{
  "model": "grayson-1",
  "state": {
    "case": {
      "case_id": "ATO-26-10-0402",
      "queue": "Payout review: account security",
      "opened": "2026-10-08T15:21:31Z",
      "records_as_of": "2026-10-08T16:05:00Z",
      "local_time": "Thursday 2026-10-08, 11:05 a.m. CDT in Madison, WI"
    },
    "platform_controls": "Sign-in is email and password. A device not trusted in the last 30 days must also pass 2-step verification: an SMS code to the phone on file, or an authenticator app if the user has added one. The mobile app then signs in with Face ID or a fingerprint. 'Forgot password' emails a reset link to the email on file, and 2-step verification is still required after a reset. Changing the email or phone on file, adding or removing a 2-step method, and adding a payout destination each need a fresh 2-step code; we email the previous address and text the phone on file after each change. Payout destinations are business or owner checking accounts, verified by signing in to the bank through our account-verification provider (which returns the holder name and the account's open date) or by micro-deposits, and debit cards for instant payouts, checked with the card network's account name inquiry. Standard payouts go by ACH on the schedule the business picks and arrive the next business day. Instant payouts send up to $25,000 a day in minutes, to a debit card or a bank account on the real-time payments network, for a 1.5% fee, and cannot be recalled. Any payout to a destination added in the last 7 days, and any instant payout over $5,000 within 24 hours of a sign-in, contact or 2-step change, waits in this review queue. Staff with the point-of-sale role take payments on the shop's devices with a PIN and cannot see payouts or change settings.",
    "business": {
      "merchant_id": "mer_08826",
      "legal_name": "Calder Street Cycles LLC",
      "doing_business_as": "Calder Street Cycles",
      "business_type": "Two-member LLC; bicycle sales and repair, MCC 5940 (bicycle shops)",
      "location": "Madison, WI; open Monday to Saturday, 10 a.m. to 7 p.m.",
      "on_platform_since": "2019-03-02",
      "owner": {
        "name": "Mateo Ferraro",
        "role": "Owner and only admin",
        "phone_on_file": "(608) 555-0127, since 2019-03-02",
        "email_on_file": "mateo@calderstreetcycles.example.com, since 2019-03-02",
        "two_step_methods": "SMS to (608) 555-0127 since 2019"
      },
      "products": "In-person card payments, online repair deposits, daily standard payouts",
      "monthly_card_volume_usd_last_12_months": "38,000 (January) to 112,000 (June)",
      "payout_schedule": "Daily standard payout each business day for the previous day's sales (Monday covers Saturday)",
      "disputes_12_months": 2,
      "account_status": "Active; no holds"
    },
    "users": {
      "columns": [
        "user",
        "role",
        "added",
        "sign_in"
      ],
      "rows": [
        [
          "Mateo Ferraro",
          "Owner (admin)",
          "2019-03-02",
          "email and password, 2-step"
        ],
        [
          "Jess Okonkwo-Hale",
          "Manager (no payouts or settings)",
          "2024-03-15",
          "email and password, 2-step"
        ],
        [
          "Liam Sorensen",
          "Point of sale",
          "2024-05-01",
          "PIN on the shop iPad only"
        ]
      ]
    },
    "devices": {
      "columns": [
        "device_id",
        "device",
        "user",
        "first_seen",
        "trusted",
        "last_seen"
      ],
      "rows": [
        [
          "dv_m2",
          "MacBook Pro, Chrome (macOS 15)",
          "Mateo Ferraro",
          "2023-06-19",
          "yes, renewed 2026-09-20",
          "2026-10-08T15:12:37Z"
        ],
        [
          "dv_m1",
          "Pixel 7, our app (Android 15)",
          "Mateo Ferraro",
          "2023-02-11",
          "removed by the owner 2026-10-03T17:46Z",
          "2026-10-03"
        ],
        [
          "dv_m4",
          "iPhone 16, our app (iOS 18)",
          "Mateo Ferraro",
          "2026-10-03T17:40:26Z",
          "yes (Face ID)",
          "2026-10-08T15:31:50Z"
        ],
        [
          "dv_m3",
          "iPad Air at the counter, point-of-sale app",
          "shop device (staff PINs)",
          "2022-04-02",
          "yes (shop device)",
          "2026-10-08T14:47:50Z"
        ],
        [
          "dv_j1",
          "iPhone 14, our app",
          "Jess Okonkwo-Hale",
          "2024-03-15",
          "yes (Face ID)",
          "2026-10-06"
        ]
      ]
    },
    "credential_and_contact_changes": {
      "columns": [
        "ts",
        "change",
        "device_id",
        "ip",
        "verification"
      ],
      "rows": [
        [
          "2019-03-02T16:40:11Z",
          "Account opened; owner Mateo Ferraro; email mateo@calderstreetcycles.example.com; phone (608) 555-0127",
          "",
          "",
          "identity check passed"
        ],
        [
          "2019-03-04T14:02:50Z",
          "Payout destination added: checking x5508",
          "",
          "",
          "micro-deposits; holder name not returned"
        ],
        [
          "2022-04-02T15:15:30Z",
          "Shop iPad dv_m3 set up for point of sale",
          "dv_m3",
          "198.51.100.120",
          "owner approval in app"
        ],
        [
          "2023-02-11T15:30:44Z",
          "App trusted on new phone dv_m1 (Pixel 7)",
          "dv_m1",
          "198.51.100.120",
          "SMS code"
        ],
        [
          "2023-06-19T02:12:09Z",
          "Computer trusted: dv_m2 (MacBook Pro)",
          "dv_m2",
          "203.0.113.19",
          "SMS code"
        ],
        [
          "2024-03-15T15:02:27Z",
          "User added: Jess Okonkwo-Hale, manager role (sales, refunds, items, reports; no payouts or settings)",
          "dv_m2",
          "198.51.100.120",
          "SMS code"
        ],
        [
          "2024-05-01T14:44:12Z",
          "User added: Liam Sorensen, point-of-sale role",
          "dv_m3",
          "198.51.100.120",
          "owner approval in app"
        ],
        [
          "2025-01-12T17:31:05Z",
          "Password changed",
          "dv_m2",
          "203.0.113.19",
          "current password"
        ],
        [
          "2026-10-03T17:40:26Z",
          "App trusted on new phone dv_m4 (iPhone 16)",
          "dv_m4",
          "198.51.100.120",
