{
  "model": "grayson-1",
  "state": {
    "case": {
      "case_id": "DW-26-001203",
      "opened": "2026-10-08T14:22:40Z",
      "queue": "Dark web alerts",
      "records_as_of": "2026-10-08T14:45:00Z"
    },
    "customer": {
      "customer_id": "cus_52208",
      "name": "Marcus Okafor",
      "age": 41,
      "home": "Columbus, OH",
      "customer_since": "2016-04-02",
      "occupation_on_file": "Registered nurse",
      "online_banking_username": "mokafor_614",
      "online_banking_since": "2016-04-02",
      "accounts": [
        {
          "account": "checking x5520",
          "opened": "2016-04-02",
          "status": "open",
          "balance_usd": 8972.45
        },
        {
          "account": "savings x7713",
          "opened": "2018-09-14",
          "status": "open",
          "balance_usd": 10190.41
        }
      ],
      "debit_card": {
        "card": "x3861",
        "on_account": "checking x5520",
        "issued": "2024-06-20",
        "expires": "06/28",
        "status": "active",
        "wallets": "none"
      },
      "phone_on_file": {
        "number": "(614) 555-0172",
        "line_type": "mobile",
        "last_changed": "2016-04-02",
        "carrier_sim_change_check": "No SIM change or port-out in 90 days (checked 2026-10-08T14:31Z)"
      },
      "email_on_file": {
        "address": "marcus.okafor@example.net",
        "last_changed": "2016-04-02"
      },
      "address_last_changed": "2022-06-30",
      "alert_settings": "Email alerts for sign-ins from new devices (turned on 2026-10-01 during a call); statement-ready emails",
      "travel_notices": "none in 12 months",
      "usual_sign_in_addresses": "203.0.113.77 (home cable ISP, Columbus OH, since 2022) for both devices; 198.51.100.140 (another Columbus cable address, first seen 2025-11, about monthly) for the laptop; mobile carrier addresses for the app"
    },
    "sign_in_security": "Online banking uses a username and password. A device becomes trusted after a one-time code sent by SMS to the phone on file, if the customer ticks 'remember this device'; a trusted device (a token stored in a browser cookie) skips the code at sign-in. The mobile app signs in with Face ID or fingerprint after its first code. Codes are also required to add a Zelle recipient or an external transfer account, to change the phone, email or address on file, and to raise transfer limits. Bill-pay payees paid by mailed check, alert settings and statement preferences change without a code. 'Forgot password' emails a reset link to the email on file; a code is required after the reset unless the device is trusted. Changing the password does not end other sessions or remove trusted devices. A sign-in from a new country triggers an SMS 'Was this you?' check. By phone, contact-detail changes need a code to the phone on file or photo ID in a branch.",
    "devices": {
      "columns": [
        "device_id",
        "device",
        "first_seen",
        "trusted_since",
        "status",
        "last_seen"
      ],
      "rows": [
        [
          "dv_2d10",
          "Pixel 6 · app",
          "2021-12-26",
          "2021-12-26",
          "removed 2024-11-03 (phone replaced)",
          "2024-11-02"
        ],
        [
          "dv_7c22",
          "Windows 11 · Chrome (laptop LAPTOP-MO4K21)",
          "2024-01-12",
          "2024-01-12",
          "trusted",
          "2026-10-08"
        ],
        [
          "dv_4e8b",
          "Pixel 8 · app",
          "2024-11-03",
          "2024-11-03",
          "trusted",
          "2026-10-08"
        ]
      ]
    },
    "credential_and_contact_changes": {
      "columns": [
        "ts",
        "change",
        "channel",
        "device_id",
        "ip",
        "verification"
      ],
      "rows": [
        [
          "2016-04-02T16:00:00Z",
          "Online banking enrolled",
          "branch",
          "",
          "",
          "photo ID"
        ],
        [
          "2021-12-26T20:14:09Z",
          "Device trusted: dv_2d10 (app)",
          "app",
          "dv_2d10",
          "",
          "SMS code"
        ],
        [
          "2022-06-30T15:30:00Z",
          "Address on file changed (bought condo)",
          "branch",
          "",
          "",
          "photo ID"
        ],
        [
          "2024-01-12T02:41:27Z",
          "Device trusted: dv_7c22",
          "web",
          "dv_7c22",
          "203.0.113.77",
          "SMS code"
        ],
        [
          "2024-11-03T21:09:55Z",
          "Device trusted: dv_4e8b (app); dv_2d10 removed by customer",
          "app",
          "dv_4e8b",
          "203.0.113.77",
          "SMS code"
        ],
        [
          "2025-03-02T03:18:44Z",
          "Password changed",
          "web",
          "dv_7c22",
          "203.0.113.77",
          "current password"
        ],
        [
          "2026-10-01T22:58:12Z",
          "Password changed (during contact-center call)",
          "web",
          "dv_7c22",
          "203.0.113.77",
          "current password"
        ],
        [
          "2026-10-01T23:02:30Z",
          "Alert settings: new-device sign-in email alerts turned on (agent-assisted)",
          "staff",
          "",
          "",
          "SMS code on the call"
        ]
      ]
    },
    "payees": {
      "columns": [
        "payee",
        "type",
        "added",
        "added_from",
        "verification",
        "payments_last_90_days",
        "last_paid"
      ],
      "rows": [
        [
          "AEP Ohio",
          "bill pay",
          "2022-07-05",
          "web",
          "none required",
          3,
          "2026-09-09"
        ],
        [
          "Tasha Okafor",
          "Zelle",
          "2021-03-14",
          "app",
          "SMS code",
          3,
          "2026-09-21"
        ],
        [
