09-21T13:33:46Z",
          "dv_b2",
          "203.0.113.84",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-23T01:43:44Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-23T23:55:35Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-09-27T00:09:38Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-28T15:02:28Z",
          "dv_b2",
          "203.0.113.84",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-29T00:51:05Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-30T00:40:09Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-09-30T19:00:04Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-03T01:45:00Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-10-03T17:28:42Z",
          "dv_a1",
          "198.51.100.36",
          "Face ID (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-10-04T21:58:12Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-04T23:43:02Z",
          "dv_a1",
          "203.0.113.84",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-04T23:52:08Z",
          "dv_x9",
          "198.51.100.77",
          "password",
          "failed: wrong password",
          ""
        ],
        [
          "2026-10-04T23:52:40Z",
          "dv_x9",
          "198.51.100.77",
          "password",
          "failed: wrong password",
          ""
        ],
        [
          "2026-10-04T23:53:31Z",
          "dv_x9",
          "198.51.100.77",
          "password",
          "failed: wrong password",
          ""
        ],
        [
          "2026-10-04T23:55:02Z",
          "dv_x9",
          "198.51.100.77",
          "password",
          "failed: wrong password",
          ""
        ],
        [
          "2026-10-05T00:07:19Z",
          "dv_x9",
          "198.51.100.77",
          "new password (reset link) + SMS code",
          "success",
          "2-step methods; email on file; notification settings; payout destinations; instant payout requested"
        ]
      ]
    },
    "device_intelligence": {
      "vendor": "Your device intelligence vendor, scored on every sign-in and sensitive change",
      "reason_code_meanings": {
        "NEW_DEVICE": "Device not seen on this account before",
        "NEW_LOCATION": "IP location not seen on this account in 90 days",
        "PROXY_RESIDENTIAL": "IP belongs to a residential proxy network",
        "VPN": "IP belongs to a commercial VPN service",
        "TZ_MISMATCH": "Device timezone doesn't fit the IP location",
        "FP_INCONSISTENT": "Browser fingerprint attributes contradict each other (anti-detect browser suspected)",
        "FRESH_PROFILE": "Browser has no stored cookies or history",
        "DIRECT_NAV": "Went straight to payout settings after sign-in",
        "RESET_THEN_CHANGE": "Password reset followed by contact or payout changes in the same session",
        "BEHAVIOR_MISMATCH": "Typing and pointer behavior differ from this user's profile",
        "SIM_RECENT": "SIM change or port on the phone on file in the last 7 days"
      },
      "recent_sessions": {
        "columns": [
          "ts",
          "device_id",
          "vendor_score",
          "reason_codes",
          "proxy_or_vpn",
          "remote_access_tool",
          "emulator_or_automation",
          "timezone_vs_ip",
          "behavior"
        ],
        "rows": [
          [
            "2026-09-28T13:12:40Z",
            "dv_b2",
            38,
            [],
            "no",
            "none",
            "no",
            "UTC-04:00, fits Portland ME",
            "consistent with profile (similarity 0.91)"
          ],
          [
            "2026-10-01T23:44:05Z",
            "dv_a1",
            22,
            [],
            "no",
            "none",
            "no",
            "UTC-04:00, fits",
            "consistent (0.94)"
          ],
          [
            "2026-10-03T00:05:51Z",
            "dv_a1",
            25,
            [],
            "no",
            "none",
            "no",
            "UTC-04:00, fits",
            "consistent (0.92)"
          ],
          [
            "2026-10-04T21:58:12Z",
            "dv_a1",
            19,
            [],
            "no",
            "none",
            "no",
            "UTC-04:00, fits",
            "consistent (0.95)"
          ],
          [
            "2026-10-04T23:52:08Z",
            "dv_x9",
            871,
            [
              "NEW_DEVICE",
              "PROXY_RESIDENTIAL",
              "TZ_MISMATCH",
              "FP_INCONSISTENT"
            ],
            "residential proxy",
            "none",
            "no",
            "UTC+01:00 on a Portland ME address",
            "4 wrong passwords in 3 minutes"
          ],
          [
            "2026-10-05T00:07:19Z",
            "dv_x9",
