{ "model": "grayson-1", "state": { "review": { "as_of": "2026-10-08T13:06:00Z", "queue": "Treasury payments fraud review", "trigger": "Same-day ACH payment approved to vendor bank details changed in the last 30 days", "rules_fired": [ { "rule": "PAY-BC30", "description": "Payment to vendor bank details changed in the last 30 days" }, { "rule": "PAY-MAX", "description": "Amount above the largest earlier payment to this vendor ($41,200.00)" }, { "rule": "PAY-RAIL", "description": "Same-day ACH; this vendor has always been paid by standard ACH" } ], "payment_status": "Held for review; same-day ACH cut-off for this payment is 2026-10-08T18:45:00Z" }, "customer": { "name": "Alderwick Veterinary Partners, PLLC", "business": "Three small-animal veterinary clinics (Denver, Lakewood and Aurora, CO); about 48 employees", "customer_since": "2023-02-14", "payables_module_since": "2023-02-21", "accounts": [ { "account": "Operating checking x0912", "avg_ledger_balance_90d_usd": 412380.55 }, { "account": "Payroll checking x0930", "funding": "Transfer from x0912 every other Thursday" } ], "payment_controls": { "dual_approval_over_usd": 10000, "vendor_bank_change": "The user making the change must tick an attestation that they called the vendor to confirm; no call details are required", "daily_ach_limit_usd": 150000, "same_day_ach": "Enabled 2023-02-21; used twice before (2024-12-31 and 2025-06-30, both rent payments sent late)" }, "users": [ { "name": "Ben Carter", "role": "AP specialist", "entitlements": "Enter bills, edit vendors, create payments", "user_since": "2024-02-05", "devices": [ { "id": "d-4c1a", "type": "Windows 11 laptop, Chrome", "first_seen": "2024-02-05" } ], "usual_access": "d-4c1a on the Denver office network, weekdays 07:30-17:00 MT", "mfa": "Authenticator push" }, { "name": "Rachel Moss", "role": "Controller", "entitlements": "Approve payments, edit vendors, administer users", "user_since": "2023-02-14", "devices": [ { "id": "d-91e2", "type": "MacBook, Safari", "first_seen": "2023-02-14" }, { "id": "d-7b30", "type": "iPhone, mobile app", "first_seen": "2025-04-02" } ], "usual_access": "Denver office or home (Littleton, CO); mobile app for evening approvals", "mfa": "Authenticator push" }, { "name": "Dr. Priya Raman", "role": "Managing partner", "entitlements": "View accounts, approve payments", "user_since": "2023-02-14", "devices": [ { "id": "d-22f8", "type": "iPad, mobile app", "first_seen": "2023-06-19" } ], "usual_access": "Home (Englewood, CO), mostly Saturday mornings", "mfa": "Authenticator push" }, { "name": "Linda Ferro", "role": "Former AP specialist", "status": "Disabled 2024-01-31" } ], "known_networks": [ { "label": "Denver office", "ip": "198.51.100.24", "type": "Business fiber, Denver, CO", "first_seen": "2023-02-14" }, { "label": "home, Littleton CO", "ip": "203.0.113.57", "type": "Residential cable (Rachel Moss)", "first_seen": "2023-03-02" }, { "label": "home, Englewood CO", "ip": "203.0.113.140", "type": "Residential fiber (Priya Raman)", "first_seen": "2023-06-19" } ] }, "vendor": { "vendor_id": "V-00118", "legal_name": "Bellhaven Veterinary Supply Co.", "tax_id": "xx-xxx4417", "category": "Veterinary pharmaceuticals and medical supplies distributor", "address": "1250 Keystone Ct, Unit B, Broomfield, CO 80020", "vendor_since": "2023-03-01", "payment_terms": "Net 10", "usual_rail": "Standard ACH (CCD+), remittance advice emailed to the remittance email", "domain_on_file": "bellhavenvetsupply.example.com", "contacts": [ { "name": "Karen Liu", "role": "Accounts receivable", "email": "billing@bellhavenvetsupply.example.com", "phone": "+1-303-555-0147", "on_file_since": "2023-03-01" }, { "name": "Tom Alcott", "role": "Account representative", "email": "tom.alcott@bellhavenvetsupply.example.com", "phone": "+1-303-555-0152", "on_file_since": "2024-01-10" }, { "name": "Accounts team", "role": "Remittance contact", "email": "accounts@bellhavenvetsuply.example.com", "phone": "+1-720-555-0189", "on_file_since": "2026-10-02" } ], "bank_accounts": [ { "bank": "First Wolden Bank, Broomfield, CO", "routing": "xxxxx2190", "account": "Business checking x4410", "added": "2023-03-01", "status": "Replaced 2026-10-02", "verification": "Call-back to +1-303-555-0147 on 2023-03-02 by Rachel Moss; owner name check: match", "payments_received": 56 }, { "bank": "Quarrystone Commerce Bank, Houston, TX", "routing": "xxxxx0418", "account": "Checking x7731", "added": "2026-10-02", "status": "Active", "payments_received": 0 } ], "master_change_log": [ { "ts": "2023-03-01T16:22:10Z", "by": "Rachel Moss", "change": "Vendor created; bank First Wolden x4410; contact Karen Liu" }, { "ts": "2024-01-10T15:41:03Z", "by": "Linda Ferro", "change": "Added contact Tom Alcott" }, { "ts": "2025-03-17T15:09:47Z", "by": "Ben Carter", "change": "Address Unit A to Unit B (from invoice letterhead)" }, { "ts": "2026-10-02T17:41:16Z", "by": "Ben Carter", "change": "Bank First Wolden x4410 to Quarrystone x7731; remittance email billing@bellhavenvetsupply.example.com to accounts@bellhavenvetsuply.example.com; added phone +1-720-555-0189", "attestation": "Called the vendor to confirm", "source_document": "Email of 2026-10-02 16:48 UTC (.eml uploaded)" } ] }, "vendor_payment_history": { "summary": "56 