          "Dre Whitaker",
          "Zelle",
          "2023-07-02",
          "app",
          "SMS code",
          0,
          "2025-12-19"
        ]
      ]
    },
    "sign_in_history": {
      "period": "2026-07-10 to 2026-10-08T14:45Z, all channels",
      "columns": [
        "ts",
        "device_id",
        "ip",
        "ip_info",
        "method",
        "fingerprint",
        "result",
        "minutes",
        "activity"
      ],
      "rows": [
        [
          "2026-07-12T02:42:19Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "card controls viewed"
        ],
        [
          "2026-07-12T11:49:55Z",
          "dv_4e8b",
          "192.0.2.71",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-07-13T19:06:59Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-07-16T01:54:22Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-07-17T11:36:43Z",
          "dv_4e8b",
          "192.0.2.241",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-07-18T01:11:37Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-07-18T23:13:08Z",
          "dv_4e8b",
          "192.0.2.133",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-07-20T18:30:23Z",
          "dv_4e8b",
          "192.0.2.190",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-07-21T11:49:17Z",
          "dv_4e8b",
          "192.0.2.190",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-07-21T18:02:10Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          4,
          "Zelle to Tasha Okafor $150.00"
        ],
        [
          "2026-07-23T00:41:08Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-07-23T23:45:50Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          4,
          "balances; transactions"
        ],
        [
          "2026-07-24T23:24:15Z",
          "dv_4e8b",
          "192.0.2.177",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "card controls viewed"
        ],
        [
          "2026-07-26T11:50:17Z",
          "dv_4e8b",
          "192.0.2.71",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-07-26T21:03:07Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          9,
          "balances; transactions"
        ],
        [
          "2026-07-27T17:11:43Z",
          "dv_4e8b",
          "192.0.2.71",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-07-28T21:03:34Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-07-30T11:36:15Z",
          "dv_4e8b",
          "192.0.2.177",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-01T18:27:02Z",
          "dv_4e8b",
          "192.0.2.177",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "card controls viewed"
        ],
        [
          "2026-08-02T23:11:47Z",
          "dv_4e8b",
          "192.0.2.71",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-03T16:31:05Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          3,
          "statements: July statement downloaded"
        ],
        [
          "2026-08-04T11:37:18Z",
          "dv_4e8b",
          "192.0.2.133",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "transactions"
        ],
        [
          "2026-08-05T11:53:02Z",
          "dv_4e8b",
          "192.0.2.177",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-07T20:18:53Z",
          "dv_7c22",
          "198.51.100.140",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          14,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-08-08T00:56:50Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "card controls viewed"
        ],
        [
          "2026-08-09T00:34:04Z",
          "dv_4e8b",
          "192.0.2.241",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-08-09T20:49:44Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          8,
          "statements"
        ],
        [
          "2026-08-09T23:43:28Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "transactions"
        ],
        [
          "2026-08-10T19:56:39Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "card controls viewed"
        ],
        [
          "2026-08-11T18:47:54Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-08-13T11:46:20Z",
          "dv_4e8b",
          "192.0.2.177",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-14T11:45:40Z",
          "dv_4e8b",
          "192.0.2.102",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-16T02:48:30Z",
          "dv_7c22",
          "198.51.100.9",
          "Hotel Wi-Fi, Cincinnati OH",
          "password + trusted device",
          "match",
          "success",
          3,
          "balances; transactions"
        ],
        [
          "2026-08-17T00:17:19Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          11,
          "balances; transactions"
        ],
        [
          "2026-08-18T11:41:25Z",
          "dv_4e8b",
          "192.0.2.133",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-18T22:18:47Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-08-19T11:52:47Z",
          "dv_4e8b",
          "192.0.2.133",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-08-19T22:08:43Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "transactions"
        ],
        [
          "2026-08-20T19:54:58Z",
          "dv_7c22",
          "198.51.100.140",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances; transactions"
        ],
        [
          "2026-08-21T17:56:39Z",
          "dv_7c22",
          "198.51.100.140",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          4,
          "balances; transactions"
        ],
        [
          "2026-08-23T11:38:05Z",
          "dv_4e8b",
          "192.0.2.84",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-08-24T19:40:02Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          8,
          "Zelle to Tasha Okafor $150.00"
        ],
        [
