{
  "model": "grayson-1",
  "state": {
    "case": {
      "case_id": "DW-26-001162",
      "opened": "2026-10-06T13:40:20Z",
      "queue": "Dark web alerts",
      "records_as_of": "2026-10-06T14:05:00Z"
    },
    "customer": {
      "customer_id": "cus_30915",
      "name": "Priya Raman",
      "age": 36,
      "home": "Raleigh, NC",
      "customer_since": "2017-08-14",
      "occupation_on_file": "Software quality engineer",
      "online_banking_username": "praman_nc",
      "online_banking_since": "2017-08-14",
      "accounts": [
        {
          "account": "checking x8834",
          "opened": "2017-08-14",
          "status": "open",
          "balance_usd": 9663.37
        },
        {
          "account": "savings x2290",
          "opened": "2019-01-07",
          "status": "open",
          "balance_usd": 14484.97
        }
      ],
      "debit_card": {
        "card": "x4471",
        "on_account": "checking x8834",
        "issued": "2025-11-03 (renewal at expiry)",
        "expires": "11/29",
        "status": "active",
        "wallets": "none"
      },
      "phone_on_file": {
        "number": "(919) 555-0164",
        "line_type": "mobile",
        "last_changed": "2017-08-14",
        "carrier_sim_change_check": "No SIM change or port-out in 90 days (checked 2026-10-06T13:52Z)"
      },
      "email_on_file": {
        "address": "priya.raman@example.com",
        "last_changed": "2019-05-20"
      },
      "address_last_changed": "2025-02-03",
      "alert_settings": "Email alerts for new devices and for transfers over $250; SMS card decline alerts",
      "travel_notices": "Portugal, 2026-09-12 to 2026-09-20",
      "usual_sign_in_addresses": "203.0.113.164 (home fiber ISP, Raleigh NC, since 2025-02) for all devices; mobile carrier addresses for the app"
    },
    "sign_in_security": "Online banking uses a username and password. A device becomes trusted after a one-time code sent by SMS to the phone on file, if the customer ticks 'remember this device'; a trusted device (a token stored in a browser cookie) skips the code at sign-in. The mobile app signs in with Face ID or fingerprint after its first code. Codes are also required to add a Zelle recipient or an external transfer account, to change the phone, email or address on file, and to raise transfer limits. Bill-pay payees paid by mailed check, alert settings and statement preferences change without a code. 'Forgot password' emails a reset link to the email on file; a code is required after the reset unless the device is trusted. Changing the password does not end other sessions or remove trusted devices. A sign-in from a new country triggers an SMS 'Was this you?' check. By phone, contact-detail changes need a code to the phone on file or photo ID in a branch.",
    "devices": {
      "columns": [
        "device_id",
        "device",
        "first_seen",
        "trusted_since",
        "status",
        "last_seen"
      ],
      "rows": [
        [
          "dv_6b02",
          "Windows 10 · Edge (laptop LAPTOP-PR5T8Q)",
          "2021-02-11",
          "2021-02-11",
          "removed 2024-04-09 (dark web alert TI-20240409-0087)",
          "2024-04-08"
        ],
        [
          "dv_a20e",
          "iPhone 15 Pro · app",
          "2023-10-07",
          "2023-10-07",
          "trusted",
          "2026-10-06"
        ],
        [
          "dv_c7d4",
          "MacBook Air · Safari",
          "2024-05-02",
          "2024-05-02",
          "trusted",
          "2026-10-04"
        ],
        [
          "dv_e913",
          "iPad (10th gen) · Safari",
          "2026-09-29",
          "2026-09-29",
          "trusted",
          "2026-10-06"
        ]
      ]
    },
    "credential_and_contact_changes": {
      "columns": [
        "ts",
        "change",
        "channel",
        "device_id",
        "ip",
        "verification"
      ],
      "rows": [
        [
          "2017-08-14T15:30:00Z",
          "Online banking enrolled",
          "branch",
          "",
          "",
          "photo ID"
        ],
        [
          "2019-05-20T23:12:48Z",
          "Email on file changed",
          "web",
          "",
          "",
          "SMS code"
        ],
        [
          "2021-02-11T01:04:33Z",
          "Device trusted: dv_6b02",
          "web",
          "dv_6b02",
          "",
          "SMS code"
        ],
        [
          "2023-10-07T18:22:10Z",
          "Device trusted: dv_a20e (app)",
          "app",
          "dv_a20e",
          "",
          "SMS code"
        ],
        [
          "2024-04-09T15:02:00Z",
          "Analyst action on TI-20240409-0087: all sessions ended, dv_6b02 removed, password reset required",
          "staff",
          "",
          "",
          ""
        ],
        [
          "2024-04-09T16:48:19Z",
          "Password changed (forced reset)",
          "app",
          "dv_a20e",
          "",
          "SMS code"
        ],
        [
          "2024-05-02T00:41:55Z",
          "Device trusted: dv_c7d4",
          "web",
          "dv_c7d4",
          "",
          "SMS code"
        ],
        [
          "2025-02-03T17:10:00Z",
          "Address on file changed (moved within Raleigh)",
          "branch",
          "",
          "",
          "photo ID and lease"
        ],
        [
          "2025-06-17T00:20:31Z",
          "Password changed",
          "web",
          "dv_c7d4",
          "",
          "current password"
        ],
        [
          "2026-07-22T12:05:40Z",
          "Password reset via 'forgot password' email link",
          "web",
          "dv_c7d4",
          "203.0.113.164",
          "email link + SMS code"
        ],
        [
          "2026-09-29T00:47:52Z",
          "Device trusted: dv_e913",
          "web",
          "dv_e913",
          "203.0.113.164",
          "SMS code"
        ]
      ]
    },
    "payees": {
      "columns": [
        "payee",
        "type",
        "added",
        "added_from",
        "verification",
        "payments_last_90_days",
        "last_paid"
      ],
      "rows": [
        [
          "Duke Energy Progress",
          "bill pay",
          "2025-02-05",
          "web",
          "none required",
          3,
          "2026-09-08"
        ],
        [
          "WakeMed Physician Practices",
          "bill pay",
          "2026-08-19",
          "web",
          "none required",
          1,
          "2026-08-19"
        ],
        [
          "Maya Chen",
          "Zelle",
          "2023-03-11",
          "app",
          "SMS code",
          1,
          "2026-07-26"
        ],
        [
          "Ananya Raman",
          "Zelle",
          "2026-09-01",
          "app",
          "SMS code",
          1,
          "2026-09-01"
        ]
      ]
    },
    "sign_in_history": {
      "period": "2026-07-08 to 2026-10-06T14:05Z, all channels",