payments since 2023-03, all by standard ACH to First Wolden x4410, none returned; monthly orders $9,800 to $22,400, quarterly stock orders $28,410.50 to $41,200.00", "columns": [ "invoice", "invoice_date", "kind", "amount_usd", "due", "paid", "rail", "to_account", "created_by", "approved_by" ], "rows": [ [ "INV-14498", "2023-03-17", "Monthly order", 16423, "2023-03-27", "2023-03-23", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-14604", "2023-04-14", "Monthly order", 11377.4, "2023-04-24", "2023-04-20", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-14723", "2023-05-12", "Monthly order", 10475.64, "2023-05-22", "2023-05-18", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-14825", "2023-06-13", "Monthly order", 12790.23, "2023-06-23", "2023-06-22", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-14951", "2023-07-04", "Quarterly stock order", 28410.5, "2023-07-14", "2023-07-13", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-15076", "2023-07-12", "Monthly order", 14674.79, "2023-07-22", "2023-07-20", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-15185", "2023-08-15", "Monthly order", 19377.1, "2023-08-25", "2023-08-24", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-15294", "2023-09-12", "Monthly order", 18306.15, "2023-09-22", "2023-09-21", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-15409", "2023-10-03", "Quarterly stock order", 30122.75, "2023-10-13", "2023-10-12", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-15532", "2023-10-18", "Monthly order", 21401.02, "2023-10-28", "2023-10-26", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-15627", "2023-11-10", "Monthly order", 16420.69, "2023-11-20", "2023-11-16", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-15722", "2023-12-15", "Monthly order", 20473.38, "2023-12-25", "2023-12-21", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-15841", "2024-01-03", "Quarterly stock order", 29870, "2024-01-13", "2024-01-11", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-15942", "2024-01-12", "Monthly order", 20996.94, "2024-01-22", "2024-01-18", "ACH", "First Wolden x4410", "Linda Ferro", "Rachel Moss" ], [ "INV-16051", "2024-02-13", "Monthly order", 15502.69, "2024-02-23", "2024-02-22", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-16164", "2024-03-15", "Monthly order", 9852.51, "2024-03-25", "2024-03-21", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-16269", "2024-04-05", "Quarterly stock order", 31644.2, "2024-04-15", "2024-04-11", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-16368", "2024-04-12", "Monthly order", 14736.24, "2024-04-22", "2024-04-18", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-16480", "2024-05-10", "Monthly order", 14226.77, "2024-05-20", "2024-05-16", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-16577", "2024-06-14", "Monthly order", 14107.89, "2024-06-24", "2024-06-20", "ACH", "First Wolden x4410", "Ben Carter", "Dr. Priya Raman" ], [ "INV-16703", "2024-07-05", "Quarterly stock order", 33905.6, "2024-07-15", "2024-07-11", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-16818", "2024-07-16", "Monthly order", 19352.01, "2024-07-26", "2024-07-25", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-16942", "2024-08-16", "Monthly order", 17283.79, "2024-08-26", "2024-08-22", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-17067", "2024-09-12", "Monthly order", 9952, "2024-09-22", "2024-09-19", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-17191", "2024-10-07", "Quarterly stock order", 32118.4, "2024-10-17", "2024-10-17", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-17310", "2024-10-11", "Monthly order", 10776.26, "2024-10-21", "2024-10-17", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-17432", "2024-11-12", "Monthly order", 13527.15, "2024-11-22", "2024-11-21", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-17559", "2024-12-13", "Monthly order", 10368.19, "2024-12-23", "2024-12-19", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-17661", "2025-01-06", "Quarterly stock order", 34760.85, "2025-01-16", "2025-01-16", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-17783", "2025-01-10", "Monthly order", 18252.49, "2025-01-20", "2025-01-16", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-17883", "2025-02-12", "Monthly order", 17923.6, "2025-02-22", "2025-02-20", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-18006", "2025-03-14", "Monthly order", 16886.1, "2025-03-24", "2025-03-20", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-18108", "2025-04-03", "Quarterly stock order", 36212.3, "2025-04-13", "2025-04-10", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-18222", "2025-04-11", "Monthly order", 18818.68, "2025-04-21", "2025-04-17", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-18321", "2025-05-13", "Monthly order", 12418.49, "2025-05-23", "2025-05-22", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-18417", "2025-06-17", "Monthly order", 18712.4, "2025-06-27", "2025-06-26", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-18525", "2025-07-04", "Quarterly stock order", 35488.9, "2025-07-14", "2025-07-10", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-18651", "2025-07-11", "Monthly