          "2026-08-24T20:58:23Z",
          "dv_4e8b",
          "192.0.2.84",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-27T11:36:10Z",
          "dv_4e8b",
          "192.0.2.102",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-08-28T11:55:08Z",
          "dv_4e8b",
          "192.0.2.84",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-29T19:55:04Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances; transactions"
        ],
        [
          "2026-08-30T22:06:54Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-01T11:54:58Z",
          "dv_4e8b",
          "192.0.2.71",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-09-02T11:59:56Z",
          "dv_4e8b",
          "192.0.2.102",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-09-03T11:45:47Z",
          "dv_4e8b",
          "192.0.2.190",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-09-05T02:35:54Z",
          "dv_7c22",
          "198.51.100.140",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          7,
          "balances; transactions"
        ],
        [
          "2026-09-07T00:57:50Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          13,
          "transactions"
        ],
        [
          "2026-09-08T16:04:30Z",
          "dv_7c22",
          "198.51.100.140",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-09-08T21:18:32Z",
          "dv_4e8b",
          "192.0.2.133",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-09-10T11:40:23Z",
          "dv_4e8b",
          "192.0.2.84",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-11T11:53:18Z",
          "dv_4e8b",
          "192.0.2.177",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-09-11T20:54:13Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          6,
          "transactions"
        ],
        [
          "2026-09-12T01:00:14Z",
          "dv_4e8b",
          "192.0.2.133",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-13T01:39:52Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          13,
          "transactions"
        ],
        [
          "2026-09-13T20:20:08Z",
          "dv_7c22",
          "198.51.100.140",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          7,
          "balances; transactions"
        ],
        [
          "2026-09-15T03:28:35Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "card controls viewed"
        ],
        [
          "2026-09-15T11:37:42Z",
          "dv_4e8b",
          "192.0.2.102",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-09-16T11:35:05Z",
          "dv_4e8b",
          "192.0.2.71",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-20T11:48:30Z",
          "dv_4e8b",
          "192.0.2.190",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "transactions"
        ],
        [
          "2026-09-21T02:46:29Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          6,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-09-21T17:55:47Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          7,
          "Zelle to Tasha Okafor $150.00"
        ],
        [
          "2026-09-22T00:47:43Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          11,
          "statements"
        ],
        [
          "2026-09-23T02:37:32Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-24T00:28:43Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-24T11:42:08Z",
          "dv_4e8b",
          "192.0.2.84",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-09-25T11:38:12Z",
          "dv_4e8b",
          "192.0.2.102",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-09-26T03:36:41Z",
          "dv_4e8b",
          "192.0.2.133",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-09-28T03:33:28Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-29T11:55:27Z",
          "dv_4e8b",
          "192.0.2.133",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-09-30T01:51:51Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances"
        ],
        [
          "2026-09-30T19:07:55Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-10-01T11:40:02Z",
          "dv_4e8b",
          "192.0.2.133",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-10-01T22:55:12Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          9,
          "balances; transactions; password changed"
        ],
        [
          "2026-10-02T23:40:00Z",
          "dv_7c22",
          "198.51.100.140",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          12,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-10-04T11:48:47Z",
          "dv_4e8b",
          "192.0.2.102",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "transactions"
        ],
        [
          "2026-10-05T17:43:00Z",
          "dv_4e8b",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-10-06T16:47:03Z",
          "dv_7c22",
          "198.51.100.66",
          "Residential cable ISP, Columbus OH; first time seen for this customer; not on proxy, VPN or hosting lists; 2 other customers of ours signed in from it in 90 days",
          "password + trusted device",
          "match (screen, fonts, WebGL, timezone, language)",
          "success",
          8,
          "balances; transactions; statements: September statement downloaded; Zelle recipients viewed; profile > contact details viewed; no changes, no payments"
        ],
        [
          "2026-10-06T17:03:43Z",
          "dv_4e8b",
          "192.0.2.133",
          "Mobile carrier, OH",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-10-07T23:12:40Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances; transactions"
        ],
        [
          "2026-10-08T12:05:09Z",
          "dv_7c22",
          "203.0.113.77",
          "Residential cable ISP, Columbus OH",
          "password + trusted device",
          "match",
          "success",