          "SMS code to (608) 555-0127 (number ported to a new carrier at 15:52Z the same day)"
        ],
        [
          "2026-10-03T17:46:02Z",
          "Old phone dv_m1 removed from trusted devices",
          "dv_m4",
          "198.51.100.120",
          "Face ID"
        ],
        [
          "2026-10-08T15:20:13Z",
          "Payout destination added: business checking x0931 at a credit union",
          "dv_m2",
          "203.0.113.140",
          "SMS code to (608) 555-0127, entered 15:19:58Z; bank login through verification provider"
        ],
        [
          "2026-10-08T15:21:30Z",
          "Default payout destination changed from x5508 to x0931",
          "dv_m2",
          "203.0.113.140",
          "SMS code"
        ]
      ]
    },
    "payout_destinations": [
      {
        "destination": "checking x5508",
        "added": "2019-03-04",
        "status": "was default until 2026-10-08T15:21:30Z",
        "ownership_check": "Micro-deposits in 2019 (no holder name returned); account name inquiry 2024-06: CALDER STREET CYCLES LLC",
        "account_opened": "unknown",
        "payouts_received": "About 1,500 payouts since 2019, none returned"
      },
      {
        "destination": "business checking x0931 at a credit union in Madison, WI",
        "added": "2026-10-08T15:20:13Z",
        "status": "default since 15:21:30Z",
        "ownership_check": "Bank login through verification provider, 2026-10-08T15:19:31Z: holder CALDER STREET CYCLES LLC (matches the legal name); authorized signer MATEO R FERRARO",
        "account_opened": "2026-09-24, per the verification provider",
        "payouts_received": "None yet",
        "seen_elsewhere_on_platform": "Not linked to any other business on our platform"
      }
    ],
    "sign_in_history": {
      "period": "2026-07-10 to 2026-10-08T16:05:00Z",
      "ip_addresses": {
        "198.51.100.120": "Business cable ISP, Madison WI (the shop's Wi-Fi)",
        "203.0.113.19": "Residential fiber ISP, Madison WI",
        "192.0.2.57": "Mobile carrier, Las Vegas NV",
        "203.0.113.140": "Hotel Wi-Fi, Las Vegas NV"
      },
      "staff_point_of_sale_sign_ins": "78 staff PIN sign-ins on dv_m3 from 198.51.100.120, one each open day between 9:30 and 9:55 a.m. local time, all successful (Jess Okonkwo-Hale 57, Liam Sorensen 21); last 2026-10-08T14:47:50Z",
      "columns": [
        "ts",
        "device_id",
        "ip",
        "method",
        "result",
        "activity"
      ],
      "rows": [
        [
          "2026-07-10T13:02:02Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "items and stock"
        ],
        [
          "2026-07-10T21:46:07Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "refund issued"
        ],
        [
          "2026-07-14T20:36:42Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "sales report"
        ],
        [
          "2026-07-15T02:28:08Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-07-15T13:53:13Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-07-19T16:16:00Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-07-20T01:39:29Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-07-20T13:51:06Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-22T13:23:07Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-24T01:43:44Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-07-24T20:46:15Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "refund issued"
        ],
        [
          "2026-07-25T03:21:02Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-07-26T17:57:54Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-07-27T02:03:47Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-07-28T13:37:16Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-07-28T20:15:11Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "refund issued"
        ],
        [
          "2026-07-30T01:18:03Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-08-01T02:40:52Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-01T13:58:30Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-02T15:03:01Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-08-04T20:48:27Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "refund issued"
        ],
        [
          "2026-08-05T01:47:00Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-05T14:24:14Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "items and stock"
        ],
        [
          "2026-08-06T01:20:42Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-08-08T02:01:41Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-08-09T15:22:01Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "weekly sales export"
        ],
        [
          "2026-08-10T01:13:48Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-08-11T21:08:25Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "items and stock"
        ],
        [
          "2026-08-14T21:52:45Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "items and stock"
        ],
        [
          "2026-08-15T01:29:17Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-08-16T16:21:36Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-08-17T13:11:52Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-08-18T13:59:50Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "items and stock"
        ],
        [
          "2026-08-18T21:28:26Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "sales report"
        ],
        [
          "2026-08-21T14:08:59Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-08-21T21:50:55Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "refund issued"
        ],
        [
          "2026-08-22T02:21:57Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-08-23T15:35:52Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "items and prices"
        ],
        [
          "2026-08-24T01:12:22Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-08-26T01:12:28Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-08-27T03:29:09Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-08-27T14:15:33Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-08-28T21:56:37Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "refund issued"
        ],
        [
          "2026-08-29T03:27:36Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-01T14:21:46Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "items and stock"
        ],
        [
          "2026-09-01T22:13:24Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "items and stock"
        ],
        [
