{
  "model": "grayson-1",
  "state": {
    "case": {
      "case_id": "DW-26-001187",
      "opened": "2026-10-07T11:58:30Z",
      "queue": "Dark web alerts",
      "records_as_of": "2026-10-07T12:20:00Z"
    },
    "customer": {
      "customer_id": "cus_41562",
      "name": "Gloria Benitez",
      "age": 68,
      "home": "Tucson, AZ",
      "customer_since": "2011-03-22",
      "occupation_on_file": "Retired (teacher)",
      "online_banking_username": "gbenitez52",
      "online_banking_since": "2014-01-08",
      "accounts": [
        {
          "account": "checking x2093",
          "opened": "2011-03-22",
          "status": "open",
          "balance_usd": 19320.81
        },
        {
          "account": "savings x6158",
          "opened": "2011-03-22",
          "status": "open",
          "balance_usd": 39882.85
        }
      ],
      "debit_card": {
        "card": "x7730",
        "on_account": "checking x2093",
        "issued": "2025-04-10",
        "expires": "04/28",
        "status": "active",
        "wallets": "none"
      },
      "phone_on_file": {
        "number": "(520) 555-0117",
        "line_type": "mobile",
        "last_changed": "2018-06-02",
        "carrier_sim_change_check": "No SIM change or port-out in 90 days (checked 2026-10-07T12:12Z)"
      },
      "email_on_file": {
        "address": "gbenitez.home@example.net",
        "last_changed": "2016-11-30"
      },
      "address_last_changed": "2011-03-22",
      "alert_settings": "Email alerts for transfers over $500 and online card purchases (on since 2019; turned off 2026-10-06, see changes); statement-ready emails",
      "travel_notices": "none in 12 months",
      "usual_sign_in_addresses": "203.0.113.58 (home cable ISP, Tucson AZ, since 2021) for the desktop and the app; mobile carrier addresses for the app"
    },
    "sign_in_security": "Online banking uses a username and password. A device becomes trusted after a one-time code sent by SMS to the phone on file, if the customer ticks 'remember this device'; a trusted device (a token stored in a browser cookie) skips the code at sign-in. The mobile app signs in with Face ID or fingerprint after its first code. Codes are also required to add a Zelle recipient or an external transfer account, to change the phone, email or address on file, and to raise transfer limits. Bill-pay payees paid by mailed check, alert settings and statement preferences change without a code. 'Forgot password' emails a reset link to the email on file; a code is required after the reset unless the device is trusted. Changing the password does not end other sessions or remove trusted devices. A sign-in from a new country triggers an SMS 'Was this you?' check. By phone, contact-detail changes need a code to the phone on file or photo ID in a branch.",
    "devices": {
      "columns": [
        "device_id",
        "device",
        "first_seen",
        "trusted_since",
        "status",
        "last_seen"
      ],
      "rows": [
        [
          "dv_19f0",
          "Windows 7 · Chrome",
          "2014-01-08",
          "2014-01-08",
          "removed 2021-09-14 (replaced)",
          "2021-09-10"
        ],
        [
          "dv_3a91",
          "Windows 10 · Chrome (desktop DESKTOP-GB7H2LQ)",
          "2021-09-14",
          "2021-09-14",
          "trusted",
          "2026-10-07T04:02:31Z"
        ],
        [
          "dv_51ce",
          "Samsung Galaxy A54 · app",
          "2023-12-27",
          "2023-12-27",
          "trusted",
          "2026-10-06"
        ],
        [
          "dv_8e07",
          "Windows 10 · Firefox 130",
          "2026-10-05",
          "",
          "not trusted",
          "2026-10-05"
        ]
      ]
    },
    "credential_and_contact_changes": {
      "columns": [
        "ts",
        "change",
        "channel",
        "device_id",
        "ip",
        "verification"
      ],
      "rows": [
        [
          "2014-01-08T17:20:00Z",
          "Online banking enrolled",
          "branch",
          "",
          "",
          "photo ID"
        ],
        [
          "2016-11-30T18:02:11Z",
          "Email on file changed",
          "web",
          "dv_19f0",
          "203.0.113.58",
          "SMS code"
        ],
        [
          "2018-06-02T16:45:09Z",
          "Phone on file changed (new mobile number)",
          "branch",
          "",
          "",
          "photo ID"
        ],
        [
          "2021-09-14T15:10:37Z",
          "Device trusted: dv_3a91",
          "web",
          "dv_3a91",
          "203.0.113.58",
          "SMS code"
        ],
        [
          "2022-05-03T16:33:50Z",
          "Password changed",
          "web",
          "dv_3a91",
          "203.0.113.58",
          "current password"
        ],
        [
          "2023-12-27T19:04:22Z",
          "Device trusted: dv_51ce (app)",
          "app",
          "dv_51ce",
          "203.0.113.58",
          "SMS code"
        ],
        [
          "2024-08-11T16:22:05Z",
          "Password reset via 'forgot password' email link",
          "web",
          "dv_3a91",
          "203.0.113.58",
          "email link; trusted device, no code"
        ],
        [
          "2026-10-06T10:03:41Z",
          "Alert settings: transfer and online-purchase email alerts turned off",
          "web",
          "dv_3a91",
          "198.51.100.141",
          "none required"
        ],
        [
          "2026-10-07T04:04:58Z",
          "Bill-pay payee added: D Marsh Home Repair (check mailed to Phoenix, AZ)",
          "web",
          "dv_3a91",
          "198.51.100.23",
          "none required"
        ]
      ]
    },
    "payees": {
      "pending_or_abandoned_since_2026_10_01": [
        "Zelle recipient 'Devon Marsh' (602) 555-0148: started 2026-10-04T10:50Z from dv_3a91 at 198.51.100.23; code not entered",
        "External transfer account at another bank ending 6620: started 2026-10-06T10:09Z from dv_3a91 at 198.51.100.141; code not entered"
      ],
      "columns": [
        "payee",
        "type",
        "added",
        "added_from",
        "verification",
        "payments_last_90_days",
        "last_paid"
      ],
      "rows": [
        [
          "Tucson Electric Power",
          "bill pay",
          "2014-02-11",
          "web",
          "none required",
          3,
          "2026-09-12"
        ],
        [
          "City of Tucson Water",
          "bill pay",
          "2014-02-11",
          "web",
          "none required",
          3,
          "2026-09-17"
        ],
        [
          "St Ambrose Parish",
          "bill pay",
          "2015-06-01",
          "web",
          "none required",
          3,
          "2026-09-05"
        ],
        [
          "Banner Health patient account",
          "bill pay",
          "2025-02-19",
          "web",
          "none required",
          1,
          "2026-07-31"
        ],
        [
          "Tucson Orthopaedic Institute",
          "bill pay",
          "2026-03-04",
          "web",
          "none required",
          1,
          "2026-09-10"
        ],
        [
          "Sofia Benitez (granddaughter per customer)",
          "Zelle",
          "2022-12-20",
          "web",
          "SMS code",
          3,
          "2026-09-25"
        ],
        [
          "D Marsh Home Repair (paper check to Phoenix, AZ)",
