{ "model": "grayson-1", "state": { "review": { "as_of": "2026-10-06T22:48:00Z", "queue": "Treasury payments fraud review", "trigger": "Payment approved to vendor bank details changed in the last 30 days", "rules_fired": [ { "rule": "PAY-BC30", "description": "Payment to vendor bank details changed in the last 30 days" }, { "rule": "PAY-MAX", "description": "Amount above the largest earlier payment to this vendor ($27,900.00)" }, { "rule": "USR-NEWDEV", "description": "Approved from a device registered in the last 7 days, at a network first seen in the last 7 days" } ], "payment_status": "Held for review; standard ACH file for 2026-10-07 settlement closes 2026-10-07T14:00:00Z" }, "customer": { "name": "Sandvale Mechanical, Inc.", "business": "Commercial HVAC and plumbing contractor, Columbus, OH; about 60 employees", "customer_since": "2019-08-20", "payables_module_since": "2019-09-03", "accounts": [ { "account": "Operating checking x3381", "avg_ledger_balance_90d_usd": 688240.17 }, { "account": "Payroll checking x3399", "funding": "Transfer from x3381 every other Friday" }, { "account": "Revolving line of credit x3402", "limit_usd": 750000, "outstanding_usd": 0 } ], "payment_controls": { "dual_approval_at_or_over_usd": 15000, "vendor_bank_change": "Call-back to a phone number already on the vendor record, with a call note; a second user must review the change before it takes effect", "wires": "Two approvers", "daily_ach_limit_usd": 250000 }, "users": [ { "name": "Megan Pruitt", "role": "Office and AP manager", "entitlements": "Enter bills, edit vendors, create payments", "user_since": "2019-08-20", "devices": [ { "id": "d-5a07", "type": "Windows 11 desktop, Edge", "first_seen": "2022-11-14" } ], "usual_access": "d-5a07 on the Columbus office network, weekdays 07:00-16:30 ET", "mfa": "Authenticator push" }, { "name": "Greg Haskins", "role": "CFO", "entitlements": "Approve payments, review vendor changes, administer users", "user_since": "2019-08-20", "devices": [ { "id": "d-c3e9", "type": "Surface laptop, Chrome", "first_seen": "2024-03-08" }, { "id": "d-1f62", "type": "iPhone, mobile app", "first_seen": "2023-05-11", "status": "Removed by user 2026-10-03" }, { "id": "d-8d4b", "type": "iPhone, mobile app", "first_seen": "2026-10-03" } ], "usual_access": "Office or home (Dublin, OH); mobile app for evening approvals", "locations_last_12_months": "Columbus area; Las Vegas, NV 2025-10-06 to 2025-10-09 (mobile app); Naples, FL 2026-03-21 to 2026-03-28 (mobile app)", "mfa": "Authenticator push; Face ID in the mobile app" }, { "name": "Daniel Ostrowski", "role": "President", "entitlements": "View accounts, approve payments and wires", "user_since": "2019-08-20", "devices": [ { "id": "d-77aa", "type": "MacBook, Safari", "first_seen": "2021-04-30" } ], "usual_access": "Home (Upper Arlington, OH), early in the month", "mfa": "Authenticator push" } ], "known_networks": [ { "label": "Columbus office", "ip": "198.51.100.61", "type": "Business cable, Columbus, OH", "first_seen": "2019-08-20" }, { "label": "home, Dublin OH", "ip": "203.0.113.19", "type": "Residential fiber (Greg Haskins)", "first_seen": "2020-03-16" }, { "label": "home, Upper Arlington OH", "ip": "203.0.113.203", "type": "Residential cable (Daniel Ostrowski)", "first_seen": "2021-04-30" }, { "label": "hotel Wi-Fi, Las Vegas NV", "ip": "192.0.2.77", "type": "Hotel network, Las Vegas, NV", "first_seen": "2026-10-05" } ] }, "vendor": { "vendor_id": "V-0042", "legal_name": "Larkspur Sheet Metal Supply, Inc.", "tax_id": "xx-xxx8803", "category": "Sheet metal, ductwork and HVAC fittings distributor", "address": "2290 Fairwood Industrial Pkwy, Columbus, OH 43207", "vendor_since": "2019-09-03", "payment_terms": "Net 30", "usual_rail": "Standard ACH (CCD+), remittance advice emailed", "domain_on_file": "larkspursheetmetal.example.com", "contacts": [ { "name": "Janet Kowalczyk", "role": "Controller", "email": "jkowalczyk@larkspursheetmetal.example.com", "phone": "+1-614-555-0123", "on_file_since": "2019-09-03 (email added 2021-02-10)" }, { "name": "Invoicing", "email": "invoices@larkspursheetmetal.example.com", "on_file_since": "2019-09-03" }, { "name": "Ray Delgado", "role": "Outside sales", "email": "rdelgado@larkspursheetmetal.example.com", "phone": "+1-614-555-0127", "on_file_since": "2022-04-11" }, { "name": "Remittance advices", "email": "ar@larkspursheetmetal.example.com", "on_file_since": "2026-09-15" } ], "bank_accounts": [ { "bank": "Fernhill National Bank, Columbus, OH", "routing": "xxxxx0115", "account": "Business checking x2208", "added": "2019-09-03", "status": "Replaced 2026-09-15", "verification": "Call-back to +1-614-555-0123 on 2019-09-04 by Megan Pruitt; owner name check: match", "payments_received": 169 }, { "bank": "Alder Point Bank, Columbus, OH", "routing": "xxxxx0277", "account": "Business checking x5512", "added": "2026-09-15", "status": "Active", "payments_received": 