order", 10328.92, "2025-07-21", "2025-07-17", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-18750", "2025-08-15", "Monthly order", 19898.33, "2025-08-25", "2025-08-21", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-18856", "2025-09-18", "Monthly order", 21210.47, "2025-09-28", "2025-09-25", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-18984", "2025-10-06", "Quarterly stock order", 37940.15, "2025-10-16", "2025-10-16", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-19085", "2025-10-10", "Monthly order", 14928.1, "2025-10-20", "2025-10-16", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-19187", "2025-11-14", "Monthly order", 12416.66, "2025-11-24", "2025-11-20", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-19304", "2025-12-18", "Monthly order", 11660.13, "2025-12-28", "2025-12-24", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-19427", "2026-01-05", "Quarterly stock order", 39276.6, "2026-01-15", "2026-01-15", "ACH", "First Wolden x4410", "Ben Carter", "Dr. Priya Raman" ], [ "INV-19536", "2026-01-14", "Monthly order", 18388.2, "2026-01-24", "2026-01-22", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-19646", "2026-02-13", "Monthly order", 11389.94, "2026-02-23", "2026-02-19", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-19742", "2026-03-13", "Monthly order", 14283.86, "2026-03-23", "2026-03-19", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-19855", "2026-04-06", "Quarterly stock order", 38105.25, "2026-04-16", "2026-04-16", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-19967", "2026-04-15", "Monthly order", 17756.89, "2026-04-25", "2026-04-23", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-20094", "2026-05-13", "Monthly order", 12777.91, "2026-05-23", "2026-05-21", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-20210", "2026-06-16", "Monthly order", 22049.78, "2026-06-26", "2026-06-25", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-20330", "2026-07-03", "Quarterly stock order", 41200, "2026-07-13", "2026-07-09", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-20448", "2026-07-17", "Monthly order", 15932.39, "2026-07-27", "2026-07-23", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-20561", "2026-08-14", "Monthly order", 18521.85, "2026-08-24", "2026-08-20", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ], [ "INV-20682", "2026-09-16", "Monthly order", 11913.48, "2026-09-26", "2026-09-24", "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss" ] ] }, "vendor_email_history": { "mailbox": "ap@alderwickvet.example.com, connected to our payables module since 2023-02-21 (inbound mail from the vendor's domains)", "before_period": "2023-03 to 2025-09: 71 messages from bellhavenvetsupply.example.com (billing@ and tom.alcott@), all SPF, DKIM and DMARC pass, all sent through the vendor's Microsoft 365 tenant", "columns": [ "received", "from", "subject", "auth_spf_dkim_dmarc", "sent_via", "attachments" ], "rows": [ [ "2025-10-01T13:34:27Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Sep", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2025-10-06T20:48:19Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-18984 - Quarterly stock order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-18984.pdf" ], [ "2025-10-10T19:48:19Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-19085 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-19085.pdf" ], [ "2025-10-22T20:18:40Z", "tom.alcott@bellhavenvetsupply.example.com", "Order confirmation SO-88756", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "SO-88756.pdf" ], [ "2025-11-03T16:56:30Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Oct", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2025-11-14T19:49:09Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-19187 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-19187.pdf" ], [ "2025-12-01T14:42:16Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Nov", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2025-12-03T17:50:14Z", "tom.alcott@bellhavenvetsupply.example.com", "Holiday delivery schedule", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "none" ], [ "2025-12-09T18:38:32Z", "tom.alcott@bellhavenvetsupply.example.com", "Order confirmation SO-89304", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "SO-89304.pdf" ], [ "2025-12-18T22:14:22Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-19304 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-19304.pdf" ], [ "2026-01-02T16:27:38Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Dec", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-01-05T17:38:51Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-19427 - Quarterly stock order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-19427.pdf" ], [ "2026-01-06T19:24:47Z", "tom.alcott@bellhavenvetsupply.example.com", "Order confirmation SO-89804", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "SO-89804.pdf" ], [ "2026-01-12T17:26:48Z", "tom.alcott@bellhavenvetsupply.example.com", "2026 price list", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Bellhaven_2026_Pricing.xlsx" ], [ "2026-01-14T16:24:20Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-19536 