          "bill pay",
          "2026-10-07",
          "web, dv_3a91 at 198.51.100.23",
          "none required",
          0,
          ""
        ]
      ]
    },
    "scheduled_payments": {
      "columns": [
        "scheduled",
        "payee",
        "amount_usd",
        "send_on",
        "method",
        "set_up_from",
        "status"
      ],
      "rows": [
        [
          "2025-02-19T17:02:10Z",
          "Tucson Electric Power",
          "statement balance",
          "2026-10-12",
          "electronic",
          "dv_3a91 at 203.0.113.58",
          "recurring monthly"
        ],
        [
          "2014-02-11T18:30:00Z",
          "City of Tucson Water",
          "statement balance",
          "2026-10-17",
          "electronic",
          "dv_19f0",
          "recurring monthly"
        ],
        [
          "2026-10-07T04:05:48Z",
          "D Marsh Home Repair",
          2850,
          "2026-10-08",
          "paper check mailed by our bill-pay processor",
          "dv_3a91 at 198.51.100.23",
          "scheduled; can be cancelled until 2026-10-08T14:00Z"
        ]
      ]
    },
    "sign_in_history": {
      "period": "2026-07-09 to 2026-10-07T12:20Z, all channels",
      "columns": [
        "ts",
        "device_id",
        "ip",
        "ip_info",
        "method",
        "fingerprint",
        "result",
        "minutes",
        "activity"
      ],
      "rows": [
        [
          "2026-07-09T15:54:03Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          2,
          "balances; statements"
        ],
        [
          "2026-07-10T03:55:50Z",
          "dv_51ce",
          "192.0.2.118",
          "Mobile carrier, AZ",
          "fingerprint (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-07-12T21:37:48Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-07-13T15:04:17Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "balances; transactions"
        ],
        [
          "2026-07-13T22:54:32Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-07-14T15:16:22Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          9,
          "balances"
        ],
        [
          "2026-07-15T15:21:23Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          3,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-07-16T16:13:26Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "balances; transactions"
        ],
        [
          "2026-07-17T17:20:16Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances; statements"
        ],
        [
          "2026-07-18T17:29:40Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          6,
          "transactions"
        ],
        [
          "2026-07-19T17:17:42Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "balances; transactions"
        ],
        [
          "2026-07-19T23:35:05Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-07-21T15:55:08Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances; transactions"
        ],
        [
          "2026-07-24T15:13:55Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances; Zelle to Sofia Benitez $50.00"
        ],
        [
          "2026-07-24T17:57:18Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          5,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-07-24T19:47:26Z",
          "dv_51ce",
          "192.0.2.14",
          "Mobile carrier, AZ",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-07-25T14:48:55Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "transactions"
        ],
        [
          "2026-07-25T18:24:10Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-07-26T15:03:11Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          9,
          "balances; transactions"
        ],
        [
          "2026-07-29T14:48:29Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-07-30T15:34:59Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances; statements"
        ],
        [
          "2026-07-30T15:59:32Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          4,
          "balances; bill pay: BANNER HEALTH PATIENT ACCT $64.20"
        ],
        [
          "2026-07-31T00:07:01Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-07-31T17:40:02Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          3,
          "balances; statements"
        ],
        [
          "2026-08-01T16:47:42Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "balances; transactions"
        ],
        [
          "2026-08-02T02:09:12Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "transactions"
        ],
        [
          "2026-08-02T15:08:50Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances"
        ],
        [
          "2026-08-03T01:48:00Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-08-03T15:46:23Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          7,
          "balances; transactions"
        ],
        [
          "2026-08-06T15:03:13Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          9,
          "balances; mobile check deposit $120.00"
        ],
        [
          "2026-08-09T17:52:33Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-08-10T20:21:20Z",
          "dv_51ce",
          "192.0.2.37",
          "Mobile carrier, AZ",
          "fingerprint (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-08-11T16:43:08Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          9,
          "balances"
        ],
        [
          "2026-08-11T23:11:13Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-08-12T16:42:52Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-08-13T03:01:30Z",
          "dv_51ce",
          "192.0.2.140",
          "Mobile carrier, AZ",
          "fingerprint (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-08-13T16:10:10Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          3,
          "balances; statements"
        ],
        [
          "2026-08-13T21:19:46Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-08-14T16:41:49Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          6,
          "transactions"
        ],
        [
          "2026-08-15T16:12:20Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          7,
          "transactions"
        ],
        [
          "2026-08-16T18:24:18Z",
          "dv_51ce",
          "192.0.2.37",
          "Mobile carrier, AZ",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-08-18T00:21:17Z",
          "dv_51ce",
          "192.0.2.118",
          "Mobile carrier, AZ",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-08-18T14:45:48Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          2,
          "balances; transactions"
        ],
        [
          "2026-08-19T16:06:55Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          9,
          "transactions"
        ],
        [
          "2026-08-20T15:50:04Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-08-21T21:52:28Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-08-22T15:35:34Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          4,
          "balances; transactions"
        ],
        [
          "2026-08-22T15:41:12Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password: incorrect",
          "match",
          "failed",
          0,
          ""
        ],
        [