      "columns": [
        "ts",
        "device_id",
        "ip",
        "ip_info",
        "method",
        "fingerprint",
        "result",
        "minutes",
        "activity"
      ],
      "rows": [
        [
          "2026-07-09T00:02:42Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-07-09T11:26:33Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-07-10T23:18:52Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances"
        ],
        [
          "2026-07-11T00:16:54Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-07-11T12:34:31Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-07-14T00:36:45Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-07-14T12:37:39Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-07-15T12:12:19Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-07-17T00:50:41Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-07-18T01:07:56Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-07-18T17:33:19Z",
          "dv_a20e",
          "192.0.2.171",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-07-19T17:54:14Z",
          "dv_a20e",
          "192.0.2.186",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-07-19T23:18:30Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          7,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-07-22T12:02:30Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password: incorrect",
          "match",
          "failed",
          0,
          ""
        ],
        [
          "2026-07-22T12:03:05Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password: incorrect",
          "match",
          "failed",
          0,
          ""
        ],
        [
          "2026-07-22T12:05:30Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password reset by email link + SMS code",
          "match",
          "success",
          4,
          "password changed; balances"
        ],
        [
          "2026-07-23T00:11:03Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          12,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-07-23T01:51:05Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-07-23T11:06:59Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-07-24T11:47:11Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-07-24T23:49:30Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          7,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-07-25T11:49:23Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-07-26T17:02:40Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "Zelle to Maya Chen $42.00"
        ],
        [
          "2026-07-26T23:29:05Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-07-28T02:27:21Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-07-28T17:09:54Z",
          "dv_a20e",
          "192.0.2.152",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-07-30T00:17:05Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-07-30T16:12:23Z",
          "dv_a20e",
          "192.0.2.199",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-01T01:16:49Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-08-02T00:35:18Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-08-03T02:33:57Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "card controls viewed"
        ],
        [
          "2026-08-03T12:02:02Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "card controls viewed"
        ],
        [
          "2026-08-05T00:55:22Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-08-05T01:40:11Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          12,
          "balances; transactions"
        ],
        [
          "2026-08-05T12:38:57Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "card controls viewed"
        ],
        [
          "2026-08-05T23:17:08Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          10,
          "balances; transactions"
        ],
        [
          "2026-08-06T23:16:30Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "card controls viewed"
        ],
        [
          "2026-08-09T02:09:15Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-08-09T23:37:16Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-08-10T12:02:31Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "card controls viewed"
        ],
        [
          "2026-08-11T00:20:58Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          7,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-08-12T02:03:44Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-08-13T02:35:43Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-08-14T00:49:22Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "card controls viewed"
        ],
        [
          "2026-08-14T12:52:43Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-08-15T16:00:02Z",
          "dv_a20e",
          "192.0.2.171",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-17T16:49:51Z",
          "dv_a20e",
          "192.0.2.224",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-08-19T01:01:06Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "transactions"
        ],
        [
          "2026-08-19T02:57:56Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          3,
          "balances; transactions"
        ],
        [
          "2026-08-20T00:11:09Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          4,
          "bill pay: WakeMed Physician Practices $45.00"
        ],
        [
          "2026-08-20T00:47:53Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-08-20T02:41:54Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          9,
          "balances; transactions"
        ],
        [
          "2026-08-20T12:59:24Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "card controls viewed"
        ],
        [
          "2026-08-22T01:33:36Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-08-22T11:52:53Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-08-23T16:54:56Z",
          "dv_a20e",
          "192.0.2.152",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-08-25T00:25:15Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-08-25T23:57:17Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-08-26T12:49:16Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-08-28T01:45:06Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "transactions"
        ],
        [
          "2026-08-29T11:15:58Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "card controls viewed"
        ],
        [
          "2026-08-30T23:22:45Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-09-01T01:00:56Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-09-01T17:45:41Z",
          "dv_a20e",
          "192.0.2.186",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-01T23:22:05Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          5,
          "add Zelle recipient Ananya Raman (code entered); Zelle to Ananya Raman $600.00"