          "2026-09-03T02:41:04Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-04T01:20:39Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-04T20:20:40Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "sales report"
        ],
        [
          "2026-09-07T13:55:06Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-08T01:19:12Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-10T13:21:00Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-09-11T13:44:22Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "items and stock"
        ],
        [
          "2026-09-13T16:17:21Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-15T01:03:56Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-09-15T20:43:08Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "refund issued"
        ],
        [
          "2026-09-16T03:13:45Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-18T01:31:50Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "deposits report"
        ],
        [
          "2026-09-18T20:43:07Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "sales report"
        ],
        [
          "2026-09-19T14:19:18Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-09-20T15:02:20Z",
          "dv_m2",
          "203.0.113.19",
          "password + SMS code (30-day trust renewed)",
          "success",
          "weekly sales export"
        ],
        [
          "2026-09-20T17:40:35Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-21T01:48:18Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-21T13:55:28Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "refund issued"
        ],
        [
          "2026-09-22T13:17:08Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "items and stock"
        ],
        [
          "2026-09-22T22:19:58Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "sales report"
        ],
        [
          "2026-09-23T01:59:53Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "payouts viewed"
        ],
        [
          "2026-09-26T02:20:36Z",
          "dv_m1",
          "203.0.113.19",
          "fingerprint (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-09-26T14:19:48Z",
          "dv_m1",
          "198.51.100.120",
          "fingerprint (app)",
          "success",
          "items and stock"
        ],
        [
          "2026-09-27T17:05:11Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "items and prices"
        ],
        [
          "2026-09-29T20:37:05Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "sales report"
        ],
        [
          "2026-10-02T22:17:09Z",
          "dv_j1",
          "198.51.100.120",
          "Face ID (app) (Jess Okonkwo-Hale)",
          "success",
          "items and stock"
        ],
        [
          "2026-10-03T17:40:26Z",
          "dv_m4",
          "198.51.100.120",
          "password + SMS code (new device)",
          "success",
          "app set up; Face ID turned on"
        ],
        [
          "2026-10-03T17:46:02Z",
          "dv_m4",
          "198.51.100.120",
          "Face ID (app)",
          "success",
          "removed old phone dv_m1 from trusted devices"
        ],
        [
          "2026-10-03T22:10:44Z",
          "dv_m4",
          "198.51.100.120",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-04T02:31:09Z",
          "dv_m4",
          "203.0.113.19",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-04T16:12:55Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "weekly sales export"
        ],
        [
          "2026-10-04T17:43:40Z",
          "dv_m2",
          "203.0.113.19",
          "password + trusted device",
          "success",
          "weekly sales export"
        ],
        [
          "2026-10-05T13:20:18Z",
          "dv_m4",
          "198.51.100.120",
          "Face ID (app)",
          "success",
          "items and stock"
        ],
        [
          "2026-10-06T01:55:40Z",
          "dv_m4",
          "203.0.113.19",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-06T23:48:31Z",
          "dv_m4",
          "192.0.2.57",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-07T03:58:12Z",
          "dv_m4",
          "203.0.113.140",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-07T04:06:47Z",
          "dv_m2",
          "203.0.113.140",
          "password + trusted device",
          "success",
          "payouts viewed"
        ],
        [
          "2026-10-07T21:15:20Z",
          "dv_m4",
          "192.0.2.57",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-08T04:22:03Z",
          "dv_m4",
          "203.0.113.140",
          "Face ID (app)",
          "success",
          "sales summary"
        ],
        [
          "2026-10-08T15:12:37Z",
          "dv_m2",
          "203.0.113.140",
          "password + trusted device",
          "success",
          "payout destinations; payout destination added"
        ],
        [
          "2026-10-08T15:31:50Z",
          "dv_m4",
          "203.0.113.140",
          "Face ID (app)",
          "success",
          "payouts viewed"
        ]
      ]
    },
    "device_intelligence": {
      "vendor": "Your device intelligence vendor, scored on every sign-in and sensitive change",
      "reason_code_meanings": {
        "NEW_DEVICE": "Device not seen on this account before",
        "NEW_LOCATION": "IP location not seen on this account in 90 days",
        "PROXY_RESIDENTIAL": "IP belongs to a residential proxy network",
        "VPN": "IP belongs to a commercial VPN service",
        "TZ_MISMATCH": "Device timezone doesn't fit the IP location",
        "FP_INCONSISTENT": "Browser fingerprint attributes contradict each other (anti-detect browser suspected)",
        "FRESH_PROFILE": "Browser has no stored cookies or history",
        "DIRECT_NAV": "Went straight to payout settings after sign-in",
        "RESET_THEN_CHANGE": "Password reset followed by contact or payout changes in the same session",
        "BEHAVIOR_MISMATCH": "Typing and pointer behavior differ from this user's profile",
        "SIM_RECENT": "SIM change or port on the phone on file in the last 7 days"
      },
      "recent_sessions": {
        "columns": [
          "ts",
          "device_id",
          "vendor_score",
          "reason_codes",
          "proxy_or_vpn",
          "remote_access_tool",
          "emulator_or_automation",
          "timezone_vs_ip",
          "behavior"
        ],
        "rows": [
          [
            "2026-10-03T17:40:26Z",
