{ "model": "grayson-1", "state": { "review": { "as_of": "2026-10-07T01:13:00Z", "queue": "Treasury payments fraud review", "trigger": "Payment approved to vendor bank details changed in the last 30 days", "rules_fired": [ { "rule": "PAY-BC30", "description": "Payment to vendor bank details changed in the last 30 days" }, { "rule": "VND-NAME", "description": "Owner name check on the new account was not a full match" }, { "rule": "VND-ATT", "description": "Change attested as confirmed by phone, but the call log records voicemail" } ], "payment_status": "Held for review; standard ACH file for 2026-10-07 settlement closes 2026-10-07T14:00:00Z" }, "customer": { "name": "Redfern Hospitality Group, LLC", "business": "Four full-service restaurants in Nashville, TN; about 140 employees", "customer_since": "2021-05-03", "payables_module_since": "2021-05-10", "accounts": [ { "account": "Operating checking x7714", "avg_ledger_balance_90d_usd": 236905.12 }, { "account": "Payroll checking x7722", "funding": "Transfer from x7714 every other Wednesday" } ], "payment_controls": { "approval_at_or_over_usd": 5000, "approver": "Owen Fairchild (single approver)", "vendor_bank_change": "The user making the change ticks an attestation that they called the vendor, and records the number called, the outcome and a note", "daily_ach_limit_usd": 80000 }, "users": [ { "name": "Alicia Moreno", "role": "Bookkeeper", "entitlements": "Enter bills, edit vendors, create payments", "user_since": "2021-05-03", "devices": [ { "id": "d-2e19", "type": "Windows 11 laptop, Chrome", "first_seen": "2024-08-26" } ], "usual_access": "d-2e19; Redfern office Tuesday to Thursday, home (East Nashville) Monday and Friday", "mfa": "Authenticator push" }, { "name": "Owen Fairchild", "role": "Owner and managing member", "entitlements": "Approve payments, edit vendors, administer users", "user_since": "2021-05-03", "devices": [ { "id": "d-6c40", "type": "MacBook, Safari", "first_seen": "2022-02-11" }, { "id": "d-a913", "type": "iPhone, mobile app", "first_seen": "2024-11-30" } ], "usual_access": "Mobile app from home (Brentwood, TN) in the evening; office occasionally", "mfa": "Authenticator push; Face ID in the mobile app" }, { "name": "Tasha Greene", "role": "Director of operations", "entitlements": "View bills", "user_since": "2025-06-02", "devices": [ { "id": "d-3b88", "type": "iPad, mobile app", "first_seen": "2025-06-02" } ], "usual_access": "Redfern office", "mfa": "Authenticator push" } ], "known_networks": [ { "label": "Redfern office", "ip": "198.51.100.88", "type": "Business cable, Nashville, TN", "first_seen": "2021-05-03" }, { "label": "home, East Nashville", "ip": "203.0.113.164", "type": "Residential fiber (Alicia Moreno)", "first_seen": "2022-09-12" }, { "label": "home, Brentwood TN", "ip": "203.0.113.31", "type": "Residential cable (Owen Fairchild)", "first_seen": "2021-05-03" }, { "label": "hotel Wi-Fi, Chattanooga TN", "ip": "192.0.2.140", "type": "Hotel network, Chattanooga, TN", "first_seen": "2026-09-19" } ] }, "vendor": { "vendor_id": "V-0007", "legal_name": "Calloway Fresh Provisions, Inc.", "tax_id": "xx-xxx2659", "category": "Produce, dairy and protein distributor", "address": "415 Waldron Industrial Dr, La Vergne, TN 37086", "vendor_since": "2021-06-14", "payment_terms": "Weekly statement (week ends Saturday), due in 7 days", "usual_rail": "Standard ACH (CCD+), created every Tuesday for Wednesday settlement", "domain_on_file": "callowayfresh.example.com", "contacts": [ { "name": "Teresa Okafor", "role": "Accounts receivable", "email": "ar@callowayfresh.example.com", "phone": "+1-615-555-0131 (main line)", "on_file_since": "2022-01-10 (main line since 2021-06-14)" }, { "name": "Marcus Calloway", "role": "President", "email": "marcus@callowayfresh.example.com", "phone": "+1-615-555-0138 (mobile)", "on_file_since": "2021-06-14" }, { "name": "Derek Simms", "role": "Route sales", "email": "derek.simms@callowayfresh.example.com", "phone": "+1-615-555-0144", "on_file_since": "2023-08-01" } ], "bank_accounts": [ { "bank": "Larchfield National Bank, Nashville, TN", "routing": "xxxxx0381", "account": "Business checking x1184", "added": "2021-06-14", "status": "Replaced 2023-03-21", "verification": "Call-back to the main line 2021-06-15" }, { "bank": "Larchfield National Bank, Nashville, TN", "routing": "xxxxx0381", "account": "Business checking x6627", "added": "2023-03-21", "status": "Replaced 2026-10-02", "verification": "Requested by a signed letter after check fraud on the vendor's old account; call-back to +1-615-555-0138 (Marcus Calloway) on 2023-03-21 by Alicia Moreno; owner name check: match", "payments_received": 184 }, { "bank": "Pellmont Bank & Trust, Murfreesboro, TN", "routing": "xxxxx0662", "account": "Business checking x3390", "added": "2026-10-02", "status": "Active", "payments_received": 0 } ], "master_change_log": [ { "ts": "2021-06-14T15:20:41Z", "by": "Alicia Moreno", "change": "Vendor created; bank Larchfield x1184; contacts Lynn Baird (AR) and Marcus Calloway" }, { "ts": "2022-01-10T16:02:18Z", "by": "Alicia