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-19536.pdf" ], [ "2026-02-02T16:27:07Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Jan", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-02-13T15:55:11Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-19646 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-19646.pdf" ], [ "2026-02-18T20:21:21Z", "tom.alcott@bellhavenvetsupply.example.com", "Order confirmation SO-90244", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "SO-90244.pdf" ], [ "2026-03-02T16:44:10Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Feb", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-03-13T15:43:43Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-19742 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-19742.pdf" ], [ "2026-04-01T15:38:05Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Mar", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-04-06T20:04:40Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-19855 - Quarterly stock order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-19855.pdf" ], [ "2026-04-07T18:02:02Z", "tom.alcott@bellhavenvetsupply.example.com", "Order confirmation SO-90643", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "SO-90643.pdf" ], [ "2026-04-15T20:51:46Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-19967 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-19967.pdf" ], [ "2026-05-01T15:51:26Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Apr", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-05-13T16:48:18Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-20094 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-20094.pdf" ], [ "2026-05-20T15:39:15Z", "tom.alcott@bellhavenvetsupply.example.com", "Order confirmation SO-91293", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "SO-91293.pdf" ], [ "2026-06-01T13:55:14Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement May", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-06-16T17:21:11Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-20210 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-20210.pdf" ], [ "2026-07-01T14:47:40Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Jun", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-07-03T15:06:41Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-20330 - Quarterly stock order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-20330.pdf" ], [ "2026-07-07T15:40:39Z", "tom.alcott@bellhavenvetsupply.example.com", "Order confirmation SO-91666", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "SO-91666.pdf" ], [ "2026-07-17T18:06:13Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-20448 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-20448.pdf" ], [ "2026-08-03T13:49:14Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Jul", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-08-14T21:23:40Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-20561 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-20561.pdf" ], [ "2026-08-19T21:38:01Z", "tom.alcott@bellhavenvetsupply.example.com", "Order confirmation SO-92283", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "SO-92283.pdf" ], [ "2026-09-01T14:58:33Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Aug", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-09-16T19:44:38Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-20682 - Monthly order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-20682.pdf" ], [ "2026-09-24T16:37:54Z", "tom.alcott@bellhavenvetsupply.example.com", "Order confirmation SO-92656", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "SO-92656.pdf" ], [ "2026-09-30T15:05:12Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Invoice INV-20931 - Q4 stock order", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "INV-20931.pdf" ], [ "2026-10-01T14:32:48Z", "billing@bellhavenvetsupply.example.com", "Bellhaven Veterinary Supply - Statement Sep", "pass/pass/pass", "Microsoft 365 (vendor tenant)", "Statement.pdf" ], [ "2026-10-02T16:48:31Z", "billing@bellhavenvetsuply.example.com", "RE: Bellhaven Invoice INV-20931 - Q4 stock order", "pass/pass/none", "Hosting provider, Amsterdam, NL (203.0.113.88)", "Bellhaven_Remittance_Update.pdf" ], [ "2026-10-05T15:22:10Z", "accounts@bellhavenvetsuply.example.com", "RE: Bellhaven Invoice INV-20931 - Q4 stock order", "pass/pass/none", "Hosting provider, Amsterdam, NL (203.0.113.88)", "none" ], [ "2026-10-07T14:51:37Z", "accounts@bellhavenvetsuply.example.com", "RE: Bellhaven Invoice INV-20931 - Q4 stock order", "pass/pass/none", "Hosting provider, Amsterdam, NL (203.0.113.88)", "none" ] ] }, "payables_last_60_days": { "period": "2026-08-12 to 2026-10-07", "note": "Payments created in our payables module from operating account x0912, excluding the payment under review. Payment runs are created on Wednesdays for Thursday settlement.", "columns": [ "created", "payee", "reference", "amount_usd", "rail", "to_account", "created_by", "approved", "status" ], "rows": [ [ "2026-08-12", "Clearwater Linen Service", "CW30120", 518.59, "ACH", "x4471", "Ben Carter", "not required", "settled" ], [ "2026-08-12", "Pinecrest Reference Laboratory", "PRL-58211", 