            947,
            [
              "NEW_DEVICE",
              "PROXY_RESIDENTIAL",
              "TZ_MISMATCH",
              "FP_INCONSISTENT",
              "RESET_THEN_CHANGE",
              "DIRECT_NAV",
              "BEHAVIOR_MISMATCH"
            ],
            "residential proxy",
            "none",
            "no",
            "UTC+01:00 on a Portland ME address",
            "new password pasted; pointer and typing differ from the owner's laptop profile (similarity 0.21); went to security settings 40 seconds after sign-in"
          ]
        ]
      }
    },
    "phone_checks": [
      {
        "checked": "2026-10-05T00:07:02Z",
        "number": "(207) 555-0163 (on file since 2021-05-14)",
        "trigger": "2-step SMS at sign-in",
        "line_type": "mobile, postpaid",
        "subscriber_name_match": "match (Kowalczyk)",
        "sim_change": "SIM changed 2026-10-04T22:41Z (1 hour 26 minutes before this code; first SIM change since 2022-09-30)",
        "port_out": "none",
        "device_change": "the number is now in a different handset (new IMEI)"
      },
      {
        "checked": "2026-09-28T13:12:31Z",
        "number": "(207) 555-0163",
        "trigger": "30-day trust renewal check",
        "line_type": "mobile, postpaid",
        "subscriber_name_match": "match",
        "sim_change": "none in 90 days",
        "port_out": "none",
        "device_change": "none"
      }
    ],
    "security_notices": {
      "columns": [
        "ts",
        "channel",
        "to",
        "message",
        "outcome"
      ],
      "rows": [
        [
          "2026-07-13T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-07-20T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-07-27T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-08-01T12:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your July statement is ready",
          "delivered"
        ],
        [
          "2026-08-03T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-08-10T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-08-17T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-08-17T14:02:30Z",
          "SMS",
          "(207) 555-0163",
          "Your verification code (renew trust on this computer). We'll never call to ask for it.",
          "entered"
        ],
        [
          "2026-08-24T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-08-31T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-09-01T12:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your August statement is ready",
          "delivered"
        ],
        [
          "2026-09-08T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-09-14T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-09-21T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-09-28T13:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your weekly payout is on its way",
          "delivered"
        ],
        [
          "2026-10-01T12:00:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your September statement is ready",
          "delivered"
        ],
        [
          "2026-10-05T00:03:44Z",
          "email",
          "harborlane.bakery@example.net",
          "Reset your password",
          "link opened 2026-10-05T00:06:31Z from 198.51.100.77 (dv_x9)"
        ],
        [
          "2026-10-05T00:06:59Z",
          "SMS",
          "(207) 555-0163",
          "Your verification code. We'll never call to ask for it.",
          "entered 00:07:14Z on dv_x9"
        ],
        [
          "2026-10-05T00:07:00Z",
          "email",
          "harborlane.bakery@example.net",
          "Your password was changed",
          "delivered"
        ],
        [
          "2026-10-05T00:09:10Z",
          "SMS",
          "(207) 555-0163",
          "Your verification code to add a 2-step method",
          "entered 00:09:20Z on dv_x9"
        ],
        [
          "2026-10-05T00:09:27Z",
          "email",
          "harborlane.bakery@example.net",
          "An authenticator app was added to your account",
          "delivered"
        ],
        [
          "2026-10-05T00:11:53Z",
          "email",
          "harborlane.bakery@example.net",
          "Your email address was changed",
          "delivered"
        ],
        [
          "2026-10-05T00:11:53Z",
          "SMS",
          "(207) 555-0163",
          "The email on your account was changed. Not you? Call us.",
          "delivered"
        ],
        [
          "2026-10-05T00:16:06Z",
          "SMS",
          "(207) 555-0163",
          "A payout account ending 4471 was added. Not you? Call us.",
          "delivered"
        ]
      ]
    },
    "daily_sales": {
      "period": "2026-07-07 to 2026-10-04",
      "note": "Card and invoice payments by business day, local time",