0 } ], "master_change_log": [ { "ts": "2019-09-03T14:02:55Z", "by": "Megan Pruitt", "change": "Vendor created; bank Fernhill x2208; contact Janet Kowalczyk" }, { "ts": "2021-02-10T16:20:31Z", "by": "Megan Pruitt", "change": "Added email jkowalczyk@larkspursheetmetal.example.com" }, { "ts": "2022-04-11T13:47:09Z", "by": "Megan Pruitt", "change": "Added contact Ray Delgado" }, { "ts": "2023-07-18T15:30:12Z", "by": "Megan Pruitt", "change": "Address 880 Marion Rd to 2290 Fairwood Industrial Pkwy", "verification": "Call-back to +1-614-555-0123; spoke with Janet Kowalczyk", "reviewed_by": "Greg Haskins" }, { "ts": "2026-09-15T14:18:37Z", "by": "Megan Pruitt", "change": "Bank Fernhill x2208 to Alder Point x5512; added remittance email ar@larkspursheetmetal.example.com", "attestation": "Called the vendor at a number on file", "call_note_attached": true, "source_document": "Email of 2026-09-14 13:22 UTC (.eml uploaded)", "reviewed_by": "Greg Haskins, 2026-09-15T17:02:11Z" } ] }, "vendor_payment_history": { "before_period": "2019-09 to 2025-03: 135 payments totaling $1,386,412.55, all by standard ACH to Fernhill x2208, none returned; largest $24,310.00 (2024-05)", "columns": [ "invoice", "po", "invoice_date", "amount_usd", "due", "paid", "rail", "to_account", "created_by", "approved_by" ], "rows": [ [ "LSM-114515", "PO 3920", "2025-03-21", 9594.95, "2025-04-20", "2025-04-16", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-114590", "PO 3940", "2025-04-04", 22234.37, "2025-05-04", "2025-04-30", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-114674", "PO 3960", "2025-04-21", 9566.15, "2025-05-21", "2025-05-21", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-114814", "PO 3977", "2025-05-05", 10706.79, "2025-06-04", "2025-06-04", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-114952", "PO 3992", "2025-05-19", 21080.01, "2025-06-18", "2025-06-18", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-115072", "PO 4001", "2025-06-03", 27900, "2025-07-03", "2025-07-02", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-115194", "PO 4018", "2025-06-17", 22409.93, "2025-07-17", "2025-07-16", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-115332", "PO 4028", "2025-07-03", 21136.85, "2025-08-02", "2025-07-30", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-115462", "PO 4046", "2025-07-18", 20011.07, "2025-08-17", "2025-08-13", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-115567", "PO 4061", "2025-08-04", 18456.36, "2025-09-03", "2025-09-03", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-115689", "PO 4070", "2025-08-18", 18944.7, "2025-09-17", "2025-09-17", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-115785", "PO 4092", "2025-09-02", 7224.28, "2025-10-02", "2025-10-01", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-115917", "PO 4108", "2025-09-17", 17413.49, "2025-10-17", "2025-10-15", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-116048", "PO 4124", "2025-10-03", 7944.39, "2025-11-02", "2025-10-29", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-116123", "PO 4139", "2025-10-20", 8055.12, "2025-11-19", "2025-11-19", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-116233", "PO 4159", "2025-11-06", 12794.14, "2025-12-06", "2025-12-03", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-116331", "PO 4171", "2025-11-18", 7092.06, "2025-12-18", "2025-12-17", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-116403", "PO 4180", "2025-12-01", 9135.12, "2025-12-31", "2025-12-31", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-116532", "PO 4197", "2025-12-15", 6609.89, "2026-01-14", "2026-01-14", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-116621", "PO 4218", "2025-12-29", 12216.07, "2026-01-28", "2026-01-28", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-116722", "PO 4229", "2026-01-12", 11225.36, "2026-02-11", "2026-02-11", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-116841", "PO 4238", "2026-01-26", 6976.65, "2026-02-25", "2026-02-25", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-116959", "PO 4249", "2026-02-12", 10409.74, "2026-03-14", "2026-03-11", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-117099", "PO 4271", "2026-03-02", 13175.61, "2026-04-01", "2026-04-01", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-117206", "PO 4290", "2026-03-18", 5952.81, "2026-04-17", "2026-04-15", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-117342", "PO 4312", "2026-03-31", 5601.27, "2026-04-30", "2026-04-29", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-117481", "PO 4330", "2026-04-17", 15684.58, "2026-05-17", "2026-05-13", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-117569", "PO 4348", "2026-05-01", 13671.74, "2026-05-31", "2026-05-27", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-117671", "PO 4358", "2026-05-18", 18691.36, "2026-06-17", "2026-06-17", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-117750", "PO 