          4,
          "balances"
        ]
      ]
    },
    "security_messages": {
      "period": "2026-07-10 to 2026-10-08",
      "columns": [
        "ts",
        "channel",
        "to",
        "message",
        "outcome"
      ],
      "rows": [
        [
          "2026-07-11T10:00:00Z",
          "email",
          "marcus.okafor@example.net",
          "Your statement is ready",
          "sent"
        ],
        [
          "2026-08-11T10:00:00Z",
          "email",
          "marcus.okafor@example.net",
          "Your statement is ready",
          "sent"
        ],
        [
          "2026-09-11T10:00:00Z",
          "email",
          "marcus.okafor@example.net",
          "Your statement is ready",
          "sent"
        ],
        [
          "2026-10-01T22:41:00Z",
          "SMS",
          "(614) 555-0172",
          "Code to verify you with our contact center",
          "entered"
        ],
        [
          "2026-10-01T22:58:32Z",
          "email",
          "marcus.okafor@example.net",
          "Your password was changed",
          "sent"
        ],
        [
          "2026-10-01T23:02:30Z",
          "email",
          "marcus.okafor@example.net",
          "Your alert settings were changed (new-device sign-in alerts on)",
          "sent"
        ]
      ]
    },
    "account_activity": {
      "period": "posted 2026-07-10 to 2026-10-07",
      "columns": [
        "posted",
        "account",
        "type",
        "description",
        "amount_usd"
      ],
      "rows": [
        [
          "2026-07-12",
          "checking x5520",
          "ACH debit",
          "COLUMBIA GAS OH ONLINE PMT",
          -27.16
        ],
        [
          "2026-07-12",
          "checking x5520",
          "debit card x3861",
          "BRENMOOR HLTH CAFE COLUMBUS OH",
          -11.97
        ],
        [
          "2026-07-12",
          "checking x5520",
          "debit card x3861",
          "CHIPOTLE 1873 COLUMBUS OH",
          -17.72
        ],
        [
          "2026-07-12",
          "checking x5520",
          "debit card x3861",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -39.03
        ],
        [
          "2026-07-14",
          "checking x5520",
          "ACH debit",
          "WOW INTERNET AUTOPAY",
          -64.99
        ],
        [
          "2026-07-14",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -50.86
        ],
        [
          "2026-07-17",
          "checking x5520",
          "ACH credit",
          "BRENMOOR HEALTH SYS PAYROLL PPD",
          2741.88
        ],
        [
          "2026-07-17",
          "checking x5520",
          "debit card x3861",
          "YOUTUBEPREMIUM",
          -13.99
        ],
        [
          "2026-07-19",
          "checking x5520",
          "ACH debit",
          "T-MOBILE AUTOPAY",
          -70
        ],
        [
          "2026-07-19",
          "checking x5520",
          "debit card x3861",
          "SHEETZ 0614 COLUMBUS OH",
          -9.1
        ],
        [
          "2026-07-20",
          "checking x5520",
          "debit card x3861",
          "SHEETZ 0614 COLUMBUS OH",
          -10.29
        ],
        [
          "2026-07-21",
          "checking x5520",
          "Zelle out",
          "Zelle to Tasha Okafor",
          -150
        ],
        [
          "2026-07-21",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -114.65
        ],
        [
          "2026-07-21",
          "checking x5520",
          "debit card x3861",
          "SHEETZ 0614 COLUMBUS OH",
          -16.32
        ],
        [
          "2026-07-22",
          "checking x5520",
          "debit card x3861",
          "BRENMOOR HLTH CAFE COLUMBUS OH",
          -11.78
        ],
        [
          "2026-07-22",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -106.48
        ],
        [
          "2026-07-23",
          "checking x5520",
          "ACH debit",
          "PROGRESSIVE INS AUTOPAY",
          -131.12
        ],
        [
          "2026-07-23",
          "checking x5520",
          "debit card x3861",
          "AMAZON MKTPL*NM5TP44V2",
          -36.33
        ],
        [
          "2026-07-23",
          "checking x5520",
          "debit card x3861",
          "PLAYSTATION NETWORK",
          -9.99
        ],
        [
          "2026-07-24",
          "checking x5520",
          "debit card x3861",
          "AMAZON MKTPL*NM5TP44V2",
          -67.51
        ],
        [
          "2026-07-25",
          "savings x7713",
          "transfer",
          "Transfer from checking x5520",
          300
        ],
        [
          "2026-07-25",
          "checking x5520",
          "transfer",
          "Transfer to savings x7713",
          -300
        ],
        [
          "2026-07-27",
          "checking x5520",
          "debit card x3861",
          "CHIPOTLE 1873 COLUMBUS OH",
          -12.8
        ],
        [
          "2026-07-28",
          "checking x5520",
          "ACH debit",
          "CONDO ASSN OF HARRISON PARK DUES",
          -210
        ],
        [
          "2026-07-30",
          "checking x5520",
          "debit card x3861",
          "GIANT EAGLE #6413 COLUMBUS OH",
          -60.77
        ],
        [
          "2026-07-31",
          "checking x5520",
          "ACH credit",
          "BRENMOOR HEALTH SYS PAYROLL PPD",
          2741.88
        ],
        [
          "2026-07-31",
          "checking x5520",
          "debit card x3861",
          "SHEETZ 0614 COLUMBUS OH",
          -10.09
        ],
        [
          "2026-07-31",
          "savings x7713",
          "interest",
          "INTEREST PAID",
          16.17
        ],
        [
          "2026-08-01",
          "checking x5520",
          "ACH debit",
          "ROCKBRIDGE MORTGAGE SVC MTG PYMT",
          -1412.36
        ],
        [