          "2026-08-22T15:41:52Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-08-24T14:23:53Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          7,
          "balances"
        ],
        [
          "2026-08-25T03:46:29Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-08-26T14:23:34Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          9,
          "balances; transactions"
        ],
        [
          "2026-08-27T16:34:35Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-08-28T15:38:24Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-08-28T16:20:14Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          4,
          "balances; Zelle to Sofia Benitez $50.00"
        ],
        [
          "2026-08-29T14:31:17Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances"
        ],
        [
          "2026-08-31T16:53:36Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances; statements"
        ],
        [
          "2026-09-02T17:53:42Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          7,
          "balances"
        ],
        [
          "2026-09-03T17:09:54Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          4,
          "balances; statements"
        ],
        [
          "2026-09-04T14:25:24Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "balances; statements"
        ],
        [
          "2026-09-05T17:10:58Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-09-05T23:28:36Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-06T16:16:12Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "balances; transactions"
        ],
        [
          "2026-09-07T16:06:05Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-09-08T17:41:42Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-09-09T15:52:44Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          11,
          "balances; bill pay: TUCSON ORTHOPAEDIC INST $35.00"
        ],
        [
          "2026-09-09T19:29:45Z",
          "dv_51ce",
          "192.0.2.91",
          "Mobile carrier, AZ",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-09-11T02:43:16Z",
          "dv_51ce",
          "192.0.2.91",
          "Mobile carrier, AZ",
          "fingerprint (app)",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-09-13T14:57:18Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-14T14:29:49Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-09-16T19:09:01Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-09-17T15:46:02Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          7,
          "balances; transactions"
        ],
        [
          "2026-09-18T15:02:03Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances; transactions"
        ],
        [
          "2026-09-19T16:07:35Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances"
        ],
        [
          "2026-09-21T01:34:27Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-09-22T16:38:40Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          4,
          "balances; transactions"
        ],
        [
          "2026-09-23T17:07:24Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances; transactions"
        ],
        [
          "2026-09-24T16:43:59Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          6,
          "transactions"
        ],
        [
          "2026-09-24T22:20:37Z",
          "dv_51ce",
          "192.0.2.91",
          "Mobile carrier, AZ",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-09-25T14:22:35Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          2,
          "balances; statements"
        ],
        [
          "2026-09-25T15:08:38Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances; Zelle to Sofia Benitez $75.00"
        ],
        [
          "2026-09-25T23:50:30Z",
          "dv_51ce",
          "192.0.2.37",
          "Mobile carrier, AZ",
          "fingerprint (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-09-26T19:40:25Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-09-28T17:05:36Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-09-30T15:29:34Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          6,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-10-01T02:40:18Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-10-01T20:39:25Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-10-02T16:20:05Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          2,
          "balances; statements"
        ],
        [
          "2026-10-03T00:58:05Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances; transactions"
        ],
        [
          "2026-10-03T16:15:52Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances; statements"
        ],
        [
          "2026-10-04T10:47:12Z",
          "dv_3a91",
          "198.51.100.23",
          "Residential ISP range, Phoenix AZ; on 2 proxy-network lists; seen at 11 consortium banks in 14 days",
          "password + trusted device",
          "differs from device: screen 1366x768 (device 1920x1080), fonts, WebGL renderer",
          "success",
          9,
          "balances; Zelle recipients; add Zelle recipient 'Devon Marsh' (602) 555-0148: code sent, not entered; contact details: email change started, code sent, not entered"
        ],
        [
          "2026-10-04T16:12:09Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-10-04T20:07:40Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-10-05T07:31:10Z",
          "dv_8e07",
          "198.51.100.77",
          "Hosting provider (data center), Ashburn VA; on VPN and proxy lists",
          "'forgot password': reset link requested",
          "new device",
          "link emailed to the email on file",
          0,
          ""
        ],
        [
          "2026-10-05T07:35:42Z",
          "dv_8e07",
          "198.51.100.77",
          "Hosting provider (data center), Ashburn VA; on VPN and proxy lists",
          "reset link opened; SMS code required (untrusted device)",
          "new device",
          "abandoned at the code; password not changed",
          2,
          ""
        ],
        [
          "2026-10-05T16:31:05Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          7,
          "transactions"
        ],
        [
          "2026-10-06T09:58:40Z",
          "dv_3a91",
          "198.51.100.141",
          "Residential ISP range, Tucson AZ; on 1 proxy-network list; seen at 6 consortium banks in 14 days",
          "password + trusted device",
          "differs from device: screen 1366x768 (device 1920x1080), fonts, WebGL renderer",
          "success",
          14,
          "balances; card controls viewed; alert settings: email alerts for transfers over $500 and for online card purchases turned off; add external transfer account (another bank, account ending 6620): code sent, not entered"
        ],
        [
          "2026-10-06T14:46:44Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          8,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-10-06T16:00:51Z",
          "dv_3a91",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "password + trusted device",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-10-06T22:41:07Z",
          "dv_51ce",
          "203.0.113.58",
          "Residential cable ISP, Tucson AZ",
          "fingerprint (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-10-07T04:02:31Z",
          "dv_3a91",