      "columns": [
        "date",
        "payments",
        "gross_usd",
        "refunds_usd",
        "fees_usd",
        "net_usd",
        "disputes"
      ],
      "rows": [
        [
          "2026-07-07",
          142,
          1701.66,
          0,
          59.8,
          1641.86,
          0
        ],
        [
          "2026-07-08",
          185,
          1996.23,
          0,
          72,
          1924.23,
          0
        ],
        [
          "2026-07-09",
          192,
          2647.13,
          0,
          90.14,
          2556.99,
          0
        ],
        [
          "2026-07-10",
          248,
          2636.95,
          172.81,
          95.47,
          2368.67,
          0
        ],
        [
          "2026-07-11",
          283,
          3437,
          0,
          120.41,
          3316.59,
          0
        ],
        [
          "2026-07-12",
          285,
          3140.5,
          0,
          112.67,
          3027.83,
          0
        ],
        [
          "2026-07-14",
          195,
          2230.97,
          0,
          79.29,
          2151.68,
          0
        ],
        [
          "2026-07-15",
          217,
          2233.86,
          0,
          81.57,
          2152.29,
          0
        ],
        [
          "2026-07-16",
          181,
          2810.83,
          0,
          93.43,
          2717.4,
          0
        ],
        [
          "2026-07-17",
          265,
          2987.84,
          0,
          106.57,
          2881.27,
          0
        ],
        [
          "2026-07-18",
          357,
          3729.34,
          0,
          135.65,
          3593.69,
          0
        ],
        [
          "2026-07-19",
          269,
          2912.85,
          178.26,
          104.96,
          2629.63,
          0
        ],
        [
          "2026-07-21",
          206,
          2266.44,
          17.12,
          81.34,
          2167.98,
          0
        ],
        [
          "2026-07-22",
          152,
          1716.32,
          0,
          61.2,
          1655.12,
          0
        ],
        [
          "2026-07-23",
          194,
          2992.38,
          90.21,
          99.6,
          2802.57,
          0
        ],
        [
          "2026-07-24",
          229,
          2835.03,
          0,
          98.88,
          2736.15,
          0
        ],
        [
          "2026-07-25",
          294,
          3303.41,
          51.65,
          117.93,
          3133.83,
          0
        ],
        [
          "2026-07-26",
          220,
          2696.95,
          0,
          94.28,
          2602.67,
          0
        ],
        [
          "2026-07-28",
          163,
          1703.12,
          0,
          61.94,
          1641.18,
          0
        ],
        [
          "2026-07-29",
          171,
          1856.21,
          0,
          66.85,
          1789.36,
          0
        ],
        [
          "2026-07-30",
          180,
          2826.65,
          0,
          93.75,
          2732.9,
          0
        ],
        [
          "2026-07-31",
          240,
          2983.8,
          0,
          103.97,
          2879.83,
          0
        ],
        [
          "2026-08-01",
          292,
          3442.84,
          56.28,
          121.47,
          3265.09,
          0
        ],
        [
          "2026-08-02",
          273,
          2865.37,
          0,
          104.09,
          2761.28,
          0
        ],
        [
          "2026-08-04",
          178,
          1891.18,
          0,
          68.48,
          1822.7,
          0
        ],
        [
          "2026-08-05",
          149,
          1745.68,
          0,
          61.68,
          1684,
          0
        ],
        [
          "2026-08-06",
          169,
          2686.59,
          14.02,
          88.9,
          2583.67,
          0
        ],
        [
          "2026-08-07",
          279,
          2939.51,
          0,
          106.68,
          2832.83,
          0
        ],
        [
          "2026-08-08",
          313,
          3642.15,
          0,
          128.91,
          3513.24,
          0
        ],
        [
          "2026-08-09",
          334,
          3496.61,
          51.49,
          127.11,
          3318.01,
          0
        ],
        [
          "2026-08-11",
          170,
          1961.52,
          0,
          69.57,
          1891.95,
          0
        ],
        [
          "2026-08-12",
          189,
          2287.73,
          0,
          80.21,
          2207.52,
          0
        ],
        [
          "2026-08-13",
          194,
          2778.26,