4374", "2026-06-03", 11555.75, "2026-07-03", "2026-07-01", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-117827", "PO 4393", "2026-06-18", 19438.92, "2026-07-18", "2026-07-15", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-117907", "PO 4407", "2026-07-06", 20333.78, "2026-08-05", "2026-08-05", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ], [ "LSM-118007", "PO 4422", "2026-07-23", 12731.86, "2026-08-22", "2026-08-19", "ACH", "Fernhill x2208", "Megan Pruitt", "not required" ], [ "LSM-118110", "PO 4441", "2026-08-10", 16851.83, "2026-09-09", "2026-09-09", "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins" ] ] }, "vendor_email_history": { "mailbox": "ap@sandvalemech.example.com, connected to our payables module since 2019-09-03 (inbound mail from the vendor's domain)", "before_period": "2019-09 to 2025-09: 212 messages from larkspursheetmetal.example.com (invoices@, jkowalczyk@, rdelgado@), all SPF, DKIM and DMARC pass, all sent through the vendor's Google Workspace tenant", "columns": [ "received", "from", "subject", "auth_spf_dkim_dmarc", "sent_via", "attachments" ], "rows": [ [ "2025-10-01T11:48:06Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Sep", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2025-10-03T13:37:31Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-116048 (PO 4124)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-116048.pdf" ], [ "2025-10-14T19:52:36Z", "rdelgado@larkspursheetmetal.example.com", "Quote Q-22340", "pass/pass/pass", "Google Workspace (vendor tenant)", "Q-22340.pdf" ], [ "2025-10-20T16:46:11Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-116123 (PO 4139)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-116123.pdf" ], [ "2025-11-03T12:49:04Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Oct", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2025-11-06T18:40:02Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-116233 (PO 4159)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-116233.pdf" ], [ "2025-11-18T17:31:07Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-116331 (PO 4171)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-116331.pdf" ], [ "2025-11-20T18:27:13Z", "rdelgado@larkspursheetmetal.example.com", "Quote Q-22479", "pass/pass/pass", "Google Workspace (vendor tenant)", "Q-22479.pdf" ], [ "2025-12-01T12:04:12Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Nov", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2025-12-01T14:59:18Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-116403 (PO 4180)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-116403.pdf" ], [ "2025-12-15T15:25:38Z", "rdelgado@larkspursheetmetal.example.com", "Holiday hours", "pass/pass/pass", "Google Workspace (vendor tenant)", "none" ], [ "2025-12-15T19:12:26Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-116532 (PO 4197)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-116532.pdf" ], [ "2025-12-29T17:40:39Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-116621 (PO 4218)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-116621.pdf" ], [ "2026-01-02T12:27:23Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Dec", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2026-01-12T15:51:52Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-116722 (PO 4229)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-116722.pdf" ], [ "2026-01-13T14:06:07Z", "jkowalczyk@larkspursheetmetal.example.com", "Updated W-9 for 2026", "pass/pass/pass", "Google Workspace (vendor tenant)", "Larkspur_W9_2026.pdf" ], [ "2026-01-26T16:47:41Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-116841 (PO 4238)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-116841.pdf" ], [ "2026-01-27T17:37:16Z", "rdelgado@larkspursheetmetal.example.com", "Quote Q-22591", "pass/pass/pass", "Google Workspace (vendor tenant)", "Q-22591.pdf" ], [ "2026-02-02T13:57:01Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Jan", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2026-02-12T18:29:42Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-116959 (PO 4249)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-116959.pdf" ], [ "2026-03-02T12:34:14Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Feb", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2026-03-02T18:01:42Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-117099 (PO 4271)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-117099.pdf" ], [ "2026-03-04T16:31:34Z", "rdelgado@larkspursheetmetal.example.com", "Quote Q-22701", "pass/pass/pass", "Google Workspace (vendor tenant)", "Q-22701.pdf" ], [ "2026-03-16T14:55:18Z", "rdelgado@larkspursheetmetal.example.com", "Steel price adjustment effective April 1", "pass/pass/pass", "Google Workspace (vendor tenant)", "Price_Adjustment_Apr2026.pdf" ], [ "2026-03-18T17:49:36Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-117206 (PO 4290)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-117206.pdf" ], [ "2026-03-31T19:50:30Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-117342 (PO 4312)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-117342.pdf" ], [ "2026-04-01T12:34:52Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Mar", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2026-04-15T14:40:43Z", "rdelgado@larkspursheetmetal.example.com", "Quote Q-22793", "pass/pass/pass", "Google Workspace (vendor tenant)", "Q-22793.pdf" ], [ "2026-04-17T18:50:05Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-117481 (PO 4330)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-117481.pdf" ], [ "2026-05-01T12:43:44Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Apr", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2026-05-01T13:55:02Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-117569 (PO 4348)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-117569.pdf" ], [ "2026-05-18T14:22:27Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-117671 (PO 4358)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-117671.pdf" ], [ "2026-05-28T18:49:58Z", "rdelgado@larkspursheetmetal.example.com", "Quote Q-22911", "pass/pass/pass", "Google Workspace (vendor tenant)", "Q-22911.pdf" ], [ "2026-06-01T11:12:03Z", "invoices@larkspursheetmetal.example.com", "Statement of account - May", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2026-06-03T17:57:04Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-117750 (PO 4374)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-117750.pdf" ], [ "2026-06-18T14:52:58Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-117827 (PO 4393)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-117827.pdf" ], [ "2026-07-01T12:34:59Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Jun", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2026-07-06T17:07:16Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-117907 (PO 4407)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-117907.pdf" ], [ "2026-07-09T19:17:07Z", "rdelgado@larkspursheetmetal.example.com", "Quote Q-23043", "pass/pass/pass", "Google Workspace (vendor tenant)", "Q-23043.pdf" ], [ "2026-07-23T13:45:37Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-118007 (PO 4422)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-118007.pdf" ], [ "2026-08-03T12:04:49Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Jul", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2026-08-06T19:27:58Z", "rdelgado@larkspursheetmetal.example.com", "Quote Q-23151", "pass/pass/pass", "Google Workspace (vendor tenant)", "Q-23151.pdf" ], [ "2026-08-10T17:23:46Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-118110 (PO 4441)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-118110.pdf" ], [ "2026-09-01T11:25:29Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Aug", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ], [ "2026-09-08T15:44:26Z", "invoices@larkspursheetmetal.example.com", "Invoice LSM-118204 (PO 4471)", "pass/pass/pass", "Google Workspace (vendor tenant)", "LSM-118204.pdf" ], [ "2026-09-14T13:22:07Z", "ar@larkspursheetmetal.example.com", "Larkspur Sheet Metal Supply - New banking information effective October 1", "pass/pass/pass", "Google Workspace (vendor tenant)", "Larkspur_Banking_Change_Letter.pdf; AlderPoint_Account_Verification_Letter.pdf; Larkspur_W9_2026.pdf" ], [ "2026-10-01T12:10:55Z", "invoices@larkspursheetmetal.example.com", "Statement of account - Sep", "pass/pass/pass", "Google Workspace (vendor tenant)", "Statement.pdf" ] ] }, "payables_last_60_days": { "period": "2026-08-11 to 2026-10-06", "note": "Payments created in our payables module from operating account x3381, excluding the payment under review. Payment runs are created on Tuesdays for Wednesday settlement.", "columns": [ "created", "payee", "reference", "amount_usd", "rail", "to_account", "created_by", "approved", "status" ], "rows": [ [ "2026-08-11", "Brightwater Fleet Fuel", "Fuel stmt 7703", 2497.52, "ACH", "x4416", "Megan Pruitt", "not required", "settled" ], [ "2026-08-11", "Coldline Refrigerant Supply", "CRS-1189", 5429.33, "ACH", "x7052", "Megan Pruitt", "not required", "settled" ], [ "2026-08-11", "Delmar Insulation LLC", "Draw 341", 8485.16, "ACH", "x2398", "Megan Pruitt", "not required", "settled" ], [ "2026-08-11", "Grantley Pipe & Valve", "GPV248138", 3018.36, "ACH", "x6107", "Megan Pruitt", "not required", "settled" ], [ "2026-08-11", "Heron Electrical Supply", "HES-90118", 1801.73, "ACH", "x3385", "Megan Pruitt", "not required", "settled" ], [ "2026-08-11", "Prism Uniform Service", "PUS-55311", 308.83, "ACH", "x5873", "Megan Pruitt", "not required", "settled" ], [ "2026-08-18", "Brightwater Fleet Fuel", "Fuel stmt 7704", 3759.51, "ACH", "x4416", "Megan Pruitt", "not required", "settled" ], [ "2026-08-18", "Delmar Insulation LLC", "Draw 