          "198.51.100.23",
          "Residential ISP range, Phoenix AZ; on 2 proxy-network lists; seen at 11 consortium banks in 14 days",
          "password + trusted device",
          "differs from device: screen 1366x768 (device 1920x1080), fonts, WebGL renderer",
          "success",
          7,
          "balances; Zelle limits viewed; bill pay: added payee 'D Marsh Home Repair' (paper check to a Phoenix AZ address, no code required); scheduled a $2,850.00 check payment to it for 2026-10-08"
        ]
      ]
    },
    "security_messages": {
      "period": "2026-07-09 to 2026-10-07",
      "columns": [
        "ts",
        "channel",
        "to",
        "message",
        "outcome"
      ],
      "rows": [
        [
          "2026-07-21T13:00:00Z",
          "email",
          "gbenitez.home@example.net",
          "Your statement is ready",
          "sent"
        ],
        [
          "2026-08-06T15:31:00Z",
          "email",
          "gbenitez.home@example.net",
          "Mobile deposit received: $120.00",
          "sent"
        ],
        [
          "2026-08-22T13:00:00Z",
          "email",
          "gbenitez.home@example.net",
          "Your statement is ready",
          "sent"
        ],
        [
          "2026-09-21T13:00:00Z",
          "email",
          "gbenitez.home@example.net",
          "Your statement is ready",
          "sent"
        ],
        [
          "2026-10-04T10:51:02Z",
          "SMS",
          "(520) 555-0117",
          "Code to add a Zelle recipient. We will never call you to ask for it.",
          "not entered; expired after 10 min"
        ],
        [
          "2026-10-04T10:54:37Z",
          "SMS",
          "(520) 555-0117",
          "Code to change your email address. We will never call you to ask for it.",
          "not entered; expired after 10 min"
        ],
        [
          "2026-10-05T07:31:12Z",
          "email",
          "gbenitez.home@example.net",
          "Password reset link",
          "link opened 2026-10-05T07:35:42Z from 198.51.100.77 (dv_8e07)"
        ],
        [
          "2026-10-05T07:35:50Z",
          "SMS",
          "(520) 555-0117",
          "Code to finish your password reset. We will never call you to ask for it.",
          "not entered; expired after 10 min"
        ],
        [
          "2026-10-05T18:09:40Z",
          "SMS",
          "(520) 555-0117",
          "Code to verify you with our contact center",
          "not entered; caller declined to use it"
        ],
        [
          "2026-10-06T10:03:55Z",
          "email",
          "gbenitez.home@example.net",
          "Your alert settings were changed",
          "sent"
        ],
        [
          "2026-10-06T10:09:14Z",
          "SMS",
          "(520) 555-0117",
          "Code to add an external transfer account. We will never call you to ask for it.",
          "not entered; expired after 10 min"
        ],
        [
          "2026-10-07T04:05:02Z",
          "email",
          "gbenitez.home@example.net",
          "A new bill-pay payee was added: D Marsh Home Repair",
          "sent"
        ],
        [
          "2026-10-07T04:06:00Z",
          "email",
          "gbenitez.home@example.net",
          "Payment scheduled: $2,850.00 to D Marsh Home Repair on 10/08",
          "sent"
        ]
      ]
    },
    "account_activity": {
      "period": "posted 2026-07-09 to 2026-10-07",
      "columns": [
        "posted",
        "account",
        "type",
        "description",
        "amount_usd"
      ],
      "rows": [
        [
          "2026-07-09",
          "checking x2093",
          "ACH debit",
          "T-MOBILE AUTOPAY",
          -65
        ],
        [
          "2026-07-10",
          "checking x2093",
          "debit card x7730",
          "WALGREENS #3521 TUCSON AZ",
          -23.12
        ],
        [
          "2026-07-11",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -65.12
        ],
        [
          "2026-07-11",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -52.67
        ],
        [
          "2026-07-12",
          "checking x2093",
          "bill pay",
          "TUCSON ELECTRIC POWER (bill pay)",
          -139.01
        ],
        [
          "2026-07-12",
          "checking x2093",
          "debit card x7730",
          "GOODWILL #213 TUCSON AZ",
          -17.62
        ],
        [
          "2026-07-12",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -27.38
        ],
        [
          "2026-07-13",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -127.4
        ],
        [
          "2026-07-14",
          "checking x2093",
          "ACH debit",
          "SOUTHWEST GAS CORP ONLINE PMT",
          -28.66
        ],
        [
          "2026-07-14",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -48.85
        ],
        [
          "2026-07-15",
          "checking x2093",
          "ACH credit",
          "SSA TREAS 310 XXSOC SEC",
          1986
        ],
        [
          "2026-07-15",
          "checking x2093",
          "debit card x7730",
          "NETFLIX.COM",
          -15.49
        ],
        [
          "2026-07-15",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -22.86
        ],
        [
          "2026-07-16",
          "checking x2093",
          "debit card x7730",
          "PANERA BREAD #601447 TUCSON AZ",
          -17.12
        ],
        [
          "2026-07-17",
          "checking x2093",
          "bill pay",
          "CITY OF TUCSON WATER (bill pay)",
          -71.27
        ],
        [
          "2026-07-17",
          "checking x2093",
          "debit card x7730",
          "COSTCO WHSE #0483 TUCSON AZ",
          -145.61
        ],
        [
          "2026-07-17",
          "checking x2093",
          "debit card x7730",
          "WALGREENS #3521 TUCSON AZ",
          -13.38
        ],
        [
          "2026-07-18",
          "checking x2093",
          "ATM",
          "ATM WITHDRAWAL 4410 E BROADWAY BLVD TUCSON AZ",
          -100
        ],
        [
          "2026-07-19",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -139.62
        ],
        [
          "2026-07-19",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -45.6
        ],
        [
          "2026-07-20",
          "checking x2093",
          "ACH debit",
          "STATE FARM INSURANCE PREM",
          -118.4
        ],
        [
          "2026-07-21",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -45.37
        ],
        [
          "2026-07-22",
          "checking x2093",
          "ACH debit",
          "CATALINA VISTA HOA DUES",
          -145
        ],
        [
          "2026-07-22",
          "checking x2093",
          "debit card x7730",
          "AMAZON MKTPL*9Q2LM04Z8",
          -34.71
        ],
        [
          "2026-07-22",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -22.44
        ],
        [
          "2026-07-23",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -35.45
        ],
        [
          "2026-07-23",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -24.67
        ],
        [
          "2026-07-24",
          "checking x2093",
          "Zelle out",
          "Zelle to Sofia Benitez",
          -50
        ],
        [
          "2026-07-24",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -74.95
        ],
        [