Moreno", "change": "AR contact Lynn Baird replaced by Teresa Okafor (same ar@ mailbox)" }, { "ts": "2023-03-21T19:44:05Z", "by": "Alicia Moreno", "change": "Bank Larchfield x1184 to Larchfield x6627", "verification": "Call-back to Marcus Calloway at +1-615-555-0138" }, { "ts": "2023-08-01T14:11:56Z", "by": "Alicia Moreno", "change": "Added contact Derek Simms" }, { "ts": "2026-10-02T16:30:19Z", "by": "Alicia Moreno", "change": "Bank Larchfield x6627 to Pellmont x3390", "attestation": "Called the vendor to confirm", "call_record": "+1-615-555-0131, voicemail; note: Left VM, Teresa confirmed by email", "source_document": "Email of 2026-10-02 04:41 UTC (.eml uploaded)" } ] }, "vendor_payment_history": { "before_period": "2021-06 to 2025-09: 223 weekly payments totaling $2,046,118.74, all by standard ACH (to Larchfield x1184 until 2023-03-14, then x6627), none returned", "columns": [ "statement", "amount_usd", "due", "paid", "rail", "to_account", "created_by", "approved_by", "note" ], "rows": [ [ "Week ending 2025-10-04", 9161.45, "2025-10-11", "2025-10-08", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-10-11", 8635.48, "2025-10-18", "2025-10-15", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-10-18", 8166.02, "2025-10-25", "2025-10-22", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-10-25", 11161.98, "2025-11-01", "2025-10-29", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-11-01", 8906.03, "2025-11-08", "2025-11-05", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-11-08", 10812.77, "2025-11-15", "2025-11-13", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-11-15", 11292.65, "2025-11-22", "2025-11-19", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-11-22", 11664.5, "2025-11-29", "2025-11-26", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-11-29", 12674.5, "2025-12-06", "2025-12-03", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-12-06", 12661.24, "2025-12-13", "2025-12-10", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-12-13", 11022.98, "2025-12-20", "2025-12-17", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-12-20", 11692.68, "2025-12-27", "2025-12-24", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2025-12-27", 13174.7, "2026-01-03", "2025-12-31", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-01-03", 8800.69, "2026-01-10", "2026-01-07", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-01-10", 6980.04, "2026-01-17", "2026-01-14", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-01-17", 6614.31, "2026-01-24", "2026-01-21", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-01-24", 7386.12, "2026-01-31", "2026-01-28", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-01-31", 8660.64, "2026-02-07", "2026-02-04", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-02-07", 9162.37, "2026-02-14", "2026-02-11", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-02-14", 8538.27, "2026-02-21", "paid with next week", "", "", "", "", "" ], [ "Week ending 2026-02-21", 17033.98, "2026-02-28", "2026-02-25", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "with week ending 2026-02-14" ], [ "Week ending 2026-02-28", 10506.51, "2026-03-07", "2026-03-04", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-03-07", 9980.16, "2026-03-14", "2026-03-11", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-03-14", 10316.87, "2026-03-21", "2026-03-18", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "less credit memo CM-1147 ($567.52, short or damaged delivery)" ], [ "Week ending 2026-03-21", 7685.4, "2026-03-28", "2026-03-25", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-03-28", 8332.55, "2026-04-04", "2026-04-01", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-04-04", 11112.38, "2026-04-11", "2026-04-08", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-04-11", 10151.31, "2026-04-18", "2026-04-15", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-04-18", 9088.17, "2026-04-25", "2026-04-22", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-04-25", 8126.35, "2026-05-02", "2026-04-29", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-05-02", 12231.33, "2026-05-09", "2026-05-06", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-05-09", 10886.92, "2026-05-16", "2026-05-13", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "less credit memo CM-1152 ($129.80, short or damaged delivery)" ], [ "Week ending 2026-05-16", 11449.38, "2026-05-23", "2026-05-20", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-05-23", 11391.45, "2026-05-30", "2026-05-27", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-05-30", 11327.88, "2026-06-06", "2026-06-03", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-06-06", 12211.09, "2026-06-13", "2026-06-10", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "less credit memo CM-1159 ($246.92, short or damaged delivery)" ], [ "Week ending 2026-06-13", 12027.08, "2026-06-20", "2026-06-17", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-06-20", 10137.55, "2026-06-27", "2026-06-24", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-06-27", 