343", 15036.69, "ACH", "x2398", "Megan Pruitt", "Greg Haskins 2026-08-19", "settled" ], [ "2026-08-18", "Grantley Pipe & Valve", "GPV248145", 5093.44, "ACH", "x6107", "Megan Pruitt", "not required", "settled" ], [ "2026-08-18", "Larkspur Sheet Metal Supply, Inc.", "LSM-118007 (PO 4422)", 12731.86, "ACH", "Fernhill x2208", "Megan Pruitt", "not required", "settled" ], [ "2026-08-18", "Prism Uniform Service", "PUS-55312", 320.6, "ACH", "x5873", "Megan Pruitt", "not required", "settled" ], [ "2026-08-18", "Tallgrass Equipment Rental", "TER-30445", 2135.42, "ACH", "x9920", "Megan Pruitt", "not required", "settled" ], [ "2026-08-25", "Brightwater Fleet Fuel", "Fuel stmt 7705", 3421.99, "ACH", "x4416", "Megan Pruitt", "not required", "settled" ], [ "2026-08-25", "Coldline Refrigerant Supply", "CRS-1190", 3106.85, "ACH", "x7052", "Megan Pruitt", "not required", "settled" ], [ "2026-08-25", "Grantley Pipe & Valve", "GPV248156", 7803.87, "ACH", "x6107", "Megan Pruitt", "not required", "settled" ], [ "2026-08-25", "Heron Electrical Supply", "HES-90127", 3711.75, "ACH", "x3385", "Megan Pruitt", "not required", "settled" ], [ "2026-08-25", "Prism Uniform Service", "PUS-55313", 311.03, "ACH", "x5873", "Megan Pruitt", "not required", "settled" ], [ "2026-08-25", "Sandvale Properties LLC", "Rent Sep - shop and yard", 18500, "ACH", "x2741", "Megan Pruitt", "Greg Haskins 2026-08-25", "settled" ], [ "2026-09-01", "Brightwater Fleet Fuel", "Fuel stmt 7706", 3281.06, "ACH", "x4416", "Megan Pruitt", "not required", "settled" ], [ "2026-09-01", "Grantley Pipe & Valve", "GPV248161", 9205.54, "ACH", "x6107", "Megan Pruitt", "not required", "settled" ], [ "2026-09-01", "Northbank Crane Service", "NCS-5122", 3759.16, "ACH", "x6634", "Megan Pruitt", "not required", "settled" ], [ "2026-09-01", "Prism Uniform Service", "PUS-55314", 300.18, "ACH", "x5873", "Megan Pruitt", "not required", "settled" ], [ "2026-09-01", "Tallgrass Equipment Rental", "TER-30450", 2967.57, "ACH", "x9920", "Megan Pruitt", "not required", "settled" ], [ "2026-09-01", "Westbury Insurance Agency", "Premium Sep (GL, auto, umbrella)", 9842.17, "ACH", "x1180", "Megan Pruitt", "not required", "settled" ], [ "2026-09-08", "Brightwater Fleet Fuel", "Fuel stmt 7707", 3420.73, "ACH", "x4416", "Megan Pruitt", "not required", "settled" ], [ "2026-09-08", "Coldline Refrigerant Supply", "CRS-1193", 1779.66, "ACH", "x7052", "Megan Pruitt", "not required", "settled" ], [ "2026-09-08", "Delmar Insulation LLC", "Draw 345", 14398.88, "ACH", "x2398", "Megan Pruitt", "not required", "settled" ], [ "2026-09-08", "Grantley Pipe & Valve", "GPV248168", 9704.84, "ACH", "x6107", "Megan Pruitt", "not required", "settled" ], [ "2026-09-08", "Heron Electrical Supply", "HES-90134", 3208.96, "ACH", "x3385", "Megan Pruitt", "not required", "settled" ], [ "2026-09-08", "Larkspur Sheet Metal Supply, Inc.", "LSM-118110 (PO 4441)", 16851.83, "ACH", "Fernhill x2208", "Megan Pruitt", "Greg Haskins 2026-09-09", "settled" ], [ "2026-09-08", "Prism Uniform Service", "PUS-55315", 296.07, "ACH", "x5873", "Megan Pruitt", "not required", "settled" ], [ "2026-09-15", "Brightwater Fleet Fuel", "Fuel stmt 7708", 3478.39, "ACH", "x4416", "Megan Pruitt", "not required", "settled" ], [ "2026-09-15", "Grantley Pipe & Valve", "GPV248172", 8633.12, "ACH", "x6107", "Megan Pruitt", "not required", "settled" ], [ "2026-09-15", "Northbank Crane Service", "NCS-5125", 4088.39, "ACH", "x6634", "Megan Pruitt", "not required", "settled" ], [ "2026-09-15", "Prism Uniform Service", "PUS-55316", 306.57, "ACH", "x5873", "Megan Pruitt", "not required", "settled" ], [ "2026-09-15", "Tallgrass Equipment Rental", "TER-30452", 1557.81, "ACH", "x9920", "Megan Pruitt", "not required", "settled" ], [ "2026-09-22", "Brightwater Fleet Fuel", "Fuel stmt 7709", 2512.99, "ACH", "x4416", "Megan Pruitt", "not required", "settled" ], [ "2026-09-22", "Coldline Refrigerant Supply", "CRS-1196", 6570.63, "ACH", "x7052", "Megan Pruitt", "not required", "settled" ], [ "2026-09-22", "Delmar Insulation LLC", "Draw 346", 9950.18, "ACH", "x2398", "Megan Pruitt", "not required", "settled" ], [ "2026-09-22", "Grantley Pipe & Valve", "GPV248176", 4004.08, "ACH", "x6107", "Megan Pruitt", "not required", "settled" ], [ "2026-09-22", "Haldane Mechanical Equipment", "Equipment PO 4490 (sheet-metal brake)", 64300, "Wire", "x8027", "Megan Pruitt", "Greg Haskins and Daniel Ostrowski 2026-09-22", "sent 2026-09-22" ], [ "2026-09-22", "Heron Electrical Supply", "HES-90138", 2445.61, "ACH", "x3385", "Megan Pruitt", "not required", "settled" ], [ "2026-09-22", "Prism Uniform Service", "PUS-55317", 323.55, "ACH", "x5873", "Megan Pruitt", "not required", "settled" ], [ "2026-09-29", "Brightwater Fleet Fuel", "Fuel stmt 7710", 2811.73, "ACH", "x4416", "Megan Pruitt", "not required", "settled" ], [ "2026-09-29", "Grantley Pipe & Valve", "GPV248187", 3443.64, "ACH", "x6107", "Megan Pruitt", "not