          "2026-08-02",
          "checking x5520",
          "debit card x3861",
          "MICRO CENTER #041 COLUMBUS OH",
          -21.08
        ],
        [
          "2026-08-02",
          "checking x5520",
          "debit card x3861",
          "SPEEDWAY 09412 COLUMBUS OH",
          -54.75
        ],
        [
          "2026-08-04",
          "checking x5520",
          "debit card x3861",
          "BRENMOOR HLTH CAFE COLUMBUS OH",
          -6.76
        ],
        [
          "2026-08-04",
          "checking x5520",
          "debit card x3861",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -23.31
        ],
        [
          "2026-08-04",
          "checking x5520",
          "debit card x3861",
          "STEAMGAMES.COM",
          -59.99
        ],
        [
          "2026-08-05",
          "checking x5520",
          "ACH debit",
          "BUCKEYE TRUCK & AUTO CU LOAN PMT",
          -386.5
        ],
        [
          "2026-08-05",
          "checking x5520",
          "debit card x3861",
          "GIANT EAGLE #6413 COLUMBUS OH",
          -49.62
        ],
        [
          "2026-08-05",
          "checking x5520",
          "debit card x3861",
          "SHEETZ 0614 COLUMBUS OH",
          -13.02
        ],
        [
          "2026-08-06",
          "checking x5520",
          "debit card x3861",
          "BRENMOOR HLTH CAFE COLUMBUS OH",
          -10.16
        ],
        [
          "2026-08-06",
          "checking x5520",
          "debit card x3861",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -43.75
        ],
        [
          "2026-08-07",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -61.95
        ],
        [
          "2026-08-08",
          "checking x5520",
          "debit card x3861",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -34.7
        ],
        [
          "2026-08-09",
          "checking x5520",
          "bill pay",
          "AEP OHIO (bill pay)",
          -67.06
        ],
        [
          "2026-08-09",
          "checking x5520",
          "debit card x3861",
          "NETFLIX.COM",
          -15.49
        ],
        [
          "2026-08-10",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -40.91
        ],
        [
          "2026-08-11",
          "checking x5520",
          "debit card x3861",
          "CHIPOTLE 1873 COLUMBUS OH",
          -14.69
        ],
        [
          "2026-08-11",
          "checking x5520",
          "debit card x3861",
          "MEIJER #279 COLUMBUS OH",
          -83.89
        ],
        [
          "2026-08-12",
          "checking x5520",
          "ACH debit",
          "COLUMBIA GAS OH ONLINE PMT",
          -28.82
        ],
        [
          "2026-08-12",
          "checking x5520",
          "debit card x3861",
          "SHEETZ 0614 COLUMBUS OH",
          -12.09
        ],
        [
          "2026-08-14",
          "checking x5520",
          "ACH credit",
          "BRENMOOR HEALTH SYS PAYROLL PPD",
          2741.88
        ],
        [
          "2026-08-14",
          "checking x5520",
          "ACH debit",
          "WOW INTERNET AUTOPAY",
          -64.99
        ],
        [
          "2026-08-14",
          "checking x5520",
          "debit card x3861",
          "SPEEDWAY 09412 COLUMBUS OH",
          -45.56
        ],
        [
          "2026-08-15",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -85.36
        ],
        [
          "2026-08-16",
          "checking x5520",
          "debit card x3861",
          "HOTEL BRAVINE CINCINNATI OH",
          -238.61
        ],
        [
          "2026-08-16",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -70.39
        ],
        [
          "2026-08-16",
          "checking x5520",
          "debit card x3861",
          "MONTGOMERY INN BOATHOUSE CINCINNATI OH",
          -71.38
        ],
        [
          "2026-08-17",
          "checking x5520",
          "debit card x3861",
          "CHIPOTLE 1873 COLUMBUS OH",
          -11.71
        ],
        [
          "2026-08-17",
          "checking x5520",
          "debit card x3861",
          "GIANT EAGLE #6413 COLUMBUS OH",
          -13.98
        ],
        [
          "2026-08-17",
          "checking x5520",
          "debit card x3861",
          "GREAT AMERICAN BALL PARK CINCINNATI OH",
          -46
        ],
        [
          "2026-08-17",
          "checking x5520",
          "debit card x3861",
          "YOUTUBEPREMIUM",
          -13.99
        ],
        [
          "2026-08-18",
          "checking x5520",
          "debit card x3861",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -36.76
        ],
        [
          "2026-08-19",
          "checking x5520",
          "ACH debit",
          "T-MOBILE AUTOPAY",
          -70
        ],
        [
          "2026-08-19",
          "checking x5520",
          "debit card x3861",
          "AMAZON MKTPL*K71ZD09A0",
          -42.22
        ],
        [
          "2026-08-20",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -117.2
        ],
        [
          "2026-08-21",
          "checking x5520",
          "debit card x3861",
          "MEIJER #279 COLUMBUS OH",
          -63.93
        ],
        [
          "2026-08-22",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -101.77
        ],
        [
          "2026-08-22",
          "checking x5520",
          "debit card x3861",
          "SHEETZ 0614 COLUMBUS OH",
          -14.43
        ],
        [
          "2026-08-23",
          "checking x5520",
          "ACH debit",
          "PROGRESSIVE INS AUTOPAY",
          -131.12
        ],
        [
          "2026-08-23",
          "checking x5520",
          "debit card x3861",
          "PLAYSTATION NETWORK",
          -9.99
        ],
        [
          "2026-08-24",
          "checking x5520",