9709.36, "2026-07-04", "2026-07-01", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-07-04", 11039.41, "2026-07-11", "2026-07-08", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "less credit memo CM-1165 ($271.66, short or damaged delivery)" ], [ "Week ending 2026-07-11", 9869.49, "2026-07-18", "2026-07-15", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-07-18", 10365.92, "2026-07-25", "2026-07-22", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-07-25", 10354.97, "2026-08-01", "2026-07-29", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-08-01", 10545.76, "2026-08-08", "2026-08-05", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-08-08", 12679.61, "2026-08-15", "2026-08-12", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-08-15", 8965.71, "2026-08-22", "2026-08-19", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-08-22", 8676.84, "2026-08-29", "2026-08-26", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-08-29", 9447.54, "2026-09-05", "2026-09-02", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-09-05", 11115.79, "2026-09-12", "2026-09-09", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-09-12", 11211.29, "2026-09-19", "2026-09-16", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-09-19", 10197.7, "2026-09-26", "2026-09-23", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ], [ "Week ending 2026-09-26", 11702.55, "2026-10-03", "2026-09-30", "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild", "" ] ] }, "vendor_email_history": { "mailbox": "ap@redfernhospitality.example.com, connected to our payables module since 2021-05-10 (inbound mail from the vendor's domain)", "before_period": "2021-06 to 2026-03: 268 messages from callowayfresh.example.com (ar@, marcus@, derek.simms@), all SPF, DKIM and DMARC pass, all sent through the vendor's Microsoft 365 tenant, all between 06:52 and 18:40 Central time", "columns": [ "received", "from", "subject", "auth_spf_dkim_dmarc", "sent_via", "attachments" ], "rows": [ [ "2026-04-04T13:19:27Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 04/04", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-04-11T13:55:23Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 04/11", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-04-14T12:52:58Z", "derek.simms@callowayfresh.example.com", "Protein pricing for next week", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Market_Update.pdf" ], [ "2026-04-18T14:03:09Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 04/18", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-04-25T13:28:20Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 04/25", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-05-02T12:16:21Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 05/02", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-05-05T19:25:16Z", "derek.simms@callowayfresh.example.com", "Market update - produce pricing", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Market_Update.pdf" ], [ "2026-05-07T18:47:38Z", "ar@callowayfresh.example.com", "Credit memo CM-1152", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "CM-1152.pdf" ], [ "2026-05-09T13:28:28Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 05/09", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-05-16T12:53:31Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 05/16", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-05-23T13:19:05Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 05/23", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-05-26T13:13:51Z", "derek.simms@callowayfresh.example.com", "Weekly specials and market update", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Market_Update.pdf" ], [ "2026-05-30T13:03:14Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 05/30", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-06-04T20:09:21Z", "ar@callowayfresh.example.com", "Credit memo CM-1159", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "CM-1159.pdf" ], [ "2026-06-06T13:37:02Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 06/06", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-06-13T12:39:51Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 06/13", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-06-16T15:00:38Z", "derek.simms@callowayfresh.example.com", "Weekly specials and market update", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Market_Update.pdf" ], [ "2026-06-20T12:48:19Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 06/20", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-06-26T16:56:55Z", "derek.simms@callowayfresh.example.com", "July 4th delivery schedule", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "none" ], [ "2026-06-27T13:08:47Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 06/27", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-07-02T18:55:15Z", "ar@callowayfresh.example.com", "Credit memo CM-1165", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "CM-1165.pdf" ], [ "2026-07-04T12:26:32Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 