2321.54, "ACH", "x1876", "Ben Carter", "not required", "settled" ], [ "2026-08-12", "Range Animal Nutrition", "RAN-7714", 6205.91, "ACH", "x2093", "Ben Carter", "not required", "settled" ], [ "2026-08-12", "Talus Pet Crematory", "TPC-2209", 1025.21, "ACH", "x0647", "Ben Carter", "not required", "settled" ], [ "2026-08-19", "Bellhaven Veterinary Supply Co.", "INV-20561", 18521.85, "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss 2026-08-19", "settled" ], [ "2026-08-19", "Clearwater Linen Service", "CW30123", 562.17, "ACH", "x4471", "Ben Carter", "not required", "settled" ], [ "2026-08-19", "Front Range Medical Gas", "FRMG 40567", 648.97, "ACH", "x8315", "Ben Carter", "not required", "settled" ], [ "2026-08-19", "Pinecrest Reference Laboratory", "PRL-58212", 4766.23, "ACH", "x1876", "Ben Carter", "not required", "settled" ], [ "2026-08-26", "Aurora Gateway Holdings", "Rent Sep - Aurora clinic", 9975, "ACH", "x6620", "Ben Carter", "not required", "settled" ], [ "2026-08-26", "Clearwater Linen Service", "CW30126", 522.85, "ACH", "x4471", "Ben Carter", "not required", "settled" ], [ "2026-08-26", "Crestview Properties LLC", "Rent Sep - Denver clinic", 14200, "ACH", "x3307", "Ben Carter", "Rachel Moss 2026-08-27", "settled" ], [ "2026-08-26", "Lakewood Commons Partners", "Rent Sep - Lakewood clinic", 11850, "ACH", "x9142", "Ben Carter", "Rachel Moss 2026-08-27", "settled" ], [ "2026-08-26", "Northfield Compounding Pharmacy", "NCP9907", 1450.3, "ACH", "x2266", "Ben Carter", "not required", "settled" ], [ "2026-08-26", "Pinecrest Reference Laboratory", "PRL-58213", 4224.58, "ACH", "x1876", "Ben Carter", "not required", "settled" ], [ "2026-08-26", "Range Animal Nutrition", "RAN-7718", 6485.9, "ACH", "x2093", "Ben Carter", "not required", "settled" ], [ "2026-08-26", "Talus Pet Crematory", "TPC-2211", 1369.35, "ACH", "x0647", "Ben Carter", "not required", "settled" ], [ "2026-09-02", "Clearwater Linen Service", "CW30129", 685.76, "ACH", "x4471", "Ben Carter", "not required", "settled" ], [ "2026-09-02", "Copperline IT Services", "CIT-1191", 2150, "ACH", "x3954", "Ben Carter", "not required", "settled" ], [ "2026-09-02", "Front Range Medical Gas", "FRMG 40582", 1339.58, "ACH", "x8315", "Ben Carter", "not required", "settled" ], [ "2026-09-02", "Kestrel Imaging Service", "Q3 maintenance KIS-612", 3450, "ACH", "x6081", "Ben Carter", "not required", "settled" ], [ "2026-09-02", "Pinecrest Reference Laboratory", "PRL-58214", 2233.71, "ACH", "x1876", "Ben Carter", "not required", "settled" ], [ "2026-09-02", "Summit Biohazard Disposal", "Service Sep", 1284.5, "ACH", "x7719", "Ben Carter", "not required", "settled" ], [ "2026-09-09", "Clearwater Linen Service", "CW30132", 558.04, "ACH", "x4471", "Ben Carter", "not required", "settled" ], [ "2026-09-09", "Front Range Veterinary Society", "2026-27 membership dues", 1450, "Check #10442", "mailed", "Ben Carter", "not required", "check cleared 2026-09-21" ], [ "2026-09-09", "Pinecrest Reference Laboratory", "PRL-58215", 2244.54, "ACH", "x1876", "Ben Carter", "not required", "settled" ], [ "2026-09-09", "Range Animal Nutrition", "RAN-7722", 4270.25, "ACH", "x2093", "Ben Carter", "not required", "settled" ], [ "2026-09-09", "Talus Pet Crematory", "TPC-2212", 947.58, "ACH", "x0647", "Ben Carter", "not required", "settled" ], [ "2026-09-16", "Clearwater Linen Service", "CW30135", 411.07, "ACH", "x4471", "Ben Carter", "not required", "settled" ], [ "2026-09-16", "Front Range Medical Gas", "FRMG 40600", 954.4, "ACH", "x8315", "Ben Carter", "not required", "settled" ], [ "2026-09-16", "Pinecrest Reference Laboratory", "PRL-58216", 5278.6, "ACH", "x1876", "Ben Carter", "not required", "settled" ], [ "2026-09-23", "Bellhaven Veterinary Supply Co.", "INV-20682", 11913.48, "ACH", "First Wolden x4410", "Ben Carter", "Rachel Moss 2026-09-24", "settled" ], [ "2026-09-23", "Clearwater Linen Service", "CW30138", 601.27, "ACH", "x4471", "Ben Carter", "not required", "settled" ], [ "2026-09-23", "Pinecrest Reference Laboratory", "PRL-58217", 4606.1, "ACH", "x1876", "Ben Carter", "not required", "settled" ], [ "2026-09-23", "Range Animal Nutrition", "RAN-7725", 6095.47, "ACH", "x2093", "Ben Carter", "not required", "settled" ], [ "2026-09-23", "Talus Pet Crematory", "TPC-2213", 1375.38, "ACH", "x0647", "Ben Carter", "not required", "settled" ], [ "2026-09-30", "Aurora Gateway Holdings", "Rent Oct - Aurora clinic", 9975, "ACH", "x6620", "Ben Carter", "not required", "settled" ], [ "2026-09-30", "Clearwater Linen Service", "CW30141", 661.85, "ACH", "x4471", "Ben Carter", "not required", "settled" ], [ "2026-09-30", "Crestview Properties LLC", "Rent Oct - Denver clinic", 14200, "ACH", "x3307", "Ben Carter", "Rachel Moss 2026-09-30", "settled" ], [ "2026-09-30", "Front Range Medical Gas", "FRMG 40618", 1045.53, "ACH", "x8315", "Ben Carter", "not required", "settled" ], [ "2026-09-30", "Lakewood Commons Partners", "Rent Oct - Lakewood clinic", 11850, "ACH", "x9142", "Ben Carter", "Rachel Moss 2026-09-30", "settled" ], [ "2026-09-30", "Northfield Compounding Pharmacy", "NCP9911", 629.75, "ACH", "x2266", "Ben Carter", "not required", "settled" ], [ "2026-09-30", "Pinecrest Reference Laboratory", "PRL-58218", 2762.14, "ACH", "x1876", "Ben