            "dv_m4",
            488,
            [
              "NEW_DEVICE",
              "SIM_RECENT"
            ],
            "no",
            "none",
            "no",
            "UTC-05:00, fits Madison WI",
            "no profile yet on this device; typing fluent, password typed"
          ],
          [
            "2026-10-04T16:12:55Z",
            "dv_m2",
            31,
            [],
            "no",
            "none",
            "no",
            "UTC-05:00, fits",
            "consistent with profile (0.93)"
          ],
          [
            "2026-10-06T23:48:31Z",
            "dv_m4",
            214,
            [
              "NEW_LOCATION"
            ],
            "no",
            "none",
            "no",
            "UTC-07:00, fits Las Vegas NV",
            "consistent with the 5 sessions on this device (0.88)"
          ],
          [
            "2026-10-07T04:06:47Z",
            "dv_m2",
            236,
            [
              "NEW_LOCATION"
            ],
            "no",
            "none",
            "no",
            "UTC-07:00, fits Las Vegas NV",
            "consistent with profile (0.90)"
          ],
          [
            "2026-10-08T15:12:37Z",
            "dv_m2",
            412,
            [
              "NEW_LOCATION",
              "SIM_RECENT"
            ],
            "no",
            "none",
            "no",
            "UTC-07:00, fits Las Vegas NV",
            "consistent with profile (0.91); browsed sales for 6 minutes before opening payout settings; typed the bank search"
          ]
        ]
      }
    },
    "phone_checks": [
      {
        "checked": "2026-10-08T15:19:44Z",
        "number": "(608) 555-0127 (on file since 2019-03-02)",
        "trigger": "2-step SMS for the payout destination",
        "line_type": "mobile, postpaid",
        "subscriber_name_match": "match (Ferraro)",
        "sim_change": "new SIM 2026-10-03T15:52Z with the port",
        "port_out": "ported to a new carrier 2026-10-03T15:52Z (first port since 2019)",
        "device_change": "new handset since 2026-10-03; same handset at every check since"
      },
      {
        "checked": "2026-10-03T17:40:12Z",
        "number": "(608) 555-0127",
        "trigger": "2-step SMS for the new phone",
        "line_type": "mobile, postpaid",
        "subscriber_name_match": "match (Ferraro)",
        "sim_change": "new SIM 2026-10-03T15:52Z",
        "port_out": "ported to a new carrier 2026-10-03T15:52Z",
        "device_change": "new handset"
      }
    ],
    "security_notices": {
      "columns": [
        "ts",
        "channel",
        "to",
        "message",
        "outcome"
      ],
      "rows": [
        [
          "2026-08-01T12:00:00Z",
          "email",
          "mateo@calderstreetcycles.example.com",
          "Your July statement is ready",
          "delivered"
        ],
        [
          "2026-09-01T12:00:00Z",
          "email",
          "mateo@calderstreetcycles.example.com",
          "Your August statement is ready",
          "delivered"
        ],
        [
          "2026-09-20T15:02:11Z",
          "SMS",
          "(608) 555-0127",
          "Your verification code (renew trust on this computer)",
          "entered"
        ],
        [
          "2026-10-01T12:00:00Z",
          "email",
          "mateo@calderstreetcycles.example.com",
          "Your September statement is ready",
          "delivered"
        ],
        [
          "2026-10-03T17:40:14Z",
          "SMS",
          "(608) 555-0127",
          "Your verification code. We'll never call to ask for it.",
          "entered 17:40:24Z on dv_m4"
        ],
        [
          "2026-10-03T17:40:27Z",
          "email",
          "mateo@calderstreetcycles.example.com",
          "New phone signed in to your account",
          "delivered; opened 17:41Z"
        ],
        [
          "2026-10-03T17:46:03Z",
          "email",
          "mateo@calderstreetcycles.example.com",
          "A device was removed from your account",
          "delivered"
        ],
        [
          "2026-10-08T15:19:45Z",
          "SMS",
          "(608) 555-0127",
          "Your verification code to add a payout account. We'll never call to ask for it.",
          "entered 15:19:58Z on dv_m2"
        ],
        [
          "2026-10-08T15:20:14Z",
          "email",
          "mateo@calderstreetcycles.example.com",
          "A payout account ending 0931 was added",
          "delivered; opened 15:31Z"
        ],
        [
          "2026-10-08T15:20:14Z",
          "SMS",
          "(608) 555-0127",
          "A payout account ending 0931 was added. Not you? Call us.",
          "delivered"
        ]
      ]
    },
    "daily_sales": {
      "period": "2026-07-10 to 2026-10-07",
      "note": "Card payments by business day, local time",
      "columns": [
        "date",
        "payments",
        "gross_usd",
        "refunds_usd",
        "fees_usd",
        "net_usd",
        "disputes"
      ],
      "rows": [
        [
          "2026-07-10",
          48,
          4453.16,
          0,
          121.47,
          4331.69,
          0
        ],
        [
          "2026-07-11",
          53,
          4630.26,
          0,
          126.61,
          4503.65,
          0
        ],
        [
          "2026-07-13",
          36,
          3496.24,
          38.68,
          95.2,
          3362.36,
          0
        ],
        [
          "2026-07-14",
          46,
          4027.92,
          92.93,
          110.13,
          3824.86,
          0
        ],
        [
          "2026-07-15",
          44,
          4383.71,
          0,
          119.25,
          4264.46,
          0
        ],
        [
          "2026-07-16",
          31,
          2977.76,
          0,
          81.12,
          2896.64,
          0
        ],
        [
          "2026-07-17",
          49,
          5139.31,
          0,
          139.55,
          4999.76,
          0
        ],
        [
          "2026-07-18",
          59,
          5382.41,
          111.67,
          146.92,
          5123.82,
          0
        ],
        [
          "2026-07-20",
          32,
          3134.62,
          0,
          85.33,
          3049.29,
          0
        ],
        [
          "2026-07-21",
          33,
          3087.03,
          54.2,
          84.18,
          2948.65,
          0
        ],
        [
          "2026-07-22",
          44,