          "2026-07-24",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -49.64
        ],
        [
          "2026-07-25",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -27.01
        ],
        [
          "2026-07-26",
          "savings x6158",
          "transfer",
          "Transfer from checking x2093",
          400
        ],
        [
          "2026-07-26",
          "checking x2093",
          "transfer",
          "Transfer to savings x6158",
          -400
        ],
        [
          "2026-07-28",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -21.55
        ],
        [
          "2026-07-29",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -28.66
        ],
        [
          "2026-07-30",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -44.88
        ],
        [
          "2026-07-30",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -114.27
        ],
        [
          "2026-07-30",
          "checking x2093",
          "debit card x7730",
          "WALGREENS #3521 TUCSON AZ",
          -31.98
        ],
        [
          "2026-07-31",
          "checking x2093",
          "bill pay",
          "BANNER HEALTH PATIENT ACCT (bill pay)",
          -64.2
        ],
        [
          "2026-07-31",
          "checking x2093",
          "check",
          "CHECK #1187",
          -140
        ],
        [
          "2026-07-31",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -34.66
        ],
        [
          "2026-07-31",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -139.2
        ],
        [
          "2026-07-31",
          "checking x2093",
          "debit card x7730",
          "WALGREENS #3521 TUCSON AZ",
          -19.14
        ],
        [
          "2026-07-31",
          "savings x6158",
          "interest",
          "INTEREST PAID",
          10.81
        ],
        [
          "2026-08-01",
          "checking x2093",
          "debit card x7730",
          "COSTCO WHSE #0483 TUCSON AZ",
          -196.36
        ],
        [
          "2026-08-03",
          "checking x2093",
          "ACH credit",
          "STATE TEACHERS RET SYS PENSION PPD",
          3412.66
        ],
        [
          "2026-08-03",
          "checking x2093",
          "ACH debit",
          "COX COMMUNICATIONS AUTOPAY",
          -89.99
        ],
        [
          "2026-08-03",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -53.65
        ],
        [
          "2026-08-03",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -114.04
        ],
        [
          "2026-08-03",
          "checking x2093",
          "debit card x7730",
          "GOODWILL #213 TUCSON AZ",
          -29.77
        ],
        [
          "2026-08-04",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -75.48
        ],
        [
          "2026-08-04",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -34.81
        ],
        [
          "2026-08-05",
          "checking x2093",
          "bill pay",
          "ST AMBROSE PARISH (bill pay)",
          -100
        ],
        [
          "2026-08-05",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -67.25
        ],
        [
          "2026-08-06",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -112.25
        ],
        [
          "2026-08-06",
          "checking x2093",
          "mobile deposit",
          "MOBILE DEPOSIT CHECK #2214",
          120
        ],
        [
          "2026-08-08",
          "checking x2093",
          "debit card x7730",
          "PANERA BREAD #601447 TUCSON AZ",
          -23
        ],
        [
          "2026-08-08",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -51.41
        ],
        [
          "2026-08-09",
          "checking x2093",
          "ACH debit",
          "T-MOBILE AUTOPAY",
          -65
        ],
        [
          "2026-08-09",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -29.06
        ],
        [
          "2026-08-09",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -10.75
        ],
        [
          "2026-08-11",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -56.57
        ],
        [
          "2026-08-11",
          "checking x2093",
          "debit card x7730",
          "WALGREENS #3521 TUCSON AZ",
          -7.7
        ],
        [
          "2026-08-12",
          "checking x2093",
          "bill pay",
          "TUCSON ELECTRIC POWER (bill pay)",
          -121.32
        ],
        [
          "2026-08-14",
          "checking x2093",
          "ACH debit",
          "SOUTHWEST GAS CORP ONLINE PMT",
          -35.87
        ],
        [
          "2026-08-14",
          "checking x2093",
          "debit card x7730",
          "COSTCO OPTICAL #0483 TUCSON AZ",
          -287.4
        ],
        [
          "2026-08-14",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -91.27
        ],
        [
          "2026-08-15",
          "checking x2093",
          "ATM",
          "ATM WITHDRAWAL 4410 E BROADWAY BLVD TUCSON AZ",
          -100
        ],
        [
          "2026-08-15",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -56.14
        ],
        [
          "2026-08-15",
          "checking x2093",
          "debit card x7730",
          "NETFLIX.COM",
          -15.49
        ],
        [
          "2026-08-16",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -20.25
        ],
        [
          "2026-08-17",
          "checking x2093",
          "bill pay",
          "CITY OF TUCSON WATER (bill pay)",
          -69.66
        ],
        [
          "2026-08-17",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -41.77
        ],
        [
          "2026-08-17",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -116.54
        ],
        [
          "2026-08-18",
          "checking x2093",
          "debit card x7730",
          "WALGREENS #3521 TUCSON AZ",
          -13.52
        ],
        [
          "2026-08-19",
          "checking x2093",
          "ACH credit",
          "SSA TREAS 310 XXSOC SEC",
          1986
        ],
        [
          "2026-08-19",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -53.82
        ],
        [
          "2026-08-19",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -138.83
        ],
        [
          "2026-08-20",
          "checking x2093",
          "ACH debit",
          "STATE FARM INSURANCE PREM",
          -118.4
        ],
        [
          "2026-08-21",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -122.8
        ],
        [
          "2026-08-22",
          "checking x2093",
          "ACH debit",
          "CATALINA VISTA HOA DUES",
          -145
        ],
        [
          "2026-08-22",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -118.04
        ],
        [
          "2026-08-22",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -28.3
        ],
        [
          "2026-08-23",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -19.39
        ],
        [
          "2026-08-24",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -115.11
        ],
        [
          "2026-08-24",
          "checking x2093",
          "debit card x7730",
          "GOODWILL #213 TUCSON AZ",
          -24.59
        ],
        [
          "2026-08-26",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -124.12
        ],
        [
          "2026-08-26",
          "checking x2093",