          "Zelle out",
          "Zelle to Tasha Okafor",
          -150
        ],
        [
          "2026-08-24",
          "checking x5520",
          "debit card x3861",
          "GIANT EAGLE #6413 COLUMBUS OH",
          -56.42
        ],
        [
          "2026-08-25",
          "checking x5520",
          "debit card x3861",
          "AMAZON MKTPL*NM5TP44V2",
          -18.05
        ],
        [
          "2026-08-25",
          "savings x7713",
          "transfer",
          "Transfer from checking x5520",
          300
        ],
        [
          "2026-08-25",
          "checking x5520",
          "transfer",
          "Transfer to savings x7713",
          -300
        ],
        [
          "2026-08-26",
          "checking x5520",
          "debit card x3861",
          "AMAZON MKTPL*8RQ2L01X3",
          -29.11
        ],
        [
          "2026-08-27",
          "checking x5520",
          "debit card x3861",
          "CHIPOTLE 1873 COLUMBUS OH",
          -17.09
        ],
        [
          "2026-08-28",
          "checking x5520",
          "ACH credit",
          "BRENMOOR HEALTH SYS PAYROLL PPD",
          2741.88
        ],
        [
          "2026-08-28",
          "checking x5520",
          "ACH debit",
          "CONDO ASSN OF HARRISON PARK DUES",
          -210
        ],
        [
          "2026-08-28",
          "checking x5520",
          "debit card x3861",
          "BRENMOOR HLTH CAFE COLUMBUS OH",
          -7.97
        ],
        [
          "2026-08-28",
          "checking x5520",
          "debit card x3861",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -45.05
        ],
        [
          "2026-08-28",
          "checking x5520",
          "debit card x3861",
          "SHEETZ 0614 COLUMBUS OH",
          -11.66
        ],
        [
          "2026-08-29",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -80.38
        ],
        [
          "2026-08-29",
          "checking x5520",
          "debit card x3861",
          "MEIJER #279 COLUMBUS OH",
          -91.34
        ],
        [
          "2026-08-30",
          "checking x5520",
          "Zelle in",
          "Zelle from Dre Whitaker",
          40
        ],
        [
          "2026-08-31",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -50.85
        ],
        [
          "2026-08-31",
          "savings x7713",
          "interest",
          "INTEREST PAID",
          16.7
        ],
        [
          "2026-09-01",
          "checking x5520",
          "ACH debit",
          "ROCKBRIDGE MORTGAGE SVC MTG PYMT",
          -1412.36
        ],
        [
          "2026-09-01",
          "checking x5520",
          "debit card x3861",
          "SPEEDWAY 09412 COLUMBUS OH",
          -52.66
        ],
        [
          "2026-09-03",
          "checking x5520",
          "debit card x3861",
          "CHIPOTLE 1873 COLUMBUS OH",
          -11.9
        ],
        [
          "2026-09-04",
          "checking x5520",
          "debit card x3861",
          "GIANT EAGLE #6413 COLUMBUS OH",
          -19.13
        ],
        [
          "2026-09-04",
          "checking x5520",
          "debit card x3861",
          "STEAMGAMES.COM",
          -4.99
        ],
        [
          "2026-09-05",
          "checking x5520",
          "ACH debit",
          "BUCKEYE TRUCK & AUTO CU LOAN PMT",
          -386.5
        ],
        [
          "2026-09-07",
          "checking x5520",
          "debit card x3861",
          "AMAZON MKTPL*K71ZD09A0",
          -24.18
        ],
        [
          "2026-09-07",
          "checking x5520",
          "debit card x3861",
          "GIANT EAGLE #6413 COLUMBUS OH",
          -57.54
        ],
        [
          "2026-09-09",
          "checking x5520",
          "bill pay",
          "AEP OHIO (bill pay)",
          -73.18
        ],
        [
          "2026-09-09",
          "checking x5520",
          "debit card x3861",
          "NETFLIX.COM",
          -15.49
        ],
        [
          "2026-09-10",
          "checking x5520",
          "debit card x3861",
          "MICRO CENTER #041 COLUMBUS OH",
          -77.59
        ],
        [
          "2026-09-11",
          "checking x5520",
          "ACH credit",
          "BRENMOOR HEALTH SYS PAYROLL PPD",
          2967.15
        ],
        [
          "2026-09-11",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -25.3
        ],
        [
          "2026-09-12",
          "checking x5520",
          "ACH debit",
          "COLUMBIA GAS OH ONLINE PMT",
          -28.27
        ],
        [
          "2026-09-13",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -88.18
        ],
        [
          "2026-09-14",
          "checking x5520",
          "ACH debit",
          "WOW INTERNET AUTOPAY",
          -64.99
        ],
        [
          "2026-09-16",
          "checking x5520",
          "debit card x3861",
          "KROGER #0547 COLUMBUS OH",
          -111.56
        ],
        [
          "2026-09-16",
          "checking x5520",
          "debit card x3861",
          "SPEEDWAY 09412 COLUMBUS OH",
          -41.71
        ],
        [
          "2026-09-17",
          "checking x5520",
          "debit card x3861",
          "YOUTUBEPREMIUM",
          -13.99
        ],
        [
          "2026-09-19",
          "checking x5520",
          "ACH debit",
          "T-MOBILE AUTOPAY",
          -70
        ],
        [
          "2026-09-21",
          "checking x5520",
          "Zelle out",
          "Zelle to Tasha Okafor",
          -150
        ],
        [
          "2026-09-22",
          "checking x5520",
          "debit card x3861",
          "MICRO CENTER #041 COLUMBUS OH",
          -59.53
        ],
        [
          "2026-09-23",
          "checking x5520",
          "ACH debit",
          "PROGRESSIVE INS AUTOPAY",