        ],
        [
          "2026-09-04T00:17:42Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          8,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-09-05T02:53:11Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "card controls viewed"
        ],
        [
          "2026-09-05T12:26:40Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-09-07T02:09:38Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-09-08T17:27:46Z",
          "dv_a20e",
          "192.0.2.152",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "card controls viewed"
        ],
        [
          "2026-09-08T23:15:51Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          10,
          "bill pay: scheduled payments viewed"
        ],
        [
          "2026-09-09T01:03:55Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          3,
          "travel notice added: Portugal 2026-09-12 to 2026-09-20"
        ],
        [
          "2026-09-10T00:04:16Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-10T11:15:22Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-09-11T17:53:29Z",
          "dv_a20e",
          "192.0.2.186",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-09-12T09:14:02Z",
          "dv_a20e",
          "192.0.2.31",
          "Mobile carrier (roaming partner), Lisbon PT",
          "Face ID (app)",
          "match",
          "success",
          2,
          "balances"
        ],
        [
          "2026-09-13T22:32:34Z",
          "dv_a20e",
          "198.51.100.212",
          "Hotel Wi-Fi, Lisbon PT",
          "Face ID (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-09-14T22:55:31Z",
          "dv_a20e",
          "192.0.2.31",
          "Mobile carrier (roaming partner), Lisbon PT",
          "Face ID (app)",
          "match",
          "success",
          4,
          "balances"
        ],
        [
          "2026-09-16T19:30:15Z",
          "dv_a20e",
          "192.0.2.31",
          "Mobile carrier (roaming partner), Lisbon PT",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-20T10:55:15Z",
          "dv_a20e",
          "192.0.2.31",
          "Mobile carrier (roaming partner), Lisbon PT",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-22T00:16:24Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "card controls viewed"
        ],
        [
          "2026-09-22T12:44:00Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-09-23T12:03:22Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "transactions"
        ],
        [
          "2026-09-24T11:48:23Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-09-25T00:03:47Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances; transactions"
        ],
        [
          "2026-09-26T00:26:11Z",
          "dv_c7d4",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          9,
          "balances"
        ],
        [
          "2026-09-26T01:11:03Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-09-26T16:20:55Z",
          "dv_a20e",
          "192.0.2.186",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "card controls viewed"
        ],
        [
          "2026-09-27T17:40:48Z",
          "dv_a20e",
          "192.0.2.224",
          "Mobile carrier, NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "transactions"
        ],
        [
          "2026-09-29T00:24:10Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-09-29T00:47:11Z",
          "dv_e913",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + SMS code ('remember this device' ticked)",
          "new device",
          "success",
          7,
          "balances; transactions"
        ],
        [
          "2026-09-30T01:18:05Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          1,
          "balances"
        ],
        [
          "2026-09-30T23:16:53Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-10-01T02:25:45Z",
          "dv_e913",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances"
        ],
        [
          "2026-10-02T01:35:55Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          2,
          "card controls viewed"
        ],
        [
          "2026-10-02T02:42:22Z",
          "dv_e913",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances"
        ],
        [
          "2026-10-03T01:15:03Z",
          "dv_e913",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password: incorrect",
          "match",
          "failed",
          0,
          ""
        ],
        [
          "2026-10-03T01:15:23Z",
          "dv_e913",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password: incorrect",
          "match",
          "failed",
          0,
          ""
        ],
        [
          "2026-10-03T01:16:18Z",
          "dv_e913",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          5,
          "balances"
        ],
        [
          "2026-10-03T02:43:48Z",
          "dv_e913",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances"
        ],
        [
          "2026-10-03T02:47:33Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          3,
          "balances"
        ],
        [
          "2026-10-05T00:50:33Z",
          "dv_a20e",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "Face ID (app)",
          "match",
          "success",
          4,
          "transactions"
        ],
        [
          "2026-10-05T01:56:42Z",
          "dv_e913",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          6,
          "balances"
        ],
        [
          "2026-10-06T02:09:49Z",
          "dv_e913",
          "203.0.113.164",
          "Residential fiber ISP, Raleigh NC",
          "password + trusted device",
          "match",
          "success",
          3,
          "balances"
        ]
      ]
    },
    "security_messages": {
      "period": "2026-07-08 to 2026-10-06",
      "columns": [
        "ts",
        "channel",
        "to",
        "message",
        "outcome"
      ],
      "rows": [
        [
          "2026-07-09T10:00:00Z",
          "email",
          "priya.raman@example.com",
          "Your statement is ready",
          "sent"
        ],
        [
          "2026-07-22T12:04:00Z",
          "email",
          "priya.raman@example.com",
          "Password reset link",
          "link opened 2026-07-22T12:05Z from dv_c7d4"
        ],
        [
          "2026-07-22T12:05:00Z",
          "SMS",
          "(919) 555-0164",
          "Code to finish your password reset",
          "entered"
        ],
        [
          "2026-07-22T12:06:00Z",
          "email",
          "priya.raman@example.com",
          "Your password was changed",
          "sent"
        ],
        [
          "2026-08-09T10:00:00Z",
          "email",
          "priya.raman@example.com",
          "Your statement is ready",
          "sent"