07/04", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-07-11T12:24:33Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 07/11", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-07-18T14:27:11Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 07/18", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-07-21T15:24:16Z", "derek.simms@callowayfresh.example.com", "Weekly specials and market update", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Market_Update.pdf" ], [ "2026-07-25T14:22:50Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 07/25", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-08-01T14:26:44Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 08/01", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-08-08T12:14:21Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 08/08", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-08-11T14:49:23Z", "derek.simms@callowayfresh.example.com", "Market update - produce pricing", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Market_Update.pdf" ], [ "2026-08-15T13:15:50Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 08/15", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-08-22T13:18:26Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 08/22", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-08-29T13:35:43Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 08/29", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-09-01T14:42:23Z", "derek.simms@callowayfresh.example.com", "Market update - produce pricing", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Market_Update.pdf" ], [ "2026-09-05T13:34:46Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 09/05", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-09-12T13:46:17Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 09/12", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-09-19T14:05:53Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 09/19", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-09-22T19:05:33Z", "derek.simms@callowayfresh.example.com", "Protein pricing for next week", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Market_Update.pdf" ], [ "2026-09-26T14:22:02Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 09/26", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-10-02T04:41:27Z", "ar@callowayfresh.example.com", "RE: Calloway Fresh Provisions - Statement 09/26", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "ACH Update - Calloway Fresh.pdf" ], [ "2026-10-02T16:02:51Z", "ar@callowayfresh.example.com", "RE: Calloway Fresh Provisions - Statement 09/26", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "none" ], [ "2026-10-03T13:05:44Z", "ar@callowayfresh.example.com", "Calloway Fresh Provisions - Statement 10/03", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ] ] }, "payables_last_60_days": { "period": "2026-08-11 to 2026-10-06", "note": "Payments created in our payables module from operating account x7714, excluding the payment under review. Payment runs are created on Tuesdays for Wednesday settlement.", "columns": [ "created", "payee", "reference", "amount_usd", "rail", "to_account", "created_by", "approved", "status" ], "rows": [ [ "2026-08-11", "Ashgrove Wine & Spirits", "AWS900454", 6209.7, "ACH", "x5167", "Alicia Moreno", "Owen Fairchild 2026-08-12", "settled" ], [ "2026-08-11", "Calloway Fresh Provisions, Inc.", "Week ending 2026-08-08", 12679.61, "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild 2026-08-12", "settled" ], [ "2026-08-11", "Hollow Creek Bakery", "Stmt 3302", 908.34, "ACH", "x2284", "Alicia Moreno", "not required", "settled" ], [ "2026-08-11", "Keel Linen & Uniform", "KLU-77124", 630.04, "ACH", "x9036", "Alicia Moreno", "not required", "settled" ], [ "2026-08-11", "Riverbend Seafood Co.", "RSC-41882", 4022.66, "ACH", "x7310", "Alicia Moreno", "not required", "settled" ], [ "2026-08-18", "Ashgrove Wine & Spirits", "AWS900479", 6673.33, "ACH", "x5167", "Alicia Moreno", "Owen Fairchild 2026-08-18", "settled" ], [ "2026-08-18", "Calloway Fresh Provisions, Inc.", "Week ending 2026-08-15", 8965.71, "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild 2026-08-18", "settled" ], [ "2026-08-18", "Hollow Creek Bakery", "Stmt 3303", 1041.07, "ACH", "x2284", "Alicia Moreno", "not required", "settled" ], [ "2026-08-18", "Keel Linen & Uniform", "KLU-77128", 546.54, "ACH", "x9036", "Alicia Moreno", "not required", "settled" ], [ "2026-08-18", "Riverbend Seafood Co.", "RSC-41890", 3207.43, "ACH", "x7310", "Alicia Moreno", "not required", "settled" ], [ "2026-08-25", "Ashgrove Wine & Spirits", "AWS900511", 6217.04, "ACH", "x5167", "Alicia Moreno", "Owen Fairchild 2026-08-26", "settled" ], [ "2026-08-25", "Calloway Fresh Provisions, Inc.", "Week ending 2026-08-22", 8676.84, "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild 2026-08-26", "settled" ], [ "2026-08-25", "Eastside Commons LLC", "Rent Sep - East Nashville", 11750, "ACH", "x0995", "Alicia Moreno", "Owen Fairchild 2026-08-26", "settled" ], [ "2026-08-25", "Germantown Lofts LLC", "Rent Sep - Germantown", 16500, "ACH", "x4402", "Alicia Moreno", "Owen Fairchild 2026-08-26", "settled" ], [ "2026-08-25", "Halcyon Kitchen Repair", "HKR-2210", 513.94, "ACH", "x5021", "Alicia Moreno", "not required", "settled" ], [ "2026-08-25", "Hollow Creek Bakery", "Stmt 3304", 802.63, "ACH", "x2284", "Alicia Moreno", "not required", "settled" ], [ "2026-08-25", "Keel Linen & Uniform", "KLU-77132", 644, "ACH", "x9036", "Alicia Moreno", "not required", "settled" ], [ "2026-08-25", "Midtown Row Holdings", "Rent Sep - Midtown", 14900, "ACH", "x3156", "Alicia Moreno", "Owen Fairchild 2026-08-26", "settled" ], [ "2026-08-25", "Riverbend Seafood Co.", "RSC-41900", 4339.95, "ACH", "x7310", "Alicia Moreno", "not required", "settled" ], [ "2026-08-25", "Twelfth Ave Retail Partners", "Rent Sep - 12th Ave", 13200, "ACH", "x7781", "Alicia Moreno", "Owen Fairchild 2026-08-26", "settled" ], [ "2026-09-01", "Ashgrove Wine & Spirits", "AWS900560", 5548.85, "ACH", "x5167", "Alicia Moreno", "Owen Fairchild 2026-09-01", "settled" ], [ "2026-09-01", "Brightside Pest Control", "Service Sep", 380, "ACH", "x4790", "Alicia Moreno", "not required", "settled" ], [ "2026-09-01", "Calloway Fresh Provisions, Inc.", "Week ending 2026-08-29", 9447.54, "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild 2026-09-01", "settled" ], [ "2026-09-01", "Clearpour Draft Services", "Line cleaning Sep", 420, "ACH", "x1532", "Alicia Moreno", "not required", "settled" ], [ "2026-09-01", "Greenline Waste & Recycling", "Service Sep", 1862.4, "ACH", "x8840", "Alicia Moreno", "not required", "settled" ], [ "2026-09-01", "Halcyon Kitchen Repair", "HKR-2212", 2422.2, "ACH", "x5021", "Alicia Moreno", "not required", "settled" ], [ "2026-09-01", "Hollow Creek Bakery", "Stmt 3305", 1066.39, "ACH", "x2284", "Alicia Moreno", "not required", "settled" ], [ "2026-09-01", "Keel Linen & Uniform", "KLU-77136", 619.63, "ACH", "x9036", "Alicia Moreno", "not required", "settled" ], [ "2026-09-01", "Pilot Light Hood Cleaning", "Hood cleaning Sep", 1150, "ACH", "x6214", "Alicia Moreno", "not required", "settled" ], [ "2026-09-01", "Riverbend Seafood Co.", "RSC-41906", 3325.11, "ACH", "x7310", "Alicia Moreno", "not required", "settled" ], [ "2026-09-01", "ServeTech POS", "Subscription Sep", 1296, "ACH", "x3368", "Alicia Moreno", "not required", "settled" ], [ "2026-09-08", "Ashgrove Wine & Spirits", "AWS900610", 7215.8, "ACH", "x5167", "Alicia Moreno", "Owen Fairchild 2026-09-08", "settled" ], [ "2026-09-08", "Calloway Fresh Provisions, Inc.", "Week ending 2026-09-05", 11115.79, "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild 2026-09-08", "settled" ], [ "2026-09-08", "Halcyon Kitchen Repair", "HKR-2213", 386.24, "ACH", "x5021", "Alicia Moreno", "not required", "settled" ], [ "2026-09-08", "Hollow Creek Bakery", "Stmt 3306", 988.62, "ACH", "x2284", "Alicia Moreno", "not required", "settled" ], [ "2026-09-08", "Keel Linen & Uniform", "KLU-77140", 676.44, "ACH", "x9036", "Alicia Moreno", "not required", "settled" ], [ "2026-09-08", "Riverbend Seafood Co.", "RSC-41917", 3517.6, "ACH", "x7310", "Alicia Moreno", "not required", "settled" ], [ "2026-09-15", "Ashgrove Wine & Spirits", "AWS900630", 7008, "ACH", "x5167", "Alicia Moreno", "Owen Fairchild 2026-09-16", "settled" ], [ "2026-09-15", "Calloway Fresh Provisions, Inc.", "Week ending 2026-09-12", 11211.29, "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild 2026-09-16", "settled" ], [ "2026-09-15", "Halcyon Kitchen Repair", "HKR-2216", 1939.64, "ACH", "x5021", "Alicia Moreno", "not required", "settled" ], [ "2026-09-15", "Hollow Creek Bakery", "Stmt 3307", 609.16, "ACH", "x2284", "Alicia Moreno", "not required", "settled" ], [ "2026-09-15", "Keel Linen & Uniform", "KLU-77144", 564.27, "ACH", "x9036", "Alicia Moreno", "not required", "settled" ], [ "2026-09-15", "Riverbend Seafood Co.", "RSC-41926", 4451.7, "ACH", "x7310", "Alicia Moreno", "not required", "settled" ], [ "2026-09-22", "Ashgrove Wine & Spirits", "AWS900665", 3923.34, "ACH", "x5167", "Alicia Moreno", "not required", "settled" ], [ "2026-09-22", "Calloway Fresh Provisions, Inc.", "Week ending 2026-09-19", 10197.7, "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild 2026-09-23", "settled" ], [ "2026-09-22", "Halcyon Kitchen Repair", "HKR-2219", 2298.32, "ACH", "x5021", "Alicia Moreno", "not required", "settled" ], [ "2026-09-22", "Hollow Creek Bakery", "Stmt 3308", 631.75, "ACH", "x2284", "Alicia Moreno", "not required", "settled" ], [ "2026-09-22", "Keel Linen & Uniform", "KLU-77148", 699.22, "ACH", "x9036", "Alicia Moreno", "not required", "settled" ], [ "2026-09-22", "Riverbend Seafood Co.", "RSC-41932", 4633.34, "ACH", "x7310", "Alicia Moreno", "not required", "settled" ], [ "2026-09-29", "Ashgrove Wine & Spirits", "AWS900694", 4105.72, "ACH", "x5167", "Alicia Moreno", "not required", "settled" ], [ "2026-09-29", "Calloway Fresh Provisions, Inc.", "Week ending 2026-09-26", 11702.55, "ACH", "Larchfield x6627", "Alicia Moreno", "Owen Fairchild 2026-09-29", "settled" ], [ "2026-09-29", "Eastside Commons LLC", "Rent Oct - East Nashville", 11750, "ACH", "x0995", "Alicia Moreno", "Owen Fairchild 2026-09-29", "settled" ], [ "2026-09-29", "Germantown Lofts LLC", "Rent Oct - Germantown", 16500, "ACH", "x4402", "Alicia Moreno", "Owen Fairchild 2026-09-29", "settled" ], [ "2026-09-29", "Halcyon Kitchen Repair", "HKR-2222", 863.49, "ACH", "x5021", "Alicia Moreno", "not required", "settled" ], [ "2026-09-29", "Hollow Creek Bakery", "Stmt 3309", 843.26, "ACH", "x2284", "Alicia Moreno", "not required", "settled" ], [ "2026-09-29", "Keel Linen & Uniform", "KLU-77152", 538.04, "ACH", "x9036", "Alicia Moreno", "not required", "settled" ], [ "2026-09-29", "Midtown Row Holdings", "Rent Oct - Midtown", 14900, "ACH", "x3156", "Alicia Moreno", "Owen Fairchild 2026-09-29", "settled" ], [ "2026-09-29", "Riverbend Seafood Co.", "RSC-41938", 4855.3, "ACH", "x7310", "Alicia Moreno", "not required", "settled" ], [ "2026-09-29", "Twelfth Ave Retail Partners", "Rent Oct - 12th Ave", 13200, "ACH", "x7781", "Alicia Moreno", "Owen Fairchild 2026-09-29", "settled" ], [ "2026-10-06", "Ashgrove Wine & Spirits", "AWS900718", 4031.93, "ACH", "x5167", "Alicia Moreno", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Brightside Pest Control", "Service Oct", 380, "ACH", "x4790", "Alicia Moreno", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Clearpour Draft Services", "Line cleaning Oct", 420, "ACH", "x1532", "Alicia Moreno", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Greenline Waste & Recycling", "Service Oct", 1862.4, "ACH", "x8840", "Alicia Moreno", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Hollow Creek Bakery", "Stmt 3310", 603.96, "ACH", "x2284", "Alicia Moreno", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Keel Linen & Uniform", "KLU-77156", 567.83, "ACH", "x9036", "Alicia Moreno", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Pilot Light Hood Cleaning", "Hood cleaning Oct", 1150, "ACH", "x6214", "Alicia Moreno", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Riverbend Seafood Co.", "RSC-41943", 2357.11, "ACH", "x7310", "Alicia Moreno", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "ServeTech POS", "Subscription Oct", 1296, "ACH", "x3368", "Alicia Moreno", "not required", "scheduled 2026-10-07" ] ] }, "online_banking_sessions": { "period": "2026-08-22 to 2026-10-07", "note": "One row per sign-in", "columns": [ "start", "user", "device", "network", "sign_in", "minutes", "activity" ], "rows": [ [ "2026-08-24T17:08:55Z", "Alicia Moreno", "d-2e19", "home, East Nashville", "password + push", 40, "entered 11 bills" ], [ "2026-08-25T14:27:48Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 49, "entered 13 bills; created 10 payments ($77,544.40)" ], [ "2026-08-26T00:21:22Z", "Owen Fairchild", "d-a913", "home, Brentwood TN", "Face ID (mobile app)", 5, "approved 6 payments ($71,243.88)" ], [ "2026-08-26T13:01:17Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 42, "entered 9 bills" ], [ "2026-08-28T19:20:23Z", "Alicia Moreno", "d-2e19", "home, East Nashville", "password + push", 12, "entered 10 bills" ], [ "2026-08-31T15:47:36Z", "Alicia Moreno", "d-2e19", "home, East Nashville", "password + push", 26, "entered 13 bills" ], [ "2026-09-01T14:41:13Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 39, "entered 10 bills; created 11 payments ($27,538.12)" ], [ "2026-09-01T20:26:16Z", "Owen Fairchild", "d-6c40", "Redfern office", "password + push", 7, "approved 2 payments ($14,996.39)" ], [ "2026-09-02T16:04:59Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 35, "entered 13 bills" ], [ "2026-09-03T13:18:30Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 35, "entered 6 bills" ], [ "2026-09-04T14:35:35Z", "Alicia Moreno", "d-2e19", "home, East Nashville", "password + push", 39, "entered 5 bills" ], [ "2026-09-08T14:00:21Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 55, "entered 14 bills; created 6 payments ($23,900.49)" ], [ "2026-09-08T19:14:40Z", "Owen Fairchild", "d-6c40", "Redfern office", "password + push", 8, "approved 2 payments ($18,331.59)" ], [ "2026-09-09T19:32:11Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 27, "entered 12 bills" ], [ "2026-09-10T17:41:56Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 45, "entered 6 bills" ], [ "2026-09-12T13:19:12Z", "Owen Fairchild", "d-a913", "home, Brentwood TN", "Face ID (mobile app)", 6, "viewed balances" ], [ "2026-09-14T14:11:33Z", "Alicia Moreno", "d-2e19", "home, East Nashville", "password + push", 33, "entered 9 bills" ], [ "2026-09-15T14:23:55Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 43, "entered 9 bills; created 6 payments ($25,784.06)" ], [ "2026-09-16T01:30:03Z", "Owen Fairchild", "d-a913", "home, Brentwood TN", "Face ID (mobile app)", 7, "approved 2 payments ($18,219.29)" ], [ "2026-09-16T18:23:29Z", "Tasha Greene", "d-3b88", "Redfern office", "Face ID (mobile app)", 12, "viewed bills" ], [ "2026-09-17T14:12:30Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 20, "entered 4 bills" ], [ "2026-09-18T18:42:35Z", "Alicia