Carter", "not required", "settled" ], [ "2026-10-07", "Clearwater Linen Service", "CW30144", 565.58, "ACH", "x4471", "Ben Carter", "not required", "scheduled 2026-10-08" ], [ "2026-10-07", "Copperline IT Services", "CIT-1192", 2150, "ACH", "x3954", "Ben Carter", "not required", "scheduled 2026-10-08" ], [ "2026-10-07", "Pinecrest Reference Laboratory", "PRL-58219", 5053.86, "ACH", "x1876", "Ben Carter", "not required", "scheduled 2026-10-08" ], [ "2026-10-07", "Range Animal Nutrition", "RAN-7730", 5562.83, "ACH", "x2093", "Ben Carter", "not required", "scheduled 2026-10-08" ], [ "2026-10-07", "Summit Biohazard Disposal", "Service Oct", 1284.5, "ACH", "x7719", "Ben Carter", "not required", "scheduled 2026-10-08" ], [ "2026-10-07", "Talus Pet Crematory", "TPC-2214", 1063.65, "ACH", "x0647", "Ben Carter", "not required", "scheduled 2026-10-08" ] ] }, "online_banking_sessions": { "period": "2026-08-24 to 2026-10-08", "note": "One row per sign-in", "columns": [ "start", "user", "device", "network", "sign_in", "minutes", "activity" ], "rows": [ [ "2026-08-24T14:26:21Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 15, "entered 4 bills" ], [ "2026-08-25T14:45:13Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 6, "entered 6 bills" ], [ "2026-08-26T20:11:49Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 35, "entered 2 bills; created 8 payments ($50,077.98)" ], [ "2026-08-27T13:34:08Z", "Rachel Moss", "d-91e2", "home, Littleton CO", "password + push", 8, "approved 2 payments ($26,050.00)" ], [ "2026-08-27T14:25:10Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 15, "viewed balances" ], [ "2026-08-27T15:06:42Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 24, "entered 9 bills" ], [ "2026-08-28T15:09:49Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 7, "entered 4 bills" ], [ "2026-08-29T15:09:22Z", "Dr. Priya Raman", "d-22f8", "home, Englewood CO", "Face ID (mobile app)", 2, "viewed balances" ], [ "2026-08-31T16:23:29Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 30, "entered 6 bills" ], [ "2026-09-01T15:28:52Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 16, "matched 7 receiving records" ], [ "2026-09-02T21:29:42Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 45, "entered 2 bills; created 6 payments ($11,143.55)" ], [ "2026-09-03T13:41:11Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 31, "matched 7 receiving records" ], [ "2026-09-03T16:56:44Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 14, "ran cash position report" ], [ "2026-09-04T14:15:33Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 16, "downloaded statements" ], [ "2026-09-04T15:16:20Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 15, "entered 4 bills" ], [ "2026-09-08T15:56:42Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 8, "downloaded statements" ], [ "2026-09-08T16:27:32Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 25, "entered 2 bills" ], [ "2026-09-09T20:13:07Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 28, "entered 3 bills; created 5 payments ($9,470.41)" ], [ "2026-09-10T14:18:49Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 20, "matched 7 receiving records" ], [ "2026-09-11T13:40:24Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 7, "entered 6 bills" ], [ "2026-09-14T13:51:06Z", "Ben Carter", "d-4c1a", "Denver office", "password reset by email link + push", 14, "entered 5 bills" ], [ "2026-09-15T15:58:39Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 13, "entered 6 bills" ], [ "2026-09-15T16:36:49Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 19, "downloaded statements" ], [ "2026-09-16T20:32:04Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 42, "entered 3 bills; created 3 payments ($6,644.07)" ], [ "2026-09-17T14:05:53Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 4, "downloaded statements" ], [ "2026-09-17T15:58:46Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 35, "matched 6 receiving records" ], [ "2026-09-18T14:12:47Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 20, "downloaded statements" ], [ "2026-09-19T15:26:58Z", "Dr. Priya Raman", "d-22f8", "home, Englewood CO", "Face ID (mobile app)", 6, "viewed balances" ], [ "2026-09-21T13:43:35Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 26, "entered 5 bills" ], [ "2026-09-22T14:12:55Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 5, "downloaded statements" ], [ "2026-09-22T16:12:04Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 11, "matched 9 receiving records" ], [ "2026-09-23T15:00:54Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 10, "ran cash position report" ], [ "2026-09-23T21:39:53Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 29, "entered 2 bills; created 5 payments ($24,591.70)" ], [ "2026-09-24T13:11:00Z", "Rachel Moss", "d-91e2", "home, Littleton CO", "password + push", 4, "approved 1 payment ($11,913.48)" ], [ "2026-09-24T15:57:13Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 9, "matched 3 receiving records" ], [ "2026-09-25T14:05:02Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 11, "downloaded statements" ], [ "2026-09-25T15:09:34Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 25, "entered 4 bills" ], [ "2026-09-26T16:39:47Z", "Dr. Priya