          0,
          93.86,
          2684.4,
          0
        ],
        [
          "2026-08-14",
          242,
          2729.09,
          138.56,
          97.34,
          2493.19,
          0
        ],
        [
          "2026-08-15",
          327,
          3458.33,
          170.23,
          125.38,
          3162.72,
          0
        ],
        [
          "2026-08-16",
          289,
          3498.71,
          0,
          122.67,
          3376.04,
          0
        ],
        [
          "2026-08-18",
          158,
          1805.72,
          38.26,
          64.19,
          1703.27,
          0
        ],
        [
          "2026-08-19",
          174,
          2090.13,
          0,
          73.42,
          2016.71,
          0
        ],
        [
          "2026-08-20",
          231,
          3036.38,
          114.35,
          104.47,
          2817.56,
          0
        ],
        [
          "2026-08-21",
          183,
          2211.1,
          0,
          77.56,
          2133.54,
          0
        ],
        [
          "2026-08-22",
          321,
          3507.33,
          33.49,
          126.1,
          3347.74,
          0
        ],
        [
          "2026-08-23",
          300,
          3495.83,
          0,
          123.69,
          3372.14,
          0
        ],
        [
          "2026-08-25",
          185,
          2057.13,
          0,
          73.63,
          1983.5,
          0
        ],
        [
          "2026-08-26",
          195,
          2209.16,
          0,
          78.71,
          2130.45,
          0
        ],
        [
          "2026-08-27",
          242,
          3065.51,
          0,
          106.36,
          2959.15,
          0
        ],
        [
          "2026-08-28",
          196,
          2307.04,
          0,
          81.43,
          2225.61,
          0
        ],
        [
          "2026-08-29",
          284,
          3075.13,
          0,
          110.81,
          2964.32,
          0
        ],
        [
          "2026-08-30",
          283,
          2928.57,
          0,
          106.79,
          2821.78,
          0
        ],
        [
          "2026-09-01",
          169,
          2125.52,
          0,
          73.86,
          2051.66,
          0
        ],
        [
          "2026-09-02",
          156,
          1707.62,
          0,
          61.36,
          1646.26,
          0
        ],
        [
          "2026-09-03",
          192,
          2756.1,
          0,
          93.06,
          2663.04,
          0
        ],
        [
          "2026-09-04",
          189,
          2237.64,
          62.39,
          78.87,
          2096.38,
          0
        ],
        [
          "2026-09-05",
          303,
          3572.92,
          0,
          126.05,
          3446.87,
          0
        ],
        [
          "2026-09-06",
          287,
          3130.61,
          0,
          112.6,
          3018.01,
          0
        ],
        [
          "2026-09-08",
          212,
          2302.98,
          0,
          82.92,
          2220.06,
          0
        ],
        [
          "2026-09-09",
          166,
          2086.44,
          0,
          72.52,
          2013.92,
          0
        ],
        [
          "2026-09-10",
          197,
          2879.89,
          0,
          96.88,
          2783.01,
          0
        ],
        [
          "2026-09-11",
          230,
          2822.05,
          0,
          98.63,
          2723.42,
          0
        ],
        [
          "2026-09-12",
          278,
          3213.96,
          0,
          113.93,
          3100.03,
          0
        ],
        [
          "2026-09-13",
          294,
          3412.94,
          0,
          120.87,
          3292.07,
          0
        ],
        [
          "2026-09-15",
          160,
          1704.32,
          0,
          61.68,
          1642.64,
          0
        ],
        [
          "2026-09-16",
          172,
          2050.8,
          0,
          72.16,
          1978.64,
          0
        ],
        [
          "2026-09-17",
          204,
          2750.4,
          58.58,
          94.11,
          2597.71,
          0
        ],
        [
          "2026-09-18",
          225,
          2801.29,
          0,
          97.57,
          2703.72,
          0
        ],
        [
          "2026-09-19",
          317,
          3841.03,
          0,
          134.64,
          3706.39,
          0
        ],
        [
          "2026-09-20",
          251,
          2954.99,
          0,
          104.29,
          2850.7,
          0
        ],
        [
          "2026-09-22",
          205,