          -131.12
        ],
        [
          "2026-09-23",
          "checking x5520",
          "debit card x3861",
          "PLAYSTATION NETWORK",
          -9.99
        ],
        [
          "2026-09-24",
          "checking x5520",
          "debit card x3861",
          "CHIPOTLE 1873 COLUMBUS OH",
          -17.25
        ],
        [
          "2026-09-25",
          "checking x5520",
          "ACH credit",
          "BRENMOOR HEALTH SYS PAYROLL PPD",
          2967.15
        ],
        [
          "2026-09-25",
          "savings x7713",
          "transfer",
          "Transfer from checking x5520",
          300
        ],
        [
          "2026-09-25",
          "checking x5520",
          "transfer",
          "Transfer to savings x7713",
          -300
        ],
        [
          "2026-09-26",
          "checking x5520",
          "debit card x3861",
          "AMAZON MKTPL*NM5TP44V2",
          -14.81
        ],
        [
          "2026-09-27",
          "checking x5520",
          "debit card x3861",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -50.56
        ],
        [
          "2026-09-27",
          "checking x5520",
          "debit card x3861",
          "SHEETZ 0614 COLUMBUS OH",
          -13.37
        ],
        [
          "2026-09-28",
          "checking x5520",
          "ACH debit",
          "CONDO ASSN OF HARRISON PARK DUES",
          -210
        ],
        [
          "2026-09-28",
          "checking x5520",
          "debit card x3861",
          "SPEEDWAY 09412 COLUMBUS OH",
          -43.29
        ],
        [
          "2026-09-30",
          "savings x7713",
          "interest",
          "INTEREST PAID",
          16.99
        ],
        [
          "2026-10-01",
          "checking x5520",
          "ACH debit",
          "ROCKBRIDGE MORTGAGE SVC MTG PYMT",
          -1412.36
        ],
        [
          "2026-10-01",
          "checking x5520",
          "debit card x3861",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -25.71
        ],
        [
          "2026-10-02",
          "checking x5520",
          "debit card x3861",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -32.86
        ],
        [
          "2026-10-03",
          "checking x5520",
          "debit card x3861",
          "MEIJER #279 COLUMBUS OH",
          -70.61
        ],
        [
          "2026-10-04",
          "checking x5520",
          "debit card x3861",
          "STEAMGAMES.COM",
          -4.99
        ],
        [
          "2026-10-05",
          "checking x5520",
          "ACH debit",
          "BUCKEYE TRUCK & AUTO CU LOAN PMT",
          -386.5
        ],
        [
          "2026-10-07",
          "checking x5520",
          "debit card x3861",
          "SHEETZ 0614 COLUMBUS OH",
          -11.94
        ]
      ]
    },
    "card_authorizations": {
      "card": "debit x3861",
      "period": "2026-09-17 to 2026-10-08, approvals and declines",
      "columns": [
        "ts",
        "merchant",
        "mcc",
        "entry",
        "amount_usd",
        "result",
        "avs",
        "cvv2"
      ],
      "rows": [
        [
          "2026-09-21T22:38:47Z",
          "MICRO CENTER #041 COLUMBUS OH",
          "5732",
          "chip (05)",
          59.53,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-22T09:30:00Z",
          "PLAYSTATION NETWORK",
          "5816",
          "card on file (10)",
          9.99,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-23T22:38:36Z",
          "CHIPOTLE 1873 COLUMBUS OH",
          "5814",
          "contactless (07)",
          17.25,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-25T16:45:00Z",
          "AMAZON MKTPL*NM5TP44V2",
          "5942",
          "card on file (10)",
          14.81,
          "approved (00)",
          "Y",
          ""
        ],
        [
          "2026-09-26T23:38:23Z",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          "5812",
          "card on file (10)",
          50.56,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-27T01:39:02Z",
          "SHEETZ 0614 COLUMBUS OH",
          "5541",
          "contactless (07)",
          13.37,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-27T16:52:52Z",
          "SPEEDWAY 09412 COLUMBUS OH",
          "5541",
          "chip (05)",
          43.29,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-30T20:56:07Z",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          "5812",
          "card on file (10)",
          25.71,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-01T16:56:42Z",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          "5812",
          "card on file (10)",
          32.86,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-02T20:26:53Z",
          "MEIJER #279 COLUMBUS OH",
          "5411",
          "chip (05)",
          70.61,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-03T09:30:00Z",
          "STEAMGAMES.COM",
          "5816",
          "card on file (10)",
          4.99,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-06T20:47:44Z",
          "SHEETZ 0614 COLUMBUS OH",
          "5541",
          "chip (05)",
          11.94,
          "approved (00)",
          "",
          ""
        ]
      ]
    },
    "contact_center_history": {
      "period": "last 12 months",
      "columns": [
        "ts",
        "channel",
        "caller",
        "verification",
        "reason",
        "outcome"
      ],
      "rows": [
        [
          "2026-04-11T19:02:00Z",
          "chat (app)",
          "dv_4e8b",
          "signed-in app session",
          "Asked to raise his Zelle limit",
          "Explained limits; no change"
        ],
        [
          "2026-10-01T22:40:00Z",
          "phone",
          "(614) 555-0172 (on file)",
          "SMS code",