required", "settled" ], [ "2026-09-29", "Prism Uniform Service", "PUS-55318", 331.68, "ACH", "x5873", "Megan Pruitt", "not required", "settled" ], [ "2026-09-29", "Sandvale Properties LLC", "Rent Oct - shop and yard", 18500, "ACH", "x2741", "Megan Pruitt", "Greg Haskins 2026-09-29", "settled" ], [ "2026-09-29", "Tallgrass Equipment Rental", "TER-30455", 2504.21, "ACH", "x9920", "Megan Pruitt", "not required", "settled" ], [ "2026-10-06", "Brightwater Fleet Fuel", "Fuel stmt 7711", 2668.93, "ACH", "x4416", "Megan Pruitt", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Coldline Refrigerant Supply", "CRS-1198", 2916.67, "ACH", "x7052", "Megan Pruitt", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Grantley Pipe & Valve", "GPV248195", 4143.84, "ACH", "x6107", "Megan Pruitt", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Heron Electrical Supply", "HES-90143", 4034.32, "ACH", "x3385", "Megan Pruitt", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Prism Uniform Service", "PUS-55319", 327.54, "ACH", "x5873", "Megan Pruitt", "not required", "scheduled 2026-10-07" ], [ "2026-10-06", "Westbury Insurance Agency", "Premium Oct (GL, auto, umbrella)", 9842.17, "ACH", "x1180", "Megan Pruitt", "not required", "scheduled 2026-10-07" ] ] }, "online_banking_sessions": { "period": "2026-08-22 to 2026-10-06", "note": "One row per sign-in", "columns": [ "start", "user", "device", "network", "sign_in", "minutes", "activity" ], "rows": [ [ "2026-08-24T12:14:36Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 40, "entered 3 bills" ], [ "2026-08-25T13:41:22Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 16, "downloaded statements" ], [ "2026-08-25T14:15:18Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 55, "entered 8 bills; created 6 payments ($36,855.49)" ], [ "2026-08-25T20:47:43Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 6, "approved 1 payment ($18,500.00)" ], [ "2026-08-26T13:10:11Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 21, "ran cash forecast" ], [ "2026-08-28T13:40:21Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 9, "entered 5 bills; 3-way matched 2 receipts" ], [ "2026-08-28T14:32:56Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 17, "viewed balances" ], [ "2026-09-01T12:30:09Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 15, "ran cash forecast" ], [ "2026-09-01T13:32:21Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 49, "entered 7 bills; created 6 payments ($29,355.68)" ], [ "2026-09-02T11:14:09Z", "Megan Pruitt", "d-5a07", "Columbus office", "password failed x2, then password + push", 31, "entered 6 bills" ], [ "2026-09-05T15:02:34Z", "Daniel Ostrowski", "d-77aa", "home, Upper Arlington OH", "password + push", 4, "viewed balances and statements" ], [ "2026-09-08T13:44:40Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 40, "entered 8 bills; created 7 payments ($49,660.97)" ], [ "2026-09-09T00:47:21Z", "Greg Haskins", "d-1f62", "home, Dublin OH", "Face ID (mobile app)", 3, "approved 1 payment ($16,851.83)" ], [ "2026-09-09T11:27:35Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 20, "entered 8 bills" ], [ "2026-09-10T15:21:05Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 5, "ran cash forecast" ], [ "2026-09-11T14:13:28Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 14, "drew $0 / viewed line of credit" ], [ "2026-09-11T14:33:40Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 40, "entered 4 bills" ], [ "2026-09-14T11:24:21Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 19, "entered 10 bills" ], [ "2026-09-15T12:12:22Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 19, "viewed balances" ], [ "2026-09-15T14:01:12Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 24, "edited vendor V-0042 (bank details, remittance email); attached call note and source email" ], [ "2026-09-15T16:58:30Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 7, "reviewed and approved vendor change V-0042" ], [ "2026-09-16T12:10:10Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 28, "entered 9 bills" ], [ "2026-09-17T14:08:16Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 36, "entered 8 bills" ], [ "2026-09-18T11:32:13Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 39, "entered 2 bills" ], [ "2026-09-21T14:12:50Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 35, "entered 10 bills" ], [ "2026-09-22T13:59:06Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 17, "drew $0 / viewed line of credit" ], [ "2026-09-22T14:01:51Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 32, "entered 8 bills; created 6 payments ($25,807.04)" ], [ "2026-09-22T15:12:47Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 6, "approved wire $64,300.00 (first approver)" ], [ "2026-09-22T15:40:05Z", "Daniel Ostrowski", "d-77aa", "Columbus office", "password + push", 4, "approved wire $64,300.00 (second approver)" ], [ "2026-09-23T12:27:02Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 23, "entered 6 bills" ], [ "2026-09-23T13:02:46Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 8, "ran cash forecast" ], [ "2026-09-24T13:56:12Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 39, "entered 9 bills; 3-way matched 2 receipts" ], [ "2026-09-24T15:11:33Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 7, "ran cash forecast" ], [ "2026-09-28T13:53:18Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 34, "entered 11 bills; 3-way matched 2 receipts" ], [ "2026-09-29T14:29:02Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 34, "entered 3 bills; created 5 payments ($27,591.26)" ], [ "2026-09-29T23:50:33Z", "Greg Haskins", "d-1f62", "home, Dublin OH", "Face ID (mobile app)", 9, "approved 1 payment ($18,500.00)" ], [ "2026-09-30T14:01:26Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 8, "entered 8 bills; 3-way matched 2 receipts" ], [ "2026-10-01T13:06:55Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 17, "entered 2 bills" ], [ "2026-10-02T12:04:28Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 39, "entered 7 bills" ], [ "2026-10-02T15:13:18Z", "Greg Haskins", "d-c3e9", "Columbus office", "password + push", 20, "drew $0 / viewed line of credit" ], [ "2026-10-03T15:32:42Z", "Daniel Ostrowski", "d-77aa", "home, Upper Arlington OH", "password + push", 4, "viewed balances and statements" ], [ "2026-10-03T15:40:12Z", "Greg Haskins", "d-8d4b", "home, Dublin OH", "new device: one-time code to mobile number on file (unchanged since 2019) + Face ID", 6, "registered new iPhone d-8d4b; removed old iPhone d-1f62; viewed balances" ], [ "2026-10-04T13:15:38Z", "Greg Haskins", "d-8d4b", "home, Dublin OH", "Face ID (mobile app)", 3, "viewed balances" ], [ "2026-10-05T12:15:35Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 35, "entered 6 bills" ], [ "2026-10-05T23:10:21Z", "Greg Haskins", "d-8d4b", "hotel Wi-Fi, Las Vegas NV", "Face ID (mobile app)", 4, "viewed balances" ], [ "2026-10-06T13:58:41Z", "Megan Pruitt", "d-5a07", "Columbus office", "password + push", 50, "entered 3 bills; created 7 payments ($62,548.87)" ], [ "2026-10-06T22:44:02Z", "Greg Haskins", "d-8d4b", "hotel Wi-Fi, Las Vegas NV", "Face ID (mobile app)", 6, "approved 1 payment ($38,615.40)" ] ] }, "invoice": { "number": "LSM-118204", "po": "PO 4471, Riverside Commons rooftop unit replacement, ductwork package", "invoice_date": "2026-09-08", "received": "2026-09-08T15:44:26Z", "from": "invoices@larkspursheetmetal.example.com", "amount_usd": 38615.4, "due": "2026-10-08", "three_way_match": "Matched: PO 4471 created 2026-08-12 by Greg Haskins for $38,615.40 (Larkspur quote Q-22871 attached); delivery to the Riverside Commons jobsite received 2026-09-03, logged by Megan Pruitt 2026-09-04", "remit_to_printed_on_invoice": "Fernhill National Bank, account ending 2208 (invoice issued before the change)", "remit_to_printed_on_statement_2026_10_01": "Alder Point Bank, account ending 5512" }, "bank_change_request": { "received": "2026-09-14T13:22:07Z", "channel": "Email to the customer's AP mailbox (new thread)", "headers": { "From": "\"Janet Kowalczyk\" ", "Reply-To": "", "To": "undisclosed-recipients:;", "Cc": "", "Subject": "Larkspur Sheet Metal Supply - New banking information effective October 1", "Date": "Mon, 14 Sep 2026 09:22:01 -0400", "Message-ID": "", "Return-Path": "", "Received": "from mail-relay (198.51.100.140, Google Workspace) by our mail gateway; Mon, 14 Sep 2026 13:22:07 +0000", "Authentication-Results": "spf=pass smtp.mailfrom=larkspursheetmetal.example.com; dkim=pass header.d=larkspursheetmetal.example.com; dmarc=pass (p=reject) header.from=larkspursheetmetal.example.com" }, "gateway_analysis": { "sender_domain": "larkspursheetmetal.example.com (the vendor's domain on file)", "sender_domain_registered": "2011-05-02", "sender_address": "ar@ had not written to this customer before; the vendor's other addresses have since 2019", "sending_infrastructure": "Same Google Workspace tenant as all 257 earlier messages from the vendor", "display_name": "Matches the vendor contact on file (Janet Kowalczyk)", "thread": "New thread; sent to undisclosed recipients (a notice to many customers)" }, "body": "Dear valued customer,\n\nLarkspur Sheet Metal Supply has moved its banking relationship to Alder Point Bank here in Columbus. Beginning October 1, 2026, please send ACH payments to the account shown on the attached letter. Our account at Fernhill National Bank will stay open through December 31, 2026, so payments sent there in the meantime will still reach us.\n\nTo protect both of us, please confirm these details by calling our office at the number you already have on file for us. We will never ask you to change banking information by email alone. Remittance advices can now go to ar@larkspursheetmetal.example.com.\n\nThank you for your business,\nJanet Kowalczyk\nController, Larkspur Sheet Metal Supply, Inc.