          "debit card x7730",
          "MICHAELS #4521 TUCSON AZ",
          -33.69
        ],
        [
          "2026-08-26",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -37.05
        ],
        [
          "2026-08-26",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -38.76
        ],
        [
          "2026-08-26",
          "savings x6158",
          "transfer",
          "Transfer from checking x2093",
          400
        ],
        [
          "2026-08-26",
          "checking x2093",
          "transfer",
          "Transfer to savings x6158",
          -400
        ],
        [
          "2026-08-27",
          "checking x2093",
          "debit card x7730",
          "COSTCO WHSE #0483 TUCSON AZ",
          -143.11
        ],
        [
          "2026-08-27",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -95.82
        ],
        [
          "2026-08-28",
          "checking x2093",
          "Zelle out",
          "Zelle to Sofia Benitez",
          -50
        ],
        [
          "2026-08-29",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -37.57
        ],
        [
          "2026-08-29",
          "checking x2093",
          "debit card x7730",
          "GOODWILL #213 TUCSON AZ",
          -28.02
        ],
        [
          "2026-08-30",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -103.68
        ],
        [
          "2026-08-30",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -44.37
        ],
        [
          "2026-08-31",
          "checking x2093",
          "check",
          "CHECK #1188",
          -140
        ],
        [
          "2026-08-31",
          "savings x6158",
          "interest",
          "INTEREST PAID",
          11.31
        ],
        [
          "2026-09-01",
          "checking x2093",
          "ACH credit",
          "STATE TEACHERS RET SYS PENSION PPD",
          3412.66
        ],
        [
          "2026-09-01",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -17.08
        ],
        [
          "2026-09-03",
          "checking x2093",
          "ACH debit",
          "COX COMMUNICATIONS AUTOPAY",
          -89.99
        ],
        [
          "2026-09-05",
          "checking x2093",
          "bill pay",
          "ST AMBROSE PARISH (bill pay)",
          -100
        ],
        [
          "2026-09-05",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -56.86
        ],
        [
          "2026-09-06",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -50.41
        ],
        [
          "2026-09-07",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -106.78
        ],
        [
          "2026-09-07",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -71.52
        ],
        [
          "2026-09-07",
          "checking x2093",
          "debit card x7730",
          "WALGREENS #3521 TUCSON AZ",
          -23.14
        ],
        [
          "2026-09-08",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -75.84
        ],
        [
          "2026-09-08",
          "checking x2093",
          "debit card x7730",
          "PANERA BREAD #601447 TUCSON AZ",
          -13.22
        ],
        [
          "2026-09-09",
          "checking x2093",
          "ACH debit",
          "T-MOBILE AUTOPAY",
          -65
        ],
        [
          "2026-09-09",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -13.77
        ],
        [
          "2026-09-09",
          "checking x2093",
          "debit card x7730",
          "WALGREENS #3521 TUCSON AZ",
          -20.42
        ],
        [
          "2026-09-10",
          "checking x2093",
          "bill pay",
          "TUCSON ORTHOPAEDIC INST (bill pay)",
          -35
        ],
        [
          "2026-09-10",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -13.55
        ],
        [
          "2026-09-11",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -111.7
        ],
        [
          "2026-09-11",
          "checking x2093",
          "debit card x7730",
          "GOODWILL #213 TUCSON AZ",
          -8.14
        ],
        [
          "2026-09-12",
          "checking x2093",
          "bill pay",
          "TUCSON ELECTRIC POWER (bill pay)",
          -184.46
        ],
        [
          "2026-09-12",
          "checking x2093",
          "debit card x7730",
          "COSTCO WHSE #0483 TUCSON AZ",
          -203.74
        ],
        [
          "2026-09-12",
          "checking x2093",
          "debit card x7730",
          "PANERA BREAD #601447 TUCSON AZ",
          -12.71
        ],
        [
          "2026-09-13",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -41.45
        ],
        [
          "2026-09-14",
          "checking x2093",
          "ACH debit",
          "SOUTHWEST GAS CORP ONLINE PMT",
          -38.14
        ],
        [
          "2026-09-14",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -36.73
        ],
        [
          "2026-09-14",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -80.31
        ],
        [
          "2026-09-15",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -40.92
        ],
        [
          "2026-09-15",
          "checking x2093",
          "debit card x7730",
          "NETFLIX.COM",
          -15.49
        ],
        [
          "2026-09-16",
          "checking x2093",
          "ACH credit",
          "SSA TREAS 310 XXSOC SEC",
          1986
        ],
        [
          "2026-09-16",
          "checking x2093",
          "debit card x7730",
          "COSTCO WHSE #0483 TUCSON AZ",
          -203.06
        ],
        [
          "2026-09-16",
          "checking x2093",
          "debit card x7730",
          "MICHAELS #4521 TUCSON AZ",
          -38.81
        ],
        [
          "2026-09-16",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -28.88
        ],
        [
          "2026-09-17",
          "checking x2093",
          "bill pay",
          "CITY OF TUCSON WATER (bill pay)",
          -64.17
        ],
        [
          "2026-09-17",
          "checking x2093",
          "debit card x7730",
          "MICHAELS #4521 TUCSON AZ",
          -47.29
        ],
        [
          "2026-09-19",
          "checking x2093",
          "ATM",
          "ATM WITHDRAWAL 4410 E BROADWAY BLVD TUCSON AZ",
          -100
        ],
        [
          "2026-09-19",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -42.33
        ],
        [
          "2026-09-19",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -37.97
        ],
        [
          "2026-09-19",
          "checking x2093",
          "debit card x7730",
          "WALGREENS #3521 TUCSON AZ",
          -25.12
        ],
        [
          "2026-09-20",
          "checking x2093",
          "ACH debit",
          "STATE FARM INSURANCE PREM",
          -118.4
        ],
        [
          "2026-09-22",
          "checking x2093",
          "ACH debit",
          "CATALINA VISTA HOA DUES",
          -145
        ],
        [
          "2026-09-24",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -54.05
        ],
        [
          "2026-09-24",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -45.3
        ],
        [
          "2026-09-25",
          "checking x2093",
          "Zelle out",
          "Zelle to Sofia Benitez",
          -75
        ],
        [
          "2026-09-25",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -51.23