          "Customer said his email provider locked his email account two days earlier after a sign-in from overseas, and asked whether online banking showed anything unusual",
          "Agent reviewed sign-ins: nothing unusual. Advised changing the online banking password and scanning his computer; customer changed the password on his laptop during the call and said he would run a virus scan. Agent turned on new-device sign-in alerts. Laptop left trusted (customer: 'it's my own laptop')"
        ]
      ]
    },
    "prior_alerts": [],
    "alert": {
      "alert_id": "TI-20261008-0141",
      "received": "2026-10-08T14:22:00Z",
      "vendor_feed": "Threat intelligence vendor: compromised credentials from infostealer logs",
      "vendor_severity": "critical (log contains our bank's login and cookies)",
      "where_seen": "An automated log shop on Tor ($10 per log); the shop does not show whether a log has sold",
      "first_seen_by_vendor": "2026-10-04T09:30:00Z",
      "newer_logs_from_same_machine": "None seen by the vendor as of the alert",
      "log": {
        "log_id": "5e02b9d1c4",
        "malware": "Commodity infostealer sold as a service (vendor family code IS-207)",
        "malware_profile": "Vendor research: builds of this family since 2026-07 add a scheduled task that re-runs the stealer every 24 hours until removed and send each new capture to the same operator; re-captures are often kept private rather than listed, so the vendor may not see them",
        "captured": "2026-09-30T02:14:51Z",
        "computer_name": "LAPTOP-MO4K21",
        "windows_user": "marcu",
        "os": "Windows 11 Home 23H2",
        "browser": "Chrome 129",
        "ip_at_capture": "203.0.113.77",
        "timezone": "UTC-05:00 Eastern",
        "screen": "1920x1200",
        "antivirus": "Windows Defender",
        "launched_file": "C:\\Users\\marcu\\Downloads\\VidCutPro_2026_full_setup.exe",
        "sites_with_saved_passwords": 74,
        "cookies": 2105,
        "screenshot": "Desktop with a video-editor installer window; no account numbers or balances visible"
      },
      "entries_for_our_bank": {
        "login_url": "https://online.ourbank.example/login",
        "username": "mokafor_614",
        "password": "present (compared with our stored hashes, see alert_checks)",
        "cookies": [
          {
            "name": "tdt",
            "what": "trusted-device token",
            "expires": "2027-01-11"
          },
          {
            "name": "sid",
            "what": "session",
            "expires": "2026-09-30T02:41:00Z"
          },
          {
            "name": "lang",
            "what": "language preference",
            "expires": "2027-09-29"
          }
        ]
      },
      "other_entries_of_note": [
        "Password and session cookies for marcus.okafor@example.net (the email on file)",
        "Login for a cryptocurrency exchange and for two gaming platforms",
        "Browser autofill: full name, home address, phone number",
        "No saved payment cards"
      ],
      "vendor_match": {
        "matched_on": [
          "online banking username",
          "email on file"
        ],
        "vendor_confidence": "high"
      }
    },
    "alert_checks": {
      "credential_check": {
        "method": "Password from the log hashed with this login's salt and algorithm and compared with the current and previous hashes; plaintext discarded, never logged",
        "matches_current_password": false,
        "matches_a_previous_password": true,
        "which_previous_password": "The one replaced on 2026-10-01 during the contact-center call",
        "current_password_set": "2026-10-01T22:58:12Z",
        "current_password_set_from": "dv_7c22 (LAPTOP-MO4K21, the machine in the log) at 203.0.113.77"
      },
      "device_token_check": {
        "token_in_log": "tdt for dv_7c22 (the laptop, trusted since 2024-01-12)",
        "token_status": "active (the password change did not remove trusted devices)",
        "presented_since_capture": "5 successful sign-ins, each with the password current at the time: 3 from 203.0.113.77, 1 from 198.51.100.140, 1 from 198.51.100.66; no failed attempts"
      },
      "log_machine_vs_our_records": "Computer name, screen size and capture IP match dv_7c22 and the customer's usual address",
      "balance_check": "Not applicable: the log's screenshot shows no balances"
    }
  },
  "questions": {
    "matches_customer": {
      "type": "noul",
      "instructions": "Does the vendor's alert refer to this customer's own login, account or card at our bank (including a card since closed or replaced), rather than to a different person?"
    },
    "still_exposed": {
      "type": "score",
      "instructions": "How likely is it that someone other than the customer can currently use the exposed data to sign in to this customer's online banking or make payments from the customer's accounts or cards?",
      "criteria": [
        "Very unlikely (under 10%)",
        "Unlikely (10-40%)",
        "Uncertain (40-60%)",
        "Likely (60-90%)",
        "Very likely (over 90%)"
      ]
    },
    "response": {
      "type": "choice",
      "instructions": "What should the bank do about this alert for this customer?",
      "criteria": {
        "no_action": "Log the alert and take no action: it doesn't match this customer, or nothing it exposes still works",
        "reset_step_up": "Force a password reset from a device not named in the alert, end all sessions, remove trusted devices and require a one-time code at the next sign-in",
        "reissue_card": "Block the exposed card and issue a new card number; online banking access needs no change",
        "restrict_contact": "Restrict outbound payments, new payees and contact-detail changes until the customer is reached at the phone number on file"
      }
    }
  }
}