\n2290 Fairwood Industrial Pkwy, Columbus, OH 43207\n614-555-0123", "attachments": [ { "name": "Larkspur_Banking_Change_Letter.pdf", "pages": 1, "pdf_producer": "Adobe Acrobat Pro", "pdf_created": "2026-09-11T18:32:10Z", "content": "Letter on Larkspur letterhead dated September 11, 2026, signed by Janet Kowalczyk (Controller) and Carl Bremer (President): new bank Alder Point Bank, Columbus, OH, routing ending 0277, account ending 5512, account name Larkspur Sheet Metal Supply, Inc.; old account open through December 31, 2026" }, { "name": "AlderPoint_Account_Verification_Letter.pdf", "pages": 1, "pdf_producer": "Adobe Acrobat Pro", "pdf_created": "2026-09-10T14:05:44Z", "content": "Letter on Alder Point Bank letterhead signed by a relationship manager, confirming business checking ending 5512 titled Larkspur Sheet Metal Supply, Inc., opened 2026-08-27" }, { "name": "Larkspur_W9_2026.pdf", "pages": 1, "content": "W-9, tax ID unchanged (xx-xxx8803)" } ] }, "verification_and_changes": [ { "ts": "2026-09-15T14:05:22Z", "type": "phone_call", "by": "Megan Pruitt", "number_dialed": "+1-614-555-0123", "number_source": "Vendor record, on file since 2019-09-03; the same number Megan called for the 2023-07-18 address change", "duration": "6 min 40 s", "note": "Spoke with Janet Kowalczyk. Read back Alder Point routing ending 0277 and account ending 5512 from the letter; Janet confirmed both. Fernhill stays open through 12/31. Confirmed ar@ is their new remittance mailbox." }, { "ts": "2026-09-15T14:18:37Z", "type": "vendor_bank_details_changed", "by": "Megan Pruitt", "device": "d-5a07", "network": "Columbus office", "attestation": "Called the vendor at a number on file; call note attached" }, { "ts": "2026-09-15T14:19:30Z", "type": "ach_prenote_sent", "to": "Alder Point x5512", "detail": "Zero-dollar prenotification, settling 2026-09-16" }, { "ts": "2026-09-15T17:02:11Z", "type": "vendor_change_reviewed", "by": "Greg Haskins", "device": "d-c3e9", "network": "Columbus office", "result": "Approved" }, { "ts": "2026-09-18T21:00:00Z", "type": "ach_prenote_result", "detail": "No return and no notification of change received" } ], "account_validation": { "checked_at": "2026-09-15T14:18:52Z", "service": "Account validation network (bank-reported account data)", "account": "Alder Point Bank, routing ending 0277, account x5512", "account_status": "Open, valid", "can_receive_ach_credits": true, "owner_name_checked": "Larkspur Sheet Metal Supply, Inc.", "owner_name_result": "Match", "routing_directory": "Alder Point Bank, Columbus, OH" }, "vendor_network": { "matched_on": "Vendor tax ID xx-xxx8803", "other_customers_paying_vendor": 4, "bank_changes_at_other_customers": "3 of 4 changed to Alder Point x5512 (2026-09-15, 2026-09-17 and 2026-09-22), each recording a call-back to a vendor phone number already on their vendor record", "payments_to_new_account": "2 payments from those customers to Alder Point x5512 (2026-09-25 $7,412.80; 2026-10-02 $15,060.00), both settled, none returned", "fourth_customer": "Still pays Fernhill x2208; last payment 2026-09-29, settled", "new_account_elsewhere": "Alder Point x5512 is not on file for any other vendor" }, "payment_under_review": { "payment_id": "PMT-0310558", "invoice": "LSM-118204 (PO 4471)", "amount_usd": 38615.4, "rail": "Standard ACH (CCD+)", "effective_date": "2026-10-07", "destination": "Alder Point Bank x5512", "remittance_advice_to": "ar@larkspursheetmetal.example.com", "created": { "ts": "2026-10-06T14:10:33Z", "by": "Megan Pruitt", "device": "d-5a07", "network": "Columbus office" }, "approved": { "ts": "2026-10-06T22:47:15Z", "by": "Greg Haskins", "device": "d-8d4b", "network": "hotel Wi-Fi, Las Vegas NV", "sign_in": "Face ID (mobile app)" } } }, "questions": { "bec_likelihood": { "type": "score", "instructions": "How likely is it that the change to the vendor's bank details is fraudulent, that is, requested by someone impersonating the vendor or made through a compromised email account or login, rather than requested by the vendor?", "criteria": [ "Very unlikely (under 10%)", "Unlikely (10-40%)", "Uncertain (40-60%)", "Likely (60-90%)", "Very likely (over 90%)" ] }, "verified_out_of_band": { "type": "noul", "instructions": "Has the vendor confirmed the new bank details through a channel the requester could not control, such as a call to a phone number that was on file before the change was requested?" }, "action": { "type": "choice", "instructions": "What should happen to the vendor payment under review?", "criteria": { "release": "Release the payment to the new bank account", "hold_and_verify": "Hold the payment until the vendor confirms the new bank details on a call to a phone number that was on file before the change", "block_and_alert": "Cancel the payment, restore the vendor's previous verified bank details and alert the customer to suspected business email compromise" } } } }