          4012.71,
          0,
          109.53,
          3903.18,
          0
        ],
        [
          "2026-07-23",
          34,
          3428.58,
          0,
          93.23,
          3335.35,
          0
        ],
        [
          "2026-07-24",
          55,
          5374.63,
          0,
          146.32,
          5228.31,
          0
        ],
        [
          "2026-07-25",
          61,
          6285,
          0,
          170.77,
          6114.23,
          0
        ],
        [
          "2026-07-27",
          38,
          3841.75,
          93.3,
          104.45,
          3644,
          0
        ],
        [
          "2026-07-28",
          43,
          4190.39,
          0,
          114.09,
          4076.3,
          0
        ],
        [
          "2026-07-29",
          33,
          3534.82,
          0,
          95.91,
          3438.91,
          0
        ],
        [
          "2026-07-30",
          45,
          4518.37,
          13.56,
          122.88,
          4381.93,
          0
        ],
        [
          "2026-07-31",
          38,
          3912.29,
          0,
          106.3,
          3805.99,
          0
        ],
        [
          "2026-08-01",
          49,
          5045.68,
          0,
          137.1,
          4908.58,
          0
        ],
        [
          "2026-08-03",
          35,
          3479.83,
          0,
          94.67,
          3385.16,
          0
        ],
        [
          "2026-08-04",
          35,
          3283.9,
          0,
          89.54,
          3194.36,
          0
        ],
        [
          "2026-08-05",
          25,
          2642.19,
          51.5,
          71.73,
          2518.96,
          0
        ],
        [
          "2026-08-06",
          39,
          3772.97,
          38.9,
          102.75,
          3631.32,
          0
        ],
        [
          "2026-08-07",
          34,
          3182.03,
          0,
          86.77,
          3095.26,
          0
        ],
        [
          "2026-08-08",
          71,
          6684.16,
          0,
          182.22,
          6501.94,
          0
        ],
        [
          "2026-08-10",
          27,
          2519.5,
          0,
          68.71,
          2450.79,
          0
        ],
        [
          "2026-08-11",
          29,
          2955.38,
          13.26,
          80.33,
          2861.79,
          0
        ],
        [
          "2026-08-12",
          25,
          2731.35,
          0,
          74.06,
          2657.29,
          0
        ],
        [
          "2026-08-13",
          45,
          4278.96,
          0,
          116.61,
          4162.35,
          0
        ],
        [
          "2026-08-14",
          48,
          4930.49,
          0,
          133.98,
          4796.51,
          0
        ],
        [
          "2026-08-15",
          67,
          6608.56,
          0,
          179.84,
          6428.72,
          0
        ],
        [
          "2026-08-17",
          21,
          2123.8,
          0,
          57.74,
          2066.06,
          0
        ],
        [
          "2026-08-18",
          25,
          2384.64,
          42.82,
          64.98,
          2276.84,
          0
        ],
        [
          "2026-08-19",
          41,
          3681.62,
          0,
          100.56,
          3581.06,
          0
        ],
        [
          "2026-08-20",
          31,
          2843.07,
          0,
          77.59,
          2765.48,
          0
        ],
        [
          "2026-08-21",
          35,
          3364.15,
          0,
          91.64,
          3272.51,
          0
        ],
        [
          "2026-08-22",
          47,
          8845.02,
          0,
          236.44,
          8608.58,
          0
        ],
        [
          "2026-08-24",
          23,
          2370.81,
          10.62,
          64.42,
          2295.77,
          0
        ],
        [
          "2026-08-25",
          36,
          3817.37,
          41.28,
          103.62,
          3672.47,
          0
        ],
        [
          "2026-08-26",
          41,
          3699.66,
          0,
          101.03,
          3598.63,
          0
        ],
        [
          "2026-08-27",
          32,
          3114.08,
          0,
          84.79,
          3029.29,
          0
        ],
        [
          "2026-08-28",
          33,
          3090.08,
          0,
          84.26,
          3005.82,
          0
        ],
        [
          "2026-08-29",
          63,
          5712.76,
          0,
          155.97,
          5556.79,
          0
        ],
        [
          "2026-08-31",
          21,
          2114.53,
          0,
          57.5,
          2057.03,
          0
        ],
        [
          "2026-09-01",
          26,
          2704.18,
          0,
          73.45,
          2630.73,
          0
        ],
        [
          "2026-09-02",
          22,
          2215.69,
          0,
          60.25,
          2155.44,
          0
        ],
        [
          "2026-09-03",
          23,
          2286.75,
          0,
          62.21,
          2224.54,
          0
        ],
        [
          "2026-09-04",
          39,
          3891.03,
          0,
          105.84,
          3785.19,
          0
        ],
        [
          "2026-09-05",
          36,
          3453.88,
          0,
          94.09,
          3359.79,
          0
        ],
        [
          "2026-09-07",
          22,
          2336.33,
          0,
          63.41,
          2272.92,
          0
        ],
        [
          "2026-09-08",
          19,
          1935.36,
          0,
          52.61,
          1882.75,
          0
        ],
        [
          "2026-09-09",
          24,
          2321.71,
          0,
          63.23,
          2258.48,
          0
        ],
        [
          "2026-09-10",
          25,
          2277.13,
          0,
          62.16,
          2214.97,
          0
        ],
        [
          "2026-09-11",
          42,
          3822.56,
          0,
          104.35,
          3718.21,
          0
        ],
        [
          "2026-09-12",
          46,
          4661.33,
          44.56,
          126.73,
          4490.04,
          0
        ],
        [
          "2026-09-14",
          19,
          1686.77,
          112.25,
          46.09,
          1528.43,
          0