        ],
        [
          "2026-09-01T23:23:00Z",
          "SMS",
          "(919) 555-0164",
          "Code to add a Zelle recipient",
          "entered"
        ],
        [
          "2026-09-09T01:05:00Z",
          "email",
          "priya.raman@example.com",
          "Travel notice saved: Portugal 9/12 to 9/20",
          "sent"
        ],
        [
          "2026-09-09T10:00:00Z",
          "email",
          "priya.raman@example.com",
          "Your statement is ready",
          "sent"
        ],
        [
          "2026-09-12T09:15:02Z",
          "SMS",
          "(919) 555-0164",
          "New sign-in from Portugal. Was this you? Reply YES or NO",
          "replied YES at 2026-09-12T09:16:40Z"
        ],
        [
          "2026-09-17T19:32:00Z",
          "SMS",
          "(919) 555-0164",
          "Card x4471 declined at TABERNA DA RUA DAS FLORES: insert your card and enter your PIN",
          "sent"
        ],
        [
          "2026-09-29T00:47:51Z",
          "SMS",
          "(919) 555-0164",
          "Code to sign in on a new device",
          "entered"
        ],
        [
          "2026-09-29T00:48:11Z",
          "email",
          "priya.raman@example.com",
          "A new device was added to your account (iPad, Raleigh NC)",
          "sent"
        ]
      ]
    },
    "account_activity": {
      "period": "posted 2026-07-08 to 2026-10-05",
      "columns": [
        "posted",
        "account",
        "type",
        "description",
        "amount_usd"
      ],
      "rows": [
        [
          "2026-07-08",
          "checking x8834",
          "bill pay",
          "DUKE ENERGY PROGRESS (bill pay)",
          -113.59
        ],
        [
          "2026-07-09",
          "checking x8834",
          "debit card x4471",
          "BURNT OAK BREWING RALEIGH NC",
          -47.94
        ],
        [
          "2026-07-09",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -76.16
        ],
        [
          "2026-07-10",
          "checking x8834",
          "ACH credit",
          "LINDQVIST SOFTWARE PAYROLL PPD",
          2846.19
        ],
        [
          "2026-07-10",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -90.6
        ],
        [
          "2026-07-11",
          "checking x8834",
          "ACH debit",
          "VERIZON WIRELESS AUTOPAY",
          -85
        ],
        [
          "2026-07-12",
          "checking x8834",
          "debit card x4471",
          "SHELL OIL 57544281 RALEIGH NC",
          -32.2
        ],
        [
          "2026-07-12",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -45.02
        ],
        [
          "2026-07-13",
          "checking x8834",
          "debit card x4471",
          "AMAZON.COM*NB7QW55E2",
          -32.63
        ],
        [
          "2026-07-15",
          "checking x8834",
          "ACH debit",
          "PLANET FITNESS CLUB FEES",
          -24.99
        ],
        [
          "2026-07-15",
          "checking x8834",
          "debit card x4471",
          "SHELL OIL 57544281 RALEIGH NC",
          -39.91
        ],
        [
          "2026-07-16",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -93.34
        ],
        [
          "2026-07-16",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -11.14
        ],
        [
          "2026-07-16",
          "savings x2290",
          "transfer",
          "Transfer from checking x8834",
          500
        ],
        [
          "2026-07-16",
          "checking x8834",
          "transfer",
          "Transfer to savings x2290",
          -500
        ],
        [
          "2026-07-18",
          "checking x8834",
          "ACH debit",
          "DOMINION ENERGY NC ONLINE PMT",
          -27.46
        ],
        [
          "2026-07-18",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -25.19
        ],
        [
          "2026-07-18",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -6.54
        ],
        [
          "2026-07-19",
          "checking x8834",
          "debit card x4471",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -45.75
        ],
        [
          "2026-07-19",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -29.7
        ],
        [
          "2026-07-20",
          "checking x8834",
          "debit card x4471",
          "BOOKING.COM HOTEL AMSTERDAM NLD",
          -1046.8
        ],
        [
          "2026-07-20",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -67.75
        ],
        [
          "2026-07-20",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -11.18
        ],
        [
          "2026-07-20",
          "checking x8834",
          "debit card x4471",
          "TAP AIR PORTUGAL 0478 LISBOA PRT",
          -912.36
        ],
        [
          "2026-07-20",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP HELP.UBER.COM CA",
          -26.66
        ],
        [
          "2026-07-20",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -31.4
        ],
        [
          "2026-07-20",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -27.37
        ],
        [
          "2026-07-21",
          "checking x8834",
          "debit card x4471",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -38.47
        ],
        [
          "2026-07-21",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -57.94
        ],
        [
          "2026-07-21",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -6.59
        ],
        [
          "2026-07-22",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -114.86
        ],
        [
          "2026-07-22",
          "checking x8834",
          "debit card x4471",
          "SPOTIFY USA",
          -11.99
        ],
        [
          "2026-07-23",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -42.32
        ],
        [
          "2026-07-24",
          "checking x8834",
          "ACH credit",
          "LINDQVIST SOFTWARE PAYROLL PPD",
          2846.19
        ],
        [
          "2026-07-24",
          "checking x8834",
          "ACH debit",
          "NAVIENT STUDENT LOAN PMT",
          -312.48
        ],
        [
          "2026-07-25",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -116.89
        ],
        [
          "2026-07-26",
          "checking x8834",
          "Zelle out",
          "Zelle to Maya Chen",
          -42
        ],
        [
          "2026-07-26",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -112.23
        ],
        [
          "2026-07-26",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -25.83
        ],
        [
          "2026-07-27",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -19.83
        ],
        [
          "2026-07-28",
          "checking x8834",
          "debit card x4471",
          "ICLOUD.COM/BILL",
          -2.99
        ],
        [