          2270.91,
          0,
          81.36,
          2189.55,
          0
        ],
        [
          "2026-09-23",
          189,
          1993.67,
          17.79,
          72.33,
          1903.55,
          0
        ],
        [
          "2026-09-24",
          194,
          2731.26,
          32.51,
          92.6,
          2606.15,
          0
        ],
        [
          "2026-09-25",
          197,
          2351.87,
          0,
          82.73,
          2269.14,
          0
        ],
        [
          "2026-09-26",
          354,
          3704.82,
          22.37,
          134.69,
          3547.76,
          0
        ],
        [
          "2026-09-27",
          292,
          3096.88,
          166.57,
          112.2,
          2818.11,
          0
        ],
        [
          "2026-09-29",
          167,
          1909.42,
          0,
          67.87,
          1841.55,
          0
        ],
        [
          "2026-09-30",
          166,
          1983.3,
          63.03,
          69.75,
          1850.52,
          0
        ],
        [
          "2026-10-01",
          164,
          2621.89,
          0,
          86.67,
          2535.22,
          0
        ],
        [
          "2026-10-02",
          215,
          2451.63,
          0,
          87.2,
          2364.43,
          0
        ],
        [
          "2026-10-03",
          253,
          3022.21,
          0,
          106.3,
          2915.91,
          0
        ],
        [
          "2026-10-04",
          250,
          2783.01,
          0,
          99.58,
          2683.43,
          0
        ]
      ]
    },
    "payout_history": {
      "columns": [
        "initiated",
        "type",
        "destination",
        "amount_usd",
        "covers",
        "status",
        "arrived"
      ],
      "rows": [
        [
          "2026-07-13T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          14836.17,
          "2026-07-06 to 2026-07-12",
          "paid",
          "2026-07-14"
        ],
        [
          "2026-07-20T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          16125.96,
          "2026-07-13 to 2026-07-19",
          "paid",
          "2026-07-21"
        ],
        [
          "2026-07-27T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          15098.32,
          "2026-07-20 to 2026-07-26",
          "paid",
          "2026-07-28"
        ],
        [
          "2026-08-03T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          15069.64,
          "2026-07-27 to 2026-08-02",
          "paid",
          "2026-08-04"
        ],
        [
          "2026-08-10T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          15754.45,
          "2026-08-03 to 2026-08-09",
          "paid",
          "2026-08-11"
        ],
        [
          "2026-08-17T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          15815.82,
          "2026-08-10 to 2026-08-16",
          "paid",
          "2026-08-18"
        ],
        [
          "2026-08-24T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          15390.96,
          "2026-08-17 to 2026-08-23",
          "paid",
          "2026-08-25"
        ],
        [
          "2026-08-31T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          15084.81,
          "2026-08-24 to 2026-08-30",
          "paid",
          "2026-09-01"
        ],
        [
          "2026-09-08T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          14922.22,
          "2026-08-31 to 2026-09-06",
          "paid",
          "2026-09-09"
        ],
        [
          "2026-09-14T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          16132.51,
          "2026-09-07 to 2026-09-13",
          "paid",
          "2026-09-15"
        ],
        [
          "2026-09-21T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          15479.8,
          "2026-09-14 to 2026-09-20",
          "paid",
          "2026-09-22"
        ],
        [
          "2026-09-28T13:00:00Z",
          "standard (ACH)",
          "checking x2290",
          15334.26,
          "2026-09-21 to 2026-09-27",
          "paid",
          "2026-09-29"
        ]
      ]
    },
    "support_history": {
      "columns": [
        "ts",
        "channel",
        "contact",
        "verification",
        "summary"
      ],
      "rows": [
        [
          "2025-12-02T15:20:00Z",
          "phone",
          "(207) 555-0163 (on file)",
          "SMS code",
          "Owner asked why a wholesale invoice payment showed as pending; explained ACH timing"
        ],
        [
          "2026-03-19T14:05:00Z",
          "chat (app)",
          "dv_a1",
          "signed-in app",
          "Owner ordered a second card reader; shipped"