Raman", "d-22f8", "home, Englewood CO", "Face ID (mobile app)", 4, "viewed balances" ], [ "2026-09-29T14:29:06Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 20, "ran cash position report" ], [ "2026-09-29T14:40:01Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 19, "entered 5 bills" ], [ "2026-09-30T15:31:44Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 26, "entered 6 bills incl. Bellhaven INV-20931 ($46,850.00, due 2026-10-09)" ], [ "2026-09-30T21:30:52Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 39, "entered 4 bills; created 7 payments ($41,124.27)" ], [ "2026-09-30T22:26:45Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 8, "approved 2 payments ($26,050.00)" ], [ "2026-10-01T16:23:03Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 19, "viewed balances" ], [ "2026-10-02T15:08:52Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 18, "entered 3 bills" ], [ "2026-10-02T16:19:27Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 8, "viewed balances" ], [ "2026-10-02T17:36:20Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 9, "edited vendor V-00118 (bank details, remittance email, phone); uploaded source email" ], [ "2026-10-03T14:34:29Z", "Dr. Priya Raman", "d-22f8", "home, Englewood CO", "Face ID (mobile app)", 4, "viewed balances" ], [ "2026-10-05T14:02:39Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 17, "entered 4 bills; viewed vendor V-00118" ], [ "2026-10-06T14:19:45Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 30, "matched 9 receiving records" ], [ "2026-10-06T14:23:20Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 9, "ran cash position report" ], [ "2026-10-07T16:23:04Z", "Rachel Moss", "d-91e2", "Denver office", "password + push", 4, "viewed balances" ], [ "2026-10-07T21:18:40Z", "Ben Carter", "d-4c1a", "Denver office", "password + push", 29, "entered 2 bills; created 7 payments ($62,530.42)" ], [ "2026-10-08T13:02:17Z", "Rachel Moss", "d-91e2", "home, Littleton CO", "password + push", 6, "approved 1 payment ($46,850.00)" ] ] }, "invoice": { "number": "INV-20931", "invoice_date": "2026-09-29", "received": "2026-09-30T15:05:12Z", "from": "billing@bellhavenvetsupply.example.com", "description": "Q4 quarterly stock order", "lines": [ { "item": "Vaccines (canine and feline core, rabies)", "amount_usd": 22310 }, { "item": "Surgical consumables", "amount_usd": 13975.5 }, { "item": "Anesthesia and IV fluids", "amount_usd": 7842.25 }, { "item": "Dental supplies", "amount_usd": 2722.25 } ], "amount_usd": 46850, "due": "2026-10-09", "remit_to_printed_on_invoice": "First Wolden Bank, account ending 4410", "goods_received": "Delivered 2026-10-01 to all three clinics; receipt logged by each clinic manager", "thread": [ { "ts": "2026-09-30T15:05:12Z", "from": "billing@bellhavenvetsupply.example.com", "cc": "tom.alcott@bellhavenvetsupply.example.com", "text": "Hi Ben, please find attached INV-20931 for the Q4 stock order shipping 10/1. Thanks, Karen Liu, Accounts Receivable" }, { "ts": "2026-09-30T16:20:44Z", "from": "ap@alderwickvet.example.com (Ben Carter)", "cc": "tom.alcott@bellhavenvetsupply.example.com", "text": "Thanks Karen, INV-20931 is scheduled for 10/8." } ] }, "bank_change_request": { "received": "2026-10-02T16:48:31Z", "channel": "Email to the customer's AP mailbox, as a reply in the INV-20931 thread", "headers": { "From": "\"Karen Liu | Bellhaven Billing\" ", "Reply-To": "accounts@bellhavenvetsuply.example.com", "To": "Ben Carter ", "Cc": "", "Subject": "RE: Bellhaven Invoice INV-20931 - Q4 stock order", "Date": "Fri, 2 Oct 2026 11:48:22 -0500", "Message-ID": "<20261002164822.7f3a91c2@mail.bellhavenvetsuply.example.com>", "In-Reply-To": "", "Return-Path": "", "Received": "from mail.bellhavenvetsuply.example.com (203.0.113.88) by our mail gateway; Fri, 2 Oct 2026 16:48:31 +0000", "Authentication-Results": "spf=pass smtp.mailfrom=bellhavenvetsuply.example.com; dkim=pass header.d=bellhavenvetsuply.example.com; dmarc=none (no record) header.from=bellhavenvetsuply.example.com" }, "gateway_analysis": { "sender_domain": "bellhavenvetsuply.example.com", "vendor_domain_on_file": "bellhavenvetsupply.example.com", "domain_similarity": "One character different from the vendor's domain on file", "sender_domain_registered": "2026-09-28T19:02:00Z", "first_message_from_sender_domain_seen_by_us": "2026-10-02T16:48:31Z (any customer)", "sending_ip": "203.0.113.88, hosting provider, Amsterdam, NL; none of the vendor's 112 earlier messages came from it", "display_name": "Matches the vendor contact on file (Karen Liu)", "thread": "Quotes the INV-20931 thread including Ben Carter's reply of 2026-09-30; the Cc to tom.alcott@bellhavenvetsupply.example.com was removed" }, "body": "Hi Ben,\n\nThank you for confirming the payment date. Please note that following our annual audit we have moved our banking to Quarrystone Commerce Bank. Kindly update our remittance details using the attached letter before you release payment for INV-20931. Our First Wolden account is being closed on October 9, so any payment sent there after that date will be returned and may delay your next order.\n\nOur main line is being upgraded this week, so for any questions please call our accounts team directly at +1-720-555-0189 or write to accounts@bellhavenvetsuply.example.com.