        ],
        [
          "2026-09-25",
          "checking x2093",
          "debit card x7730",
          "COSTCO WHSE #0483 TUCSON AZ",
          -95.31
        ],
        [
          "2026-09-26",
          "checking x2093",
          "debit card x7730",
          "COSTCO WHSE #0483 TUCSON AZ",
          -152.33
        ],
        [
          "2026-09-26",
          "checking x2093",
          "debit card x7730",
          "PANERA BREAD #601447 TUCSON AZ",
          -21.08
        ],
        [
          "2026-09-26",
          "savings x6158",
          "transfer",
          "Transfer from checking x2093",
          400
        ],
        [
          "2026-09-26",
          "checking x2093",
          "transfer",
          "Transfer to savings x6158",
          -400
        ],
        [
          "2026-09-28",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -49.13
        ],
        [
          "2026-09-30",
          "checking x2093",
          "check",
          "CHECK #1189",
          -140
        ],
        [
          "2026-09-30",
          "checking x2093",
          "debit card x7730",
          "CIRCLE K #2709451 TUCSON AZ",
          -48.13
        ],
        [
          "2026-09-30",
          "savings x6158",
          "interest",
          "INTEREST PAID",
          10.61
        ],
        [
          "2026-10-01",
          "checking x2093",
          "ACH credit",
          "STATE TEACHERS RET SYS PENSION PPD",
          3412.66
        ],
        [
          "2026-10-01",
          "checking x2093",
          "debit card x7730",
          "COSTCO WHSE #0483 TUCSON AZ",
          -115.59
        ],
        [
          "2026-10-01",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -110.41
        ],
        [
          "2026-10-03",
          "checking x2093",
          "ACH debit",
          "COX COMMUNICATIONS AUTOPAY",
          -89.99
        ],
        [
          "2026-10-05",
          "checking x2093",
          "bill pay",
          "ST AMBROSE PARISH (bill pay)",
          -100
        ],
        [
          "2026-10-05",
          "checking x2093",
          "debit card x7730",
          "FRYS FOOD #0673 TUCSON AZ",
          -63.29
        ],
        [
          "2026-10-06",
          "checking x2093",
          "debit card x7730",
          "MICHAELS #4521 TUCSON AZ",
          -31.53
        ],
        [
          "2026-10-06",
          "checking x2093",
          "debit card x7730",
          "SAFEWAY #1734 TUCSON AZ",
          -47.46
        ],
        [
          "2026-10-06",
          "checking x2093",
          "debit card x7730",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          -57.52
        ]
      ]
    },
    "card_authorizations": {
      "card": "debit x7730",
      "period": "2026-09-16 to 2026-10-07, approvals and declines",
      "columns": [
        "ts",
        "merchant",
        "mcc",
        "entry",
        "amount_usd",
        "result",
        "avs",
        "cvv2"
      ],
      "rows": [
        [
          "2026-09-16T00:22:19Z",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          "5411",
          "chip (05)",
          28.88,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-16T18:07:35Z",
          "MICHAELS #4521 TUCSON AZ",
          "5945",
          "contactless (07)",
          47.29,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-18T17:18:23Z",
          "FRYS FOOD #0673 TUCSON AZ",
          "5411",
          "contactless (07)",
          42.33,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-18T23:46:55Z",
          "WALGREENS #3521 TUCSON AZ",
          "5912",
          "chip (05)",
          25.12,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-19T00:49:40Z",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          "5411",
          "chip (05)",
          37.97,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-23T16:12:11Z",
          "CIRCLE K #2709451 TUCSON AZ",
          "5542",
          "chip (05)",
          54.05,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-23T18:20:14Z",
          "SAFEWAY #1734 TUCSON AZ",
          "5411",
          "contactless (07)",
          45.3,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-24T18:31:30Z",
          "CIRCLE K #2709451 TUCSON AZ",
          "5542",
          "contactless (07)",
          51.23,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-24T21:05:13Z",
          "COSTCO WHSE #0483 TUCSON AZ",
          "5300",
          "chip (05)",
          95.31,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-25T18:06:01Z",
          "COSTCO WHSE #0483 TUCSON AZ",
          "5300",
          "contactless (07)",
          152.33,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-26T00:16:17Z",
          "PANERA BREAD #601447 TUCSON AZ",
          "5814",
          "contactless (07)",
          21.08,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-28T00:45:26Z",
          "CIRCLE K #2709451 TUCSON AZ",
          "5542",
          "contactless (07)",
          49.13,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-29T17:37:31Z",
          "CIRCLE K #2709451 TUCSON AZ",
          "5542",
          "chip (05)",
          48.13,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-30T16:13:08Z",
          "FRYS FOOD #0673 TUCSON AZ",
          "5411",
          "chip (05)",
          110.41,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-30T19:03:24Z",
          "COSTCO WHSE #0483 TUCSON AZ",
          "5300",
          "contactless (07)",
          115.59,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-04T18:41:13Z",
          "FRYS FOOD #0673 TUCSON AZ",
          "5411",
          "chip (05)",
          63.29,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-05T20:57:58Z",
          "SPROUTS FARMERS MKT #142 TUCSON AZ",
          "5411",
          "contactless (07)",
          57.52,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-05T21:36:51Z",
          "MICHAELS #4521 TUCSON AZ",
          "5945",
          "contactless (07)",
          31.53,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-05T22:21:49Z",
          "SAFEWAY #1734 TUCSON AZ",
          "5411",
          "chip (05)",
          47.46,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-06T10:20:11Z",
          "VRT*DIGITALGOODS 800-555-0163 CA",
          "5818",
          "ecommerce (81)",
          1,
          "approved (00)",
          "Y",
          "P (not provided)"
        ],
        [
          "2026-10-06T10:31:40Z",
          "NOVAPIXEL ELECTRONICS NJ",
          "5732",
          "ecommerce (81)",
          389.97,
          "declined (N7 CVV2 mismatch)",
          "Y",
          "N"
        ],
        [
          "2026-10-06T10:32:55Z",
          "NOVAPIXEL ELECTRONICS NJ",
          "5732",
          "ecommerce (81)",
          389.97,
          "declined (N7 CVV2 mismatch)",
          "Y",
          "N"
        ],
        [
          "2026-10-06T10:42:02Z",
          "QUIKLOAD GIFTCARDS NV",
          "5999",
          "ecommerce (81)",
          250,
          "declined (59 suspected fraud: rule CNP after CVV2 failures)",
          "Y",
          "P (not provided)"
        ],
        [
          "2026-10-06T15:30:18Z",
          "SAFEWAY #1734 TUCSON AZ",
          "5411",
          "chip (05)",
          46.12,
          "approved (00)",