          "2026-07-29",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -5.32
        ],
        [
          "2026-07-29",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP HELP.UBER.COM CA",
          -15.61
        ],
        [
          "2026-07-31",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -52.18
        ],
        [
          "2026-07-31",
          "savings x2290",
          "interest",
          "INTEREST PAID",
          32.74
        ],
        [
          "2026-08-01",
          "checking x8834",
          "ACH debit",
          "OAKWELL APARTMENTS RENT WEB",
          -1875
        ],
        [
          "2026-08-01",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -9.7
        ],
        [
          "2026-08-01",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -22.5
        ],
        [
          "2026-08-02",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -41.69
        ],
        [
          "2026-08-03",
          "checking x8834",
          "debit card x4471",
          "TARGET 00019 RALEIGH NC",
          -90.05
        ],
        [
          "2026-08-03",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -22.92
        ],
        [
          "2026-08-04",
          "checking x8834",
          "ACH debit",
          "SPECTRUM AUTOPAY",
          -69.99
        ],
        [
          "2026-08-05",
          "checking x8834",
          "debit card x4471",
          "BURNT OAK BREWING RALEIGH NC",
          -24.6
        ],
        [
          "2026-08-07",
          "checking x8834",
          "ACH credit",
          "LINDQVIST SOFTWARE PAYROLL PPD",
          2846.19
        ],
        [
          "2026-08-07",
          "checking x8834",
          "debit card x4471",
          "NETFLIX.COM",
          -15.49
        ],
        [
          "2026-08-08",
          "checking x8834",
          "bill pay",
          "DUKE ENERGY PROGRESS (bill pay)",
          -114.32
        ],
        [
          "2026-08-08",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -7.02
        ],
        [
          "2026-08-08",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP HELP.UBER.COM CA",
          -12.09
        ],
        [
          "2026-08-09",
          "checking x8834",
          "debit card x4471",
          "AMAZON.COM*PL41X09N3",
          -83.45
        ],
        [
          "2026-08-09",
          "checking x8834",
          "debit card x4471",
          "SHELL OIL 57544281 RALEIGH NC",
          -47.69
        ],
        [
          "2026-08-09",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -5.76
        ],
        [
          "2026-08-10",
          "checking x8834",
          "debit card x4471",
          "CVS/PHARMACY #07216 RALEIGH NC",
          -33.94
        ],
        [
          "2026-08-10",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP HELP.UBER.COM CA",
          -17.4
        ],
        [
          "2026-08-11",
          "checking x8834",
          "ACH debit",
          "VERIZON WIRELESS AUTOPAY",
          -85
        ],
        [
          "2026-08-13",
          "checking x8834",
          "debit card x4471",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -44.98
        ],
        [
          "2026-08-15",
          "checking x8834",
          "ACH debit",
          "PLANET FITNESS CLUB FEES",
          -24.99
        ],
        [
          "2026-08-16",
          "checking x8834",
          "debit card x4471",
          "CVS/PHARMACY #07216 RALEIGH NC",
          -19.71
        ],
        [
          "2026-08-16",
          "savings x2290",
          "transfer",
          "Transfer from checking x8834",
          500
        ],
        [
          "2026-08-16",
          "checking x8834",
          "transfer",
          "Transfer to savings x2290",
          -500
        ],
        [
          "2026-08-17",
          "checking x8834",
          "debit card x4471",
          "AMAZON.COM*TT3MD81K0",
          -77.95
        ],
        [
          "2026-08-18",
          "checking x8834",
          "ACH debit",
          "DOMINION ENERGY NC ONLINE PMT",
          -32.51
        ],
        [
          "2026-08-19",
          "checking x8834",
          "bill pay",
          "WAKEMED PHYSICIAN PRACTICES (bill pay)",
          -45
        ],
        [
          "2026-08-20",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -34.27
        ],
        [
          "2026-08-20",
          "checking x8834",
          "debit card x4471",
          "TARGET 00019 RALEIGH NC",
          -95.93
        ],
        [
          "2026-08-21",
          "checking x8834",
          "ACH credit",
          "LINDQVIST SOFTWARE PAYROLL PPD",
          2846.19
        ],
        [
          "2026-08-21",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -30.91
        ],
        [
          "2026-08-22",
          "checking x8834",
          "debit card x4471",
          "SPOTIFY USA",
          -11.99
        ],
        [
          "2026-08-22",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -10.64
        ],
        [
          "2026-08-23",
          "checking x8834",
          "debit card x4471",
          "CVS/PHARMACY #07216 RALEIGH NC",
          -34.09
        ],
        [
          "2026-08-24",
          "checking x8834",
          "ACH debit",
          "NAVIENT STUDENT LOAN PMT",
          -312.48
        ],
        [
          "2026-08-25",
          "checking x8834",
          "debit card x4471",
          "SHELL OIL 57544281 RALEIGH NC",
          -32.14
        ],
        [
          "2026-08-26",
          "checking x8834",
          "debit card x4471",
          "BURNT OAK BREWING RALEIGH NC",
          -25.43
        ],
        [
          "2026-08-27",
          "checking x8834",
          "debit card x4471",
          "AMAZON.COM*ZK8RT2LQ1",
          -20.41
        ],
        [
          "2026-08-27",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -42.75
        ],
        [
          "2026-08-28",
          "checking x8834",
          "debit card x4471",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -38.88
        ],
        [
          "2026-08-28",
          "checking x8834",
          "debit card x4471",
          "ICLOUD.COM/BILL",
          -2.99
        ],
        [
          "2026-08-30",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -60.73
        ],
        [
          "2026-08-31",
          "checking x8834",
          "debit card x4471",
          "SHELL OIL 57544281 RALEIGH NC",
          -32.29
        ],
        [
          "2026-08-31",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -9.72
        ],
        [
          "2026-08-31",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP HELP.UBER.COM CA",
          -17.68
        ],
        [
          "2026-08-31",
          "savings x2290",
          "interest",
          "INTEREST PAID",
          35.98
        ],