        ],
        [
          "2026-09-15",
          22,
          2297.02,
          0,
          62.38,
          2234.64,
          0
        ],
        [
          "2026-09-16",
          30,
          2829.7,
          0,
          77.14,
          2752.56,
          0
        ],
        [
          "2026-09-17",
          28,
          2961.29,
          35.52,
          80.39,
          2845.38,
          0
        ],
        [
          "2026-09-18",
          26,
          2382.83,
          0,
          65.03,
          2317.8,
          0
        ],
        [
          "2026-09-19",
          39,
          3815.54,
          0,
          103.87,
          3711.67,
          0
        ],
        [
          "2026-09-21",
          24,
          2593.57,
          0,
          70.35,
          2523.22,
          0
        ],
        [
          "2026-09-22",
          18,
          1886.65,
          0,
          51.23,
          1835.42,
          0
        ],
        [
          "2026-09-23",
          33,
          3310.69,
          102.81,
          90.04,
          3117.84,
          0
        ],
        [
          "2026-09-24",
          33,
          2991.21,
          95.71,
          81.67,
          2813.83,
          0
        ],
        [
          "2026-09-25",
          36,
          3515.78,
          0,
          95.71,
          3420.07,
          0
        ],
        [
          "2026-09-26",
          51,
          4772.43,
          39.77,
          130.14,
          4602.52,
          0
        ],
        [
          "2026-09-28",
          20,
          2076.68,
          0,
          56.41,
          2020.27,
          0
        ],
        [
          "2026-09-29",
          33,
          2974.74,
          125.56,
          81.24,
          2767.94,
          0
        ],
        [
          "2026-09-30",
          24,
          2259.27,
          0,
          61.59,
          2197.68,
          0
        ],
        [
          "2026-10-01",
          30,
          2945.29,
          0,
          80.17,
          2865.12,
          0
        ],
        [
          "2026-10-02",
          24,
          2247.1,
          127.38,
          61.27,
          2058.45,
          0
        ],
        [
          "2026-10-03",
          42,
          3760.51,
          42.24,
          102.73,
          3615.54,
          0
        ],
        [
          "2026-10-05",
          17,
          1820.23,
          148.18,
          49.39,
          1622.66,
          0
        ],
        [
          "2026-10-06",
          26,
          2550.6,
          31.12,
          69.43,
          2450.05,
          0
        ],
        [
          "2026-10-07",
          25,
          2312.3,
          126.19,
          63.08,
          2123.03,
          0
        ]
      ]
    },
    "payout_history": {
      "columns": [
        "initiated",
        "type",
        "destination",
        "amount_usd",
        "covers",
        "status",
        "arrived"
      ],
      "rows": [
        [
          "2026-07-10T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          4163.43,
          "2026-07-09",
          "paid",
          "2026-07-13"
        ],
        [
          "2026-07-13T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          8835.34,
          "2026-07-10 to 2026-07-11",
          "paid",
          "2026-07-14"
        ],
        [
          "2026-07-14T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3362.36,
          "2026-07-13",
          "paid",
          "2026-07-15"
        ],
        [
          "2026-07-15T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3824.86,
          "2026-07-14",
          "paid",
          "2026-07-16"
        ],
        [
          "2026-07-16T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          4264.46,
          "2026-07-15",
          "paid",
          "2026-07-17"
        ],
        [
          "2026-07-17T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2896.64,
          "2026-07-16",
          "paid",
          "2026-07-20"
        ],
        [
          "2026-07-20T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          10123.58,
          "2026-07-17 to 2026-07-18",
          "paid",
          "2026-07-21"
        ],
        [
          "2026-07-21T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3049.29,
          "2026-07-20",
          "paid",
          "2026-07-22"
        ],
        [
          "2026-07-22T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2948.65,
          "2026-07-21",
          "paid",
          "2026-07-23"
        ],
        [
          "2026-07-23T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3903.18,
          "2026-07-22",
          "paid",
          "2026-07-24"
        ],
        [
          "2026-07-24T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3335.35,
          "2026-07-23",
          "paid",
          "2026-07-27"
        ],
        [
          "2026-07-27T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          11342.54,
          "2026-07-24 to 2026-07-25",
          "paid",
          "2026-07-28"
        ],
        [
          "2026-07-28T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3644,
          "2026-07-27",
          "paid",
          "2026-07-29"
        ],
        [
          "2026-07-29T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          4076.3,
          "2026-07-28",
          "paid",
          "2026-07-30"
        ],
        [
          "2026-07-30T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3438.91,
          "2026-07-29",
          "paid",
          "2026-07-31"
        ],
        [
          "2026-07-31T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          4381.93,
          "2026-07-30",
          "paid",
          "2026-08-03"
        ],
        [
          "2026-08-03T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          8714.57,
          "2026-07-31 to 2026-08-01",
          "paid",
          "2026-08-04"
        ],
        [
          "2026-08-04T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3385.16,
          "2026-08-03",
          "paid",
          "2026-08-05"
        ],
        [
          "2026-08-05T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3194.36,
          "2026-08-04",
          "paid",
          "2026-08-06"
        ],
        [
          "2026-08-06T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2518.96,
          "2026-08-05",