          "",
          ""
        ]
      ]
    },
    "contact_center_history": {
      "period": "last 12 months",
      "columns": [
        "ts",
        "channel",
        "caller",
        "verification",
        "reason",
        "outcome"
      ],
      "rows": [
        [
          "2026-01-14T17:41:00Z",
          "phone",
          "(520) 555-0117 (on file)",
          "SMS code",
          "Asked for her 1099-INT",
          "Mailed copy"
        ],
        [
          "2026-06-02T16:05:00Z",
          "phone",
          "(520) 555-0117 (on file)",
          "SMS code",
          "Ordered checks",
          "Order placed"
        ],
        [
          "2026-10-05T18:05:00Z",
          "phone",
          "(520) 555-0131 (not on file; carrier lookup: non-fixed VoIP)",
          "Name, date of birth, home address and email on file answered; last 4 of SSN not given ('doesn't have her card'); declined the code to the phone on file ('my phone is broken, that's why I'm calling')",
          "Caller said she was Gloria Benitez; asked to change the phone on file to (520) 555-0131 and to stop the text codes; then asked for the balance and recent large transactions",
          "Declined per procedure (needs a code or photo ID in a branch). Agent referral FR-26-04417 to Fraud Operations: 'could not verify'"
        ],
        [
          "2026-10-06T20:15:00Z",
          "phone",
          "(520) 555-0189 (not on file; carrier lookup: non-fixed VoIP)",
          "Name, date of birth, home address, email on file and last 4 of SSN answered correctly; declined the code to the phone on file ('my phone was stolen')",
          "Caller said she was Gloria Benitez; asked to replace the phone on file with (520) 555-0189 and to send a replacement debit card to a new mailing address ('staying with my daughter in Phoenix')",
          "Declined per procedure. Caller said she would 'come to a branch tomorrow with my ID'. Agent added the call to referral FR-26-04417. Referral status: queued, not yet reviewed"
        ]
      ]
    },
    "prior_alerts": [
      {
        "alert_id": "TI-20230612-1150",
        "received": "2023-06-12T14:20:00Z",
        "type": "Email address in a combo list (email and password pairs)",
        "detail": "Email on file paired with a password; our hash comparison matched neither the current nor any previous password",
        "disposition": "Closed, no action"
      }
    ],
    "alert": {
      "alert_id": "TI-20261007-0233",
      "received": "2026-10-07T11:58:00Z",
      "vendor_feed": "Threat intelligence vendor: compromised credentials from infostealer logs",
      "vendor_severity": "critical (log contains our bank's login and cookies)",
      "where_seen": "An automated log shop on Tor ($12 per log) and a private Telegram channel that reposts logs",
      "first_seen_by_vendor": "2026-10-05T06:12:00Z",
      "log": {
        "log_id": "a91c4e07f2",
        "malware": "Commodity infostealer sold as a service (vendor family code IS-114)",
        "captured": "2026-10-03T01:12:44Z",
        "computer_name": "DESKTOP-GB7H2LQ",
        "windows_user": "Gloria",
        "os": "Windows 10 Home 22H2",
        "browser": "Chrome 129",
        "ip_at_capture": "203.0.113.58",
        "timezone": "UTC-07:00 Arizona",
        "screen": "1920x1080",
        "antivirus": "Windows Defender",
        "launched_file": "C:\\Users\\Gloria\\Downloads\\Delivery_Notice_7781.pdf.exe",
        "sites_with_saved_passwords": 46,
        "cookies": 1288,
        "screenshot": "Desktop with an email inbox open; no account numbers or balances visible"
      },
      "entries_for_our_bank": {
        "login_url": "https://online.ourbank.example/login",
        "username": "gbenitez52",
        "password": "present (compared with our stored hashes, see alert_checks)",
        "cookies": [
          {
            "name": "tdt",
            "what": "trusted-device token",
            "expires": "2027-03-14"
          },
          {
            "name": "sid",
            "what": "session",
            "expires": "2026-10-03T01:42:00Z"
          },
          {
            "name": "lang",
            "what": "language preference",
            "expires": "2027-10-02"
          },
          {
            "name": "_ga",
            "what": "analytics",
            "expires": "2027-11-06"
          }
        ]
      },
      "other_entries_of_note": [
        "Password and session cookies for the webmail account gbenitez.home@example.net (the email on file)",
        "Username and password for the online account at the mobile carrier of the phone on file",
        "Browser autofill: full name, home address, phone number, date of birth",
        "Saved card: debit card ending 7730, expiry 04/28, name on card; no security code"
      ],
      "vendor_match": {
        "matched_on": [
          "online banking username",
          "email on file",
          "home address in autofill"
        ],
        "vendor_confidence": "high"
      }
    },
    "alert_checks": {
      "credential_check": {
        "method": "Password from the log hashed with this login's salt and algorithm and compared with the current and previous hashes; plaintext discarded, never logged",
        "matches_current_password": true,
        "matches_a_previous_password": false,
        "current_password_set": "2024-08-11T16:22:05Z"
      },
      "device_token_check": {
        "token_in_log": "tdt for dv_3a91 (the desktop, trusted since 2021-09-14)",
        "token_status": "active",
        "presented_since_capture": "7 successful sign-ins: 4 from 203.0.113.58 with matching fingerprint; 3 from 198.51.100.23 or 198.51.100.141 with a different fingerprint"
      },
      "log_machine_vs_our_records": "Computer name, screen size, timezone and capture IP match dv_3a91 and the customer's usual address",
      "balance_check": "Not applicable: the log's screenshot shows no balances"
    }
  },
  "questions": {
    "matches_customer": {
      "type": "noul",
      "instructions": "Does the vendor's alert refer to this customer's own login, account or card at our bank (including a card since closed or replaced), rather than to a different person?"
    },
    "still_exposed": {
      "type": "score",
      "instructions": "How likely is it that someone other than the customer can currently use the exposed data to sign in to this customer's online banking or make payments from the customer's accounts or cards?",
      "criteria": [
        "Very unlikely (under 10%)",
        "Unlikely (10-40%)",
        "Uncertain (40-60%)",
        "Likely (60-90%)",
        "Very likely (over 90%)"
      ]
    },
    "response": {
      "type": "choice",
      "instructions": "What should the bank do about this alert for this customer?",
      "criteria": {
        "no_action": "Log the alert and take no action: it doesn't match this customer, or nothing it exposes still works",
        "reset_step_up": "Force a password reset from a device not named in the alert, end all sessions, remove trusted devices and require a one-time code at the next sign-in",
        "reissue_card": "Block the exposed card and issue a new card number; online banking access needs no change",
        "restrict_contact": "Restrict outbound payments, new payees and contact-detail changes until the customer is reached at the phone number on file"
      }
    }
  }
}