        [
          "2026-09-01",
          "checking x8834",
          "ACH debit",
          "OAKWELL APARTMENTS RENT WEB",
          -1875
        ],
        [
          "2026-09-01",
          "checking x8834",
          "Zelle out",
          "Zelle to Ananya Raman",
          -600
        ],
        [
          "2026-09-02",
          "checking x8834",
          "debit card x4471",
          "BURNT OAK BREWING RALEIGH NC",
          -16.22
        ],
        [
          "2026-09-03",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -63.65
        ],
        [
          "2026-09-03",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -55.57
        ],
        [
          "2026-09-04",
          "checking x8834",
          "ACH credit",
          "LINDQVIST SOFTWARE PAYROLL PPD",
          2846.19
        ],
        [
          "2026-09-04",
          "checking x8834",
          "ACH debit",
          "SPECTRUM AUTOPAY",
          -69.99
        ],
        [
          "2026-09-05",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -11.39
        ],
        [
          "2026-09-07",
          "checking x8834",
          "debit card x4471",
          "NETFLIX.COM",
          -15.49
        ],
        [
          "2026-09-08",
          "checking x8834",
          "bill pay",
          "DUKE ENERGY PROGRESS (bill pay)",
          -145.23
        ],
        [
          "2026-09-10",
          "checking x8834",
          "debit card x4471",
          "BURNT OAK BREWING RALEIGH NC",
          -27.02
        ],
        [
          "2026-09-10",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -86.97
        ],
        [
          "2026-09-10",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -48.9
        ],
        [
          "2026-09-11",
          "checking x8834",
          "ACH debit",
          "VERIZON WIRELESS AUTOPAY",
          -85
        ],
        [
          "2026-09-12",
          "checking x8834",
          "debit card x4471",
          "CVS/PHARMACY #07216 RALEIGH NC",
          -24.9
        ],
        [
          "2026-09-12",
          "checking x8834",
          "debit card x4471",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -29.91
        ],
        [
          "2026-09-12",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -32.36
        ],
        [
          "2026-09-13",
          "checking x8834",
          "debit card x4471",
          "FARMACIA ESTRELA LISBOA PRT",
          -21.84
        ],
        [
          "2026-09-13",
          "checking x8834",
          "debit card x4471",
          "PASTELARIA ALFAMA LISBOA PRT",
          -9.15
        ],
        [
          "2026-09-13",
          "checking x8834",
          "debit card x4471",
          "PINGO DOCE LISBOA PRT",
          -7.21
        ],
        [
          "2026-09-13",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.22
        ],
        [
          "2026-09-13",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.27
        ],
        [
          "2026-09-13",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.66
        ],
        [
          "2026-09-14",
          "checking x8834",
          "ATM",
          "ATM WITHDRAWAL MULTIBANCO LISBOA PRT (EUR 100)",
          -117.42
        ],
        [
          "2026-09-14",
          "checking x8834",
          "debit card x4471",
          "PINGO DOCE LISBOA PRT",
          -11.58
        ],
        [
          "2026-09-14",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP LISBOA PRT",
          -7.98
        ],
        [
          "2026-09-14",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.35
        ],
        [
          "2026-09-14",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.24
        ],
        [
          "2026-09-14",
          "checking x8834",
          "fee",
          "NON-NETWORK ATM FEE",
          -5
        ],
        [
          "2026-09-15",
          "checking x8834",
          "ACH debit",
          "PLANET FITNESS CLUB FEES",
          -24.99
        ],
        [
          "2026-09-15",
          "checking x8834",
          "debit card x4471",
          "PINGO DOCE LISBOA PRT",
          -29.11
        ],
        [
          "2026-09-15",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP LISBOA PRT",
          -6.73
        ],
        [
          "2026-09-15",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.87
        ],
        [
          "2026-09-15",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.2
        ],
        [
          "2026-09-16",
          "checking x8834",
          "debit card x4471",
          "METRO LISBOA PRT",
          -7.4
        ],
        [
          "2026-09-16",
          "checking x8834",
          "debit card x4471",
          "MUSEU CALOUSTE GULBENKIAN LISBOA PRT",
          -21.8
        ],
        [
          "2026-09-16",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.22
        ],
        [
          "2026-09-16",
          "savings x2290",
          "transfer",
          "Transfer from checking x8834",
          500
        ],
        [
          "2026-09-16",
          "checking x8834",
          "transfer",
          "Transfer to savings x2290",
          -500
        ],
        [
          "2026-09-17",
          "checking x8834",
          "debit card x4471",
          "PASTELARIA ALFAMA LISBOA PRT",
          -4.98
        ],
        [
          "2026-09-17",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP LISBOA PRT",
          -10.01
        ],
        [
          "2026-09-17",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.3
        ],
        [
          "2026-09-17",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.15
        ],
        [
          "2026-09-18",
          "checking x8834",
          "ACH credit",
          "LINDQVIST SOFTWARE PAYROLL PPD",
          2846.19
        ],
        [
          "2026-09-18",
          "checking x8834",
          "ACH debit",
          "DOMINION ENERGY NC ONLINE PMT",
          -34.08
        ],
        [
          "2026-09-18",
          "checking x8834",
          "debit card x4471",
          "FARMACIA ESTRELA LISBOA PRT",
          -10.57
        ],
        [
          "2026-09-18",
          "checking x8834",
          "debit card x4471",
          "PINGO DOCE LISBOA PRT",
          -28.68
        ],
        [
          "2026-09-18",
          "checking x8834",
          "debit card x4471",
          "TABERNA DA RUA DAS FLORES LISBOA PRT",
          -64.1
        ],
        [
          "2026-09-18",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP LISBOA PRT",
          -13.6
        ],
        [
          "2026-09-18",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.86
        ],
        [
          "2026-09-18",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.41
        ],
        [