          "paid",
          "2026-08-07"
        ],
        [
          "2026-08-07T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3631.32,
          "2026-08-06",
          "paid",
          "2026-08-10"
        ],
        [
          "2026-08-10T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          9597.2,
          "2026-08-07 to 2026-08-08",
          "paid",
          "2026-08-11"
        ],
        [
          "2026-08-11T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2450.79,
          "2026-08-10",
          "paid",
          "2026-08-12"
        ],
        [
          "2026-08-12T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2861.79,
          "2026-08-11",
          "paid",
          "2026-08-13"
        ],
        [
          "2026-08-13T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2657.29,
          "2026-08-12",
          "paid",
          "2026-08-14"
        ],
        [
          "2026-08-14T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          4162.35,
          "2026-08-13",
          "paid",
          "2026-08-17"
        ],
        [
          "2026-08-17T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          11225.23,
          "2026-08-14 to 2026-08-15",
          "paid",
          "2026-08-18"
        ],
        [
          "2026-08-18T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2066.06,
          "2026-08-17",
          "paid",
          "2026-08-19"
        ],
        [
          "2026-08-19T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2276.84,
          "2026-08-18",
          "paid",
          "2026-08-20"
        ],
        [
          "2026-08-20T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3581.06,
          "2026-08-19",
          "paid",
          "2026-08-21"
        ],
        [
          "2026-08-21T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2765.48,
          "2026-08-20",
          "paid",
          "2026-08-24"
        ],
        [
          "2026-08-24T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          11881.09,
          "2026-08-21 to 2026-08-22",
          "paid",
          "2026-08-25"
        ],
        [
          "2026-08-25T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2295.77,
          "2026-08-24",
          "paid",
          "2026-08-26"
        ],
        [
          "2026-08-26T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3672.47,
          "2026-08-25",
          "paid",
          "2026-08-27"
        ],
        [
          "2026-08-27T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3598.63,
          "2026-08-26",
          "paid",
          "2026-08-28"
        ],
        [
          "2026-08-28T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3029.29,
          "2026-08-27",
          "paid",
          "2026-08-31"
        ],
        [
          "2026-08-31T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          8562.61,
          "2026-08-28 to 2026-08-29",
          "paid",
          "2026-09-01"
        ],
        [
          "2026-09-01T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2057.03,
          "2026-08-31",
          "paid",
          "2026-09-02"
        ],
        [
          "2026-09-02T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2630.73,
          "2026-09-01",
          "paid",
          "2026-09-03"
        ],
        [
          "2026-09-03T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2155.44,
          "2026-09-02",
          "paid",
          "2026-09-04"
        ],
        [
          "2026-09-04T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2224.54,
          "2026-09-03",
          "paid",
          "2026-09-08"
        ],
        [
          "2026-09-08T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          9417.9,
          "2026-09-04 to 2026-09-07",
          "paid",
          "2026-09-09"
        ],
        [
          "2026-09-09T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          1882.75,
          "2026-09-08",
          "paid",
          "2026-09-10"
        ],
        [
          "2026-09-10T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2258.48,
          "2026-09-09",
          "paid",
          "2026-09-11"
        ],
        [
          "2026-09-11T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2214.97,
          "2026-09-10",
          "paid",
          "2026-09-14"
        ],
        [
          "2026-09-14T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          8208.25,
          "2026-09-11 to 2026-09-12",
          "paid",
          "2026-09-15"
        ],
        [
          "2026-09-15T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          1528.43,
          "2026-09-14",
          "paid",
          "2026-09-16"
        ],
        [
          "2026-09-16T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2234.64,
          "2026-09-15",
          "paid",
          "2026-09-17"
        ],
        [
          "2026-09-17T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2752.56,
          "2026-09-16",
          "paid",
          "2026-09-18"
        ],
        [
          "2026-09-18T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2845.38,
          "2026-09-17",
          "paid",
          "2026-09-21"
        ],
        [
          "2026-09-21T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          6029.47,
          "2026-09-18 to 2026-09-19",
          "paid",
          "2026-09-22"
        ],
        [
          "2026-09-22T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2523.22,
          "2026-09-21",
          "paid",
          "2026-09-23"
        ],
        [
          "2026-09-23T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          1835.42,
          "2026-09-22",
          "paid",
          "2026-09-24"
        ],
        [
          "2026-09-24T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          3117.84,
          "2026-09-23",
          "paid",
          "2026-09-25"
        ],
        [
          "2026-09-25T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2813.83,
          "2026-09-24",
          "paid",
          "2026-09-28"
        ],
        [
          "2026-09-28T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          8022.59,
          "2026-09-25 to 2026-09-26",
          "paid",
          "2026-09-29"
        ],
        [
          "2026-09-29T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2020.27,