\n\nKind regards,\nKaren Liu\nAccounts Receivable | Bellhaven Veterinary Supply Co.\n\n> On Wed, Sep 30, 2026, Ben Carter wrote:\n> Thanks Karen, INV-20931 is scheduled for 10/8.", "attachments": [ { "name": "Bellhaven_Remittance_Update.pdf", "pages": 1, "pdf_producer": "Microsoft: Print To PDF", "pdf_created": "2026-10-02T15:58:40Z", "content": "Letter on Bellhaven letterhead dated October 1, 2026, unsigned: new bank Quarrystone Commerce Bank, routing ending 0418, account ending 7731, account name 'Bellhaven Veterinary Supply'; payments to be sent there effective immediately" } ], "later_messages": [ { "ts": "2026-10-02T18:05:51Z", "from": "ap@alderwickvet.example.com (Ben Carter)", "to": "accounts@bellhavenvetsuply.example.com", "text": "Hi Karen, updated on our side. Thanks." }, { "ts": "2026-10-05T15:22:10Z", "from": "accounts@bellhavenvetsuply.example.com", "text": "Hi Ben, thank you. Can you confirm INV-20931 will go out before the 9th?" }, { "ts": "2026-10-05T16:40:02Z", "from": "ap@alderwickvet.example.com (Ben Carter)", "to": "accounts@bellhavenvetsuply.example.com", "text": "Yes, scheduled for 10/8." }, { "ts": "2026-10-07T14:51:37Z", "from": "accounts@bellhavenvetsuply.example.com", "text": "Hi Ben, please send INV-20931 by same-day ACH so the funds land in the new account before the old one closes on the 9th, and send the remittance advice to this address. Thank you for your help. Karen" } ] }, "verification_and_changes": [ { "ts": "2026-10-02T17:20:05Z", "type": "phone_call", "by": "Ben Carter", "number_dialed": "+1-720-555-0189", "number_source": "Body and signature of the 2026-10-02 change-request email; not on the vendor record before the request", "duration": "4 min 12 s", "note": "Spoke with Karen in accounts, who confirmed the new account details" }, { "ts": "2026-10-02T17:41:16Z", "type": "vendor_bank_details_changed", "by": "Ben Carter", "device": "d-4c1a", "network": "Denver office", "attestation": "Called the vendor to confirm" }, { "ts": "2026-10-02T17:42:03Z", "type": "micro_deposits_sent", "to": "Quarrystone x7731", "detail": "Two credits under $1.00, settling 2026-10-05" }, { "ts": "2026-10-05T14:30:18Z", "type": "micro_deposits_confirmed", "detail": "Both amounts entered correctly through a link emailed to accounts@bellhavenvetsuply.example.com (the remittance email set on 2026-10-02)" } ], "account_validation": { "checked_at": "2026-10-02T17:41:22Z", "service": "Account validation network (bank-reported account data)", "account": "Quarrystone Commerce Bank, routing ending 0418, account x7731", "account_status": "Open, valid", "can_receive_ach_credits": true, "owner_name_checked": "Bellhaven Veterinary Supply Co.", "owner_name_result": "No match", "routing_directory": "Quarrystone Commerce Bank, Houston, TX" }, "vendor_network": { "matched_on": "Vendor tax ID xx-xxx4417", "other_customers_paying_vendor": 6, "bank_on_file_at_other_customers": "All 6: First Wolden Bank x4410", "recent_payments_to_old_account": "4 payments from 3 customers to First Wolden x4410 between 2026-09-29 and 2026-10-06 (latest $12,906.40 on 2026-10-06), all settled, none returned", "bank_change_requests_at_other_customers": "None recorded", "new_account_elsewhere": "Quarrystone x7731 was added on 2026-09-30 by one other customer of ours as the remittance account of a different vendor (a laboratory supply company); one payment of $18,420.00 sent there on 2026-10-01" }, "payment_under_review": { "payment_id": "PMT-0094417", "invoice": "INV-20931", "amount_usd": 46850, "rail": "Same-day ACH (CCD+)", "effective_date": "2026-10-08", "destination": "Quarrystone Commerce Bank x7731", "remittance_advice_to": "accounts@bellhavenvetsuply.example.com", "memo": "Per vendor, funds must reach new account before 10/9", "created": { "ts": "2026-10-07T21:40:09Z", "by": "Ben Carter", "device": "d-4c1a", "network": "Denver office" }, "approved": { "ts": "2026-10-08T13:05:41Z", "by": "Rachel Moss", "device": "d-91e2", "network": "home, Littleton CO" } } }, "questions": { "bec_likelihood": { "type": "score", "instructions": "How likely is it that the change to the vendor's bank details is fraudulent, that is, requested by someone impersonating the vendor or made through a compromised email account or login, rather than requested by the vendor?", "criteria": [ "Very unlikely (under 10%)", "Unlikely (10-40%)", "Uncertain (40-60%)", "Likely (60-90%)", "Very likely (over 90%)" ] }, "verified_out_of_band": { "type": "noul", "instructions": "Has the vendor confirmed the new bank details through a channel the requester could not control, such as a call to a phone number that was on file before the change was requested?" }, "action": { "type": "choice", "instructions": "What should happen to the vendor payment under review?", "criteria": { "release": "Release the payment to the new bank account", "hold_and_verify": "Hold the payment until the vendor confirms the new bank details on a call to a phone number that was on file before the change", "block_and_alert": "Cancel the payment, restore the vendor's previous verified bank details and alert the customer to suspected business email compromise" } } } }