          "2026-09-18",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.32
        ],
        [
          "2026-09-18",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -1.92
        ],
        [
          "2026-09-19",
          "checking x8834",
          "debit card x4471",
          "PINGO DOCE LISBOA PRT",
          -19.39
        ],
        [
          "2026-09-19",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.58
        ],
        [
          "2026-09-20",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP LISBOA PRT",
          -7.49
        ],
        [
          "2026-09-20",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.22
        ],
        [
          "2026-09-21",
          "checking x8834",
          "debit card x4471",
          "PASTELARIA ALFAMA LISBOA PRT",
          -6.39
        ],
        [
          "2026-09-21",
          "checking x8834",
          "debit card x4471",
          "PINGO DOCE LISBOA PRT",
          -19.05
        ],
        [
          "2026-09-21",
          "checking x8834",
          "debit card x4471",
          "TIME OUT MARKET LISBOA PRT",
          -23.19
        ],
        [
          "2026-09-21",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP LISBOA PRT",
          -8.92
        ],
        [
          "2026-09-21",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.57
        ],
        [
          "2026-09-21",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.27
        ],
        [
          "2026-09-21",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.19
        ],
        [
          "2026-09-21",
          "checking x8834",
          "fee",
          "FOREIGN TRANSACTION FEE",
          -0.7
        ],
        [
          "2026-09-22",
          "checking x8834",
          "debit card x4471",
          "SPOTIFY USA",
          -11.99
        ],
        [
          "2026-09-22",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -5.77
        ],
        [
          "2026-09-23",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -7.34
        ],
        [
          "2026-09-24",
          "checking x8834",
          "ACH debit",
          "NAVIENT STUDENT LOAN PMT",
          -312.48
        ],
        [
          "2026-09-24",
          "checking x8834",
          "Zelle in",
          "Zelle from Ananya Raman",
          84.5
        ],
        [
          "2026-09-24",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -7.74
        ],
        [
          "2026-09-24",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP HELP.UBER.COM CA",
          -18.7
        ],
        [
          "2026-09-25",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -94.72
        ],
        [
          "2026-09-25",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -34.03
        ],
        [
          "2026-09-26",
          "checking x8834",
          "debit card x4471",
          "SHELL OIL 57544281 RALEIGH NC",
          -37.14
        ],
        [
          "2026-09-27",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -47.38
        ],
        [
          "2026-09-27",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -5.47
        ],
        [
          "2026-09-27",
          "checking x8834",
          "debit card x4471",
          "UBER *TRIP HELP.UBER.COM CA",
          -13.48
        ],
        [
          "2026-09-28",
          "checking x8834",
          "debit card x4471",
          "ICLOUD.COM/BILL",
          -2.99
        ],
        [
          "2026-09-30",
          "savings x2290",
          "interest",
          "INTEREST PAID",
          35.84
        ],
        [
          "2026-10-01",
          "checking x8834",
          "ACH debit",
          "OAKWELL APARTMENTS RENT WEB",
          -1875
        ],
        [
          "2026-10-01",
          "checking x8834",
          "debit card x4471",
          "AMAZON.COM*PL41X09N3",
          -69.31
        ],
        [
          "2026-10-01",
          "checking x8834",
          "debit card x4471",
          "CVS/PHARMACY #07216 RALEIGH NC",
          -17.98
        ],
        [
          "2026-10-01",
          "checking x8834",
          "debit card x4471",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          -34.81
        ],
        [
          "2026-10-01",
          "checking x8834",
          "debit card x4471",
          "STARBUCKS STORE 08841 RALEIGH NC",
          -6.89
        ],
        [
          "2026-10-02",
          "checking x8834",
          "ACH credit",
          "LINDQVIST SOFTWARE PAYROLL PPD",
          2846.19
        ],
        [
          "2026-10-03",
          "checking x8834",
          "debit card x4471",
          "TRADER JOE'S #742 RALEIGH NC",
          -28.66
        ],
        [
          "2026-10-04",
          "checking x8834",
          "ACH debit",
          "SPECTRUM AUTOPAY",
          -69.99
        ],
        [
          "2026-10-04",
          "checking x8834",
          "debit card x4471",
          "HARRIS TEETER #0119 RALEIGH NC",
          -43.19
        ],
        [
          "2026-10-05",
          "checking x8834",
          "debit card x4471",
          "TARGET 00019 RALEIGH NC",
          -31.03
        ]
      ]
    },
    "card_authorizations": {
      "card": "debit x4471",
      "period": "2026-09-15 to 2026-10-06, approvals and declines",
      "columns": [
        "ts",
        "merchant",
        "mcc",
        "entry",
        "amount_usd",
        "result",
        "avs",
        "cvv2"
      ],
      "rows": [
        [
          "2026-09-15T10:05:00Z",
          "MUSEU CALOUSTE GULBENKIAN LISBOA PRT",
          "7991",
          "contactless (07)",
          21.8,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-15T14:20:00Z",
          "METRO LISBOA PRT",
          "4111",
          "contactless (07)",
          7.4,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-16T14:23:46Z",
          "PASTELARIA ALFAMA LISBOA PRT",
          "5814",
          "contactless (07)",
          4.98,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-16T19:36:31Z",
          "UBER *TRIP LISBOA PRT",
          "4121",
          "card on file (10)",
          10.01,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-17T10:29:54Z",
          "UBER *TRIP LISBOA PRT",
          "4121",
          "card on file (10)",
          13.6,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-17T13:35:35Z",
          "PINGO DOCE LISBOA PRT",
          "5411",
          "contactless (07)",
          28.68,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-17T19:17:16Z",
          "FARMACIA ESTRELA LISBOA PRT",
          "5912",
          "contactless (07)",
          10.57,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-17T19:31:00Z",
          "TABERNA DA RUA DAS FLORES LISBOA PRT",
          "5812",
          "contactless (07)",
          64.1,