Moreno", "d-2e19", "home, East Nashville", "password + push", 15, "entered 6 bills" ], [ "2026-09-19T14:44:03Z", "Owen Fairchild", "d-a913", "hotel Wi-Fi, Chattanooga TN", "Face ID (mobile app)", 3, "viewed balances" ], [ "2026-09-22T14:50:40Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 51, "entered 13 bills; created 6 payments ($22,383.67)" ], [ "2026-09-23T01:35:48Z", "Owen Fairchild", "d-a913", "home, Brentwood TN", "Face ID (mobile app)", 5, "approved 1 payment ($10,197.70)" ], [ "2026-09-23T14:31:50Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 2, "browser updated (Chrome 129 to 130); same device" ], [ "2026-09-23T16:45:19Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 40, "entered 7 bills" ], [ "2026-09-24T14:33:36Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 13, "entered 12 bills" ], [ "2026-09-25T16:18:34Z", "Tasha Greene", "d-3b88", "Redfern office", "Face ID (mobile app)", 3, "viewed bills" ], [ "2026-09-28T17:24:58Z", "Alicia Moreno", "d-2e19", "home, East Nashville", "password + push", 32, "entered 4 bills" ], [ "2026-09-29T14:42:14Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 43, "entered 14 bills; created 10 payments ($79,258.36)" ], [ "2026-09-29T20:18:34Z", "Owen Fairchild", "d-6c40", "Redfern office", "password + push", 9, "approved 5 payments ($68,052.55)" ], [ "2026-09-30T13:37:23Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 13, "entered 4 bills" ], [ "2026-10-01T12:32:45Z", "Owen Fairchild", "d-a913", "home, Brentwood TN", "Face ID (mobile app)", 3, "viewed balances" ], [ "2026-10-02T15:02:26Z", "Alicia Moreno", "d-2e19", "home, East Nashville", "password + push", 16, "entered 6 bills; viewed vendor V-0007" ], [ "2026-10-02T16:26:51Z", "Alicia Moreno", "d-2e19", "home, East Nashville", "password + push", 11, "edited vendor V-0007 bank details; uploaded source email" ], [ "2026-10-05T17:12:29Z", "Alicia Moreno", "d-2e19", "home, East Nashville", "password + push", 44, "entered 13 bills" ], [ "2026-10-06T14:09:12Z", "Alicia Moreno", "d-2e19", "Redfern office", "password + push", 50, "entered 9 bills; created 10 payments ($23,953.88)" ], [ "2026-10-07T01:10:55Z", "Owen Fairchild", "d-a913", "home, Brentwood TN", "Face ID (mobile app)", 5, "approved 1 payment ($11,284.65)" ] ] }, "invoice": { "statement": "Week ending 2026-10-03", "received": "2026-10-03T13:05:44Z", "from": "ar@callowayfresh.example.com", "deliveries": "9 delivery invoices across the four restaurants, each signed for by the kitchen manager and matching receiving logs", "amount_usd": 11284.65, "due": "2026-10-10", "remit_to_printed_on_statement": "Larchfield National Bank, account ending 6627" }, "bank_change_request": { "received": "2026-10-02T04:41:27Z", "channel": "Email to the customer's AP mailbox, as a reply in the Statement 09/26 thread", "headers": { "From": "\"Teresa Okafor\" ", "Reply-To": "", "To": "Alicia Moreno ", "Cc": "", "Subject": "RE: Calloway Fresh Provisions - Statement 09/26", "Date": "Thu, 1 Oct 2026 23:41:19 -0500", "Message-ID": "", "In-Reply-To": "", "Return-Path": "", "Received": "from the vendor's Microsoft 365 tenant (198.51.100.212) by our mail gateway; Fri, 2 Oct 2026 04:41:27 +0000", "Authentication-Results": "spf=pass smtp.mailfrom=callowayfresh.example.com; dkim=pass header.d=callowayfresh.example.com; dmarc=pass (p=none) header.from=callowayfresh.example.com" }, "gateway_analysis": { "sender_domain": "callowayfresh.example.com (the vendor's domain on file)", "sender_domain_registered": "2009-03-17", "sender_address": "Matches the AR contact on file; it sent every statement in the last 4 years", "sending_infrastructure": "Same Microsoft 365 tenant as all 306 earlier messages from the vendor", "display_name": "Matches the vendor contact on file (Teresa Okafor)", "send_time": "23:41 Central; the first message from this vendor outside 06:52-18:40 Central", "thread": "Reply in the Statement 09/26 thread; quotes the original statement email" }, "body": "Hi Alicia,\n\nPlease see attached updated ACH information. We have moved our operating accounts to Pellmont Bank & Trust as part of our new line of credit with them. Please update your records and send all payments to the new account starting with this week's payment.\n\nLet me know once it's updated. Thank you!\n\nTeresa Okafor\nAccounts Receivable\nCalloway Fresh Provisions, Inc.