        ],
        [
          "2026-07-28T19:40:00Z",
          "chat (app)",
          "dv_a1",
          "signed-in app",
          "Owner asked to add a tip screen to the counter iPad; walked through settings"
        ]
      ]
    },
    "rules_and_scores": {
      "rules_fired": [
        "ATO-03 Payout destination added within 1 hour of a password reset",
        "ATO-07 Email on file changed and notification emails turned off in the same session",
        "ATO-11 SIM change on the phone on file within 24 hours of a 2-step code",
        "PAY-02 Instant payout to a destination added today",
        "PAY-05 Destination holder name doesn't match the business or the owner"
      ],
      "platform_risk_model": "0.97 (0 to 1; our queue prioritizes above 0.80)",
      "device_intelligence_vendor_score": "947 (0 to 1,000, higher is riskier)"
    },
    "payout_under_review": {
      "requested": "2026-10-05T00:21:47Z",
      "session": "dv_x9 at 198.51.100.77, signed in 00:07:19Z after the password reset",
      "type": "Instant payout (real-time payments network)",
      "amount_usd": 14191.06,
      "fee_usd": 212.87,
      "available_balance_usd": 14191.06,
      "covers": "all card and invoice sales from 2026-09-28 to 2026-10-04, which the weekly standard payout to x2290 would have sent on 2026-10-05",
      "destination": "checking x4471 at an online bank (added 2026-10-05T00:16:05Z)",
      "owner_usual": "Weekly standard payouts to x2290; no instant payout in 5 years on our platform",
      "status": "Waiting in review since 00:21:48Z"
    }
  },
  "questions": {
    "takeover_likelihood": {
      "type": "score",
      "instructions": "How likely is it that someone other than the account holder or a user they authorized controls the session that requested the money movement under review, or the session that made the recent sign-in, contact, 2-step or payout change before it?",
      "criteria": [
        "Very unlikely (under 10%)",
        "Unlikely (10-40%)",
        "Uncertain (40-60%)",
        "Likely (60-90%)",
        "Very likely (over 90%)"
      ]
    },
    "access_route": {
      "type": "multi_choice",
      "instructions": "Which of these does the record show happened on this account in the last 30 days? Choose every one that applies, or only none_of_these.",
      "criteria": {
        "password_stolen": "Someone else signed in with the account holder's current password, without resetting it",
        "email_taken_over": "Someone else used the email account on file, for example to open a password reset link or receive change notices",
        "phone_taken_over": "Someone else took over the phone number on file (SIM swap or port-out) or replaced it with their own number",
        "support_tricked": "Our support team changed a sign-in detail, contact detail or 2-step method for someone posing as the account holder",
        "code_handed_over": "The account holder was tricked into reading out a one-time code or approving a sign-in for someone else",
        "remote_access": "Someone operated the account holder's own device through a remote-access or screen-sharing tool",
        "none_of_these": "None of these: the account holder or their authorized users made every recent change themselves"
      }
    },
    "destination_owner": {
      "type": "choice",
      "instructions": "Who owns and controls the bank account or card the money movement under review would pay into?",
      "criteria": {
        "holder": "The account holder: the business itself or its owner, in an account they control",
        "known_party": "A person or business with a real, earlier relationship to the account holder, such as a family member, employee or regular supplier",
        "unrelated": "Someone with no evident relationship to the account holder, including an account opened in the holder's name by someone else",
        "cannot_tell": "The records can't establish it: ownership checks are missing or inconclusive and nothing else ties the account to anyone"
      }
    },
    "action": {
      "type": "choice",
      "instructions": "What should happen to the money movement under review?",
      "criteria": {
        "allow": "Release it as requested",
        "step_up": "Release it only after the account holder confirms it with a 2-step method that existed before the recent changes and that the session under review did not use",
        "hold_and_call": "Hold it and call the account holder at a phone number that was on file before the recent changes; release it only if they confirm",
        "block_and_lock": "Cancel it, lock the account, end all sessions, undo the recent changes and contact the account holder through details on file before the changes"
      }
    }
  }
}