          "2026-09-28",
          "paid",
          "2026-09-30"
        ],
        [
          "2026-09-30T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2767.94,
          "2026-09-29",
          "paid",
          "2026-10-01"
        ],
        [
          "2026-10-01T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2197.68,
          "2026-09-30",
          "paid",
          "2026-10-02"
        ],
        [
          "2026-10-02T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2865.12,
          "2026-10-01",
          "paid",
          "2026-10-05"
        ],
        [
          "2026-10-05T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          5673.99,
          "2026-10-02 to 2026-10-03",
          "paid",
          "2026-10-06"
        ],
        [
          "2026-10-06T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          1622.66,
          "2026-10-05",
          "paid",
          "2026-10-07"
        ],
        [
          "2026-10-07T21:00:00Z",
          "standard (ACH)",
          "checking x5508",
          2450.05,
          "2026-10-06",
          "paid",
          "2026-10-08"
        ]
      ]
    },
    "support_history": {
      "columns": [
        "ts",
        "channel",
        "contact",
        "verification",
        "summary"
      ],
      "rows": [
        [
          "2025-10-08T18:20:00Z",
          "chat (app)",
          "dv_m1, from Las Vegas NV",
          "signed-in app",
          "Owner at a bicycle industry trade show in Las Vegas asked how to see the shop's sales live on his phone; showed him the live sales view"
        ],
        [
          "2026-02-14T16:05:00Z",
          "phone",
          "(608) 555-0127 (on file)",
          "SMS code",
          "Owner asked about a chargeback on a repair; helped him submit receipts (won)"
        ],
        [
          "2026-10-02T19:12:00Z",
          "chat (web)",
          "dv_m2 at 198.51.100.120",
          "signed-in web",
          "Owner: 'We're moving our business checking to the credit union, account opens next week. How do I switch payouts so nothing gets lost? I'll be at the show in Vegas next week.' Agent explained adding a destination by bank login and that the first payout to it goes through review"
        ]
      ]
    },
    "rules_and_scores": {
      "rules_fired": [
        "PAY-01 Payout to a destination added today",
        "ATO-09 Payout destination added within 7 days of a port or SIM change on the phone on file",
        "ATO-12 Sensitive change from an IP location not seen in 90 days"
      ],
      "platform_risk_model": "0.31 (0 to 1; our queue prioritizes above 0.80)",
      "device_intelligence_vendor_score": "412 (0 to 1,000, higher is riskier)"
    },
    "payout_under_review": {
      "scheduled": "2026-10-08T21:00:00Z",
      "session": "Scheduled daily payout; destination set from dv_m2 at 203.0.113.140 at 15:21:30Z",
      "type": "Standard payout (ACH), arrives next business day",
      "amount_usd": 2123.03,
      "available_balance_usd": 2123.03,
      "covers": "card sales on 2026-10-07",
      "destination": "business checking x0931 at a credit union (added 2026-10-08T15:20:13Z)",
      "owner_usual": "Daily standard payouts to x5508; no instant payouts",
      "status": "Waiting in review since 15:21:31Z"
    }
  },
  "questions": {
    "takeover_likelihood": {
      "type": "score",
      "instructions": "How likely is it that someone other than the account holder or a user they authorized controls the session that requested the money movement under review, or the session that made the recent sign-in, contact, 2-step or payout change before it?",
      "criteria": [
        "Very unlikely (under 10%)",
        "Unlikely (10-40%)",
        "Uncertain (40-60%)",
        "Likely (60-90%)",
        "Very likely (over 90%)"
      ]
    },
    "access_route": {
      "type": "multi_choice",
      "instructions": "Which of these does the record show happened on this account in the last 30 days? Choose every one that applies, or only none_of_these.",
      "criteria": {
        "password_stolen": "Someone else signed in with the account holder's current password, without resetting it",
        "email_taken_over": "Someone else used the email account on file, for example to open a password reset link or receive change notices",
        "phone_taken_over": "Someone else took over the phone number on file (SIM swap or port-out) or replaced it with their own number",
        "support_tricked": "Our support team changed a sign-in detail, contact detail or 2-step method for someone posing as the account holder",
        "code_handed_over": "The account holder was tricked into reading out a one-time code or approving a sign-in for someone else",
        "remote_access": "Someone operated the account holder's own device through a remote-access or screen-sharing tool",
        "none_of_these": "None of these: the account holder or their authorized users made every recent change themselves"
      }
    },
    "destination_owner": {
      "type": "choice",
      "instructions": "Who owns and controls the bank account or card the money movement under review would pay into?",
      "criteria": {
        "holder": "The account holder: the business itself or its owner, in an account they control",
        "known_party": "A person or business with a real, earlier relationship to the account holder, such as a family member, employee or regular supplier",
        "unrelated": "Someone with no evident relationship to the account holder, including an account opened in the holder's name by someone else",
        "cannot_tell": "The records can't establish it: ownership checks are missing or inconclusive and nothing else ties the account to anyone"
      }
    },
    "action": {
      "type": "choice",
      "instructions": "What should happen to the money movement under review?",
      "criteria": {
        "allow": "Release it as requested",
        "step_up": "Release it only after the account holder confirms it with a 2-step method that existed before the recent changes and that the session under review did not use",
        "hold_and_call": "Hold it and call the account holder at a phone number that was on file before the recent changes; release it only if they confirm",
        "block_and_lock": "Cancel it, lock the account, end all sessions, undo the recent changes and contact the account holder through details on file before the changes"
      }
    }
  }
}