\n415 Waldron Industrial Dr, La Vergne, TN 37086\n615-555-0131\n\nFrom: Teresa Okafor \nSent: Saturday, September 26, 2026 8:14 AM\nSubject: Calloway Fresh Provisions - Statement 09/26\nPlease find attached your statement for the week ending 09/26.", "attachments": [ { "name": "ACH Update - Calloway Fresh.pdf", "pages": 2, "pdf_producer": "iOS Quartz PDFContext (phone scan)", "pdf_created": "2026-10-01T22:15:09Z", "content": "Page 1: Calloway Fresh vendor ACH form, filled in by hand, signed 'Marcus Calloway, President', dated 10/1/26: Pellmont Bank & Trust, routing ending 0662, account ending 3390, account name 'Calloway Fresh Provisions'. Page 2: voided check no. 1001 on Pellmont Bank & Trust, printed CALLOWAY FRESH PROVISIONS, 415 WALDRON INDUSTRIAL DR, LA VERGNE TN" } ], "later_messages": [ { "ts": "2026-10-02T15:14:02Z", "from": "ap@redfernhospitality.example.com (Alicia Moreno)", "to": "ar@callowayfresh.example.com", "text": "Hi Teresa, I left you a voicemail. Can you confirm the new routing number ending 0662 and account ending 3390 before I update? Thanks, Alicia" }, { "ts": "2026-10-02T16:02:51Z", "from": "ar@callowayfresh.example.com", "text": "Yes that's correct, thanks Alicia! Please use the new account starting with this week's payment. Teresa" } ] }, "verification_and_changes": [ { "ts": "2026-10-02T15:10:40Z", "type": "phone_call", "by": "Alicia Moreno", "number_dialed": "+1-615-555-0131", "number_source": "Vendor record (main line), on file since 2021-06-14; also in the request's signature", "duration": "0 min 48 s", "outcome": "Voicemail (greeting: Calloway Fresh Provisions, please leave a message)", "note": "Left VM for Teresa asking her to call back to confirm the new bank info" }, { "ts": "2026-10-02T16:30:19Z", "type": "vendor_bank_details_changed", "by": "Alicia Moreno", "device": "d-2e19", "network": "home, East Nashville", "attestation": "Called the vendor to confirm" }, { "ts": "2026-10-02T16:32:10Z", "type": "ach_prenote_sent", "to": "Pellmont x3390", "detail": "Zero-dollar prenotification, settling 2026-10-05" }, { "ts": "2026-10-05T14:38:12Z", "type": "phone_call", "by": "Alicia Moreno", "number_dialed": "+1-615-555-0131", "number_source": "Vendor record (main line)", "duration": "1 min 35 s", "outcome": "Answered by a warehouse employee", "note": "Teresa not at her desk, left message for her to call me back about the bank change" }, { "ts": "2026-10-06T21:00:00Z", "type": "ach_prenote_result", "detail": "No return and no notification of change received" }, { "ts": "2026-10-07T01:13:00Z", "type": "call_back_status", "detail": "No return call from the vendor recorded", "attempts_by_number_on_file": { "+1-615-555-0131 (main line)": "2 calls, no confirmation", "+1-615-555-0138 (Marcus Calloway)": "not called", "+1-615-555-0144 (Derek Simms)": "not called" } } ], "account_validation": { "checked_at": "2026-10-02T16:31:07Z", "service": "Account validation network (bank-reported account data)", "account": "Pellmont Bank & Trust, routing ending 0662, account x3390", "account_status": "Open, valid", "can_receive_ach_credits": true, "owner_name_checked": "Calloway Fresh Provisions, Inc.", "owner_name_result": "Partial match", "detail": "Business name matches in part; the service does not return the name on the account", "account_open_date_reported": "2026-09-28", "routing_directory": "Pellmont Bank & Trust, Murfreesboro, TN" }, "vendor_network": { "matched_on": "Vendor tax ID xx-xxx2659", "other_customers_paying_vendor": 3, "same_request_elsewhere": "One customer (a cafe group) uploaded the same request on 2026-10-02 (identical attachment) and changed to Pellmont x3390 on 2026-10-05, recording 'confirmed by vendor email'; no payment to x3390 yet", "other_two_customers": "No bank change recorded; their AP mailboxes are not connected to our payables module. One paid Larchfield x6627 $4,912.30 on 2026-09-30 (settled); the other has a payment to x6627 scheduled for 2026-10-07", "new_account_elsewhere": "Pellmont x3390 is not on file for any other vendor" }, "payment_under_review": { "payment_id": "PMT-0207733", "invoice": "Statement, week ending 2026-10-03", "amount_usd": 11284.65, "rail": "Standard ACH (CCD+)", "effective_date": "2026-10-07", "destination": "Pellmont Bank & Trust x3390", "remittance_advice_to": "ar@callowayfresh.example.com", "created": { "ts": "2026-10-06T14:20:18Z", "by": "Alicia Moreno", "device": "d-2e19", "network": "Redfern office" }, "approved": { "ts": "2026-10-07T01:12:40Z", "by": "Owen Fairchild", "device": "d-a913", "network": "home, Brentwood TN", "sign_in": "Face ID (mobile app)" } } }, "questions": { "bec_likelihood": { "type": "score", "instructions": "How likely is it that the change to the vendor's bank details is fraudulent, that is, requested by someone impersonating the vendor or made through a compromised email account or login, rather than requested by the vendor?", "criteria": [ "Very unlikely (under 10%)", "Unlikely (10-40%)", "Uncertain (40-60%)", "Likely (60-90%)", "Very likely (over 90%)" ] }, "verified_out_of_band": { "type": "noul", "instructions": "Has the vendor confirmed the new bank details through a channel the requester could not control, such as a call to a phone number that was on file before the change was requested?" }, "action": { "type": "choice", "instructions": "What should happen to the vendor payment under review?", "criteria": { "release": "Release the payment to the new bank account", "hold_and_verify": "Hold the payment until the vendor confirms the new bank details on a call to a phone number that was on file before the change", "block_and_alert": "Cancel the payment, restore the vendor's previous verified bank details and alert the customer to suspected business email compromise" } } } }