          "declined (1A additional authentication required: insert card, enter PIN)",
          "",
          ""
        ],
        [
          "2026-09-17T19:33:00Z",
          "TABERNA DA RUA DAS FLORES LISBOA PRT",
          "5812",
          "chip + PIN (05)",
          64.1,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-18T15:47:26Z",
          "PINGO DOCE LISBOA PRT",
          "5411",
          "contactless (07)",
          19.39,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-19T13:18:03Z",
          "UBER *TRIP LISBOA PRT",
          "4121",
          "card on file (10)",
          7.49,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-20T09:01:56Z",
          "PINGO DOCE LISBOA PRT",
          "5411",
          "contactless (07)",
          19.05,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-20T14:46:49Z",
          "UBER *TRIP LISBOA PRT",
          "4121",
          "card on file (10)",
          8.92,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-20T17:30:29Z",
          "PASTELARIA ALFAMA LISBOA PRT",
          "5814",
          "contactless (07)",
          6.39,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-20T20:32:34Z",
          "TIME OUT MARKET LISBOA PRT",
          "5812",
          "contactless (07)",
          23.19,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-21T08:12:00Z",
          "SPOTIFY USA",
          "4899",
          "card on file (10)",
          11.99,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-22T00:05:15Z",
          "STARBUCKS STORE 08841 RALEIGH NC",
          "5814",
          "chip (05)",
          5.77,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-22T17:53:41Z",
          "STARBUCKS STORE 08841 RALEIGH NC",
          "5814",
          "chip (05)",
          7.34,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-23T21:24:50Z",
          "STARBUCKS STORE 08841 RALEIGH NC",
          "5814",
          "chip (05)",
          7.74,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-23T23:06:03Z",
          "UBER *TRIP HELP.UBER.COM CA",
          "4121",
          "card on file (10)",
          18.7,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-24T15:33:36Z",
          "TRADER JOE'S #742 RALEIGH NC",
          "5411",
          "contactless (07)",
          34.03,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-24T22:27:51Z",
          "HARRIS TEETER #0119 RALEIGH NC",
          "5411",
          "contactless (07)",
          94.72,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-25T15:44:59Z",
          "SHELL OIL 57544281 RALEIGH NC",
          "5541",
          "contactless (07)",
          37.14,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-26T16:18:34Z",
          "STARBUCKS STORE 08841 RALEIGH NC",
          "5814",
          "chip (05)",
          5.47,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-26T16:55:59Z",
          "HARRIS TEETER #0119 RALEIGH NC",
          "5411",
          "contactless (07)",
          47.38,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-26T17:14:29Z",
          "UBER *TRIP HELP.UBER.COM CA",
          "4121",
          "card on file (10)",
          13.48,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-27T08:12:00Z",
          "ICLOUD.COM/BILL",
          "5818",
          "card on file (10)",
          2.99,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-30T17:15:51Z",
          "DOORDASH*DASHPASS SAN FRANCISCO CA",
          "5812",
          "card on file (10)",
          34.81,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-30T20:08:53Z",
          "STARBUCKS STORE 08841 RALEIGH NC",
          "5814",
          "chip (05)",
          6.89,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-09-30T21:31:00Z",
          "AMAZON.COM*PL41X09N3",
          "5942",
          "card on file (10)",
          69.31,
          "approved (00)",
          "Y",
          ""
        ],
        [
          "2026-10-01T01:25:05Z",
          "CVS/PHARMACY #07216 RALEIGH NC",
          "5912",
          "chip (05)",
          17.98,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-02T18:29:30Z",
          "TRADER JOE'S #742 RALEIGH NC",
          "5411",
          "chip (05)",
          28.66,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-04T00:10:51Z",
          "HARRIS TEETER #0119 RALEIGH NC",
          "5411",
          "contactless (07)",
          43.19,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-05T00:30:49Z",
          "TARGET 00019 RALEIGH NC",
          "5310",
          "contactless (07)",
          31.03,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-05T17:59:54Z",
          "HARRIS TEETER #0119 RALEIGH NC",
          "5411",
          "contactless (07)",
          77.16,
          "approved (00)",
          "",
          ""
        ],
        [
          "2026-10-05T20:11:43Z",
          "TRADER JOE'S #742 RALEIGH NC",
          "5411",
          "contactless (07)",
          48.38,
          "approved (00)",
          "",
          ""
        ]
      ]
    },
    "contact_center_history": {
      "period": "since 2024-01-01",
      "columns": [
        "ts",
        "channel",
        "caller",
        "verification",
        "reason",
        "outcome"
      ],
      "rows": [
        [
          "2024-04-09T15:20:00Z",
          "phone (outbound)",
          "(919) 555-0164 (on file)",
          "SMS code",
          "Outreach for dark web alert TI-20240409-0087",
          "Customer said she had installed a free PDF converter on the laptop in March; agreed to stop using it; reset password from her phone; said she would change her email password"
        ],
        [
          "2025-02-03T17:00:00Z",
          "branch",
          "in person",
          "photo ID",
          "Address change",
          "Done"
        ],
        [
          "2026-09-21T14:12:00Z",
          "chat (app)",
          "dv_a20e",
          "signed-in app session",
          "Asked why her card was declined at a Lisbon restaurant on 9/17",
          "Explained that the tap needed her PIN under European rules; the chip-and-PIN retry was approved. No changes"
        ]
      ]
    },
    "prior_alerts": [
      {
        "alert_id": "TI-20240409-0087",
        "received": "2024-04-09T13:31:00Z",
        "type": "Infostealer log with our bank's login",
        "detail": "Log captured 2024-03-15T00:05Z on LAPTOP-PR5T8Q (dv_6b02); password matched the then-current password; trusted-device cookie for dv_6b02",
        "disposition": "Password reset forced, sessions ended, dv_6b02 removed; customer reached 2024-04-09; no unauthorized activity found; closed"
      },
      {
        "alert_id": "TI-20250916-0412",
        "received": "2025-09-16T15:02:00Z",
        "type": "Email address in a breach dump (online retailer breach, 2025)",
        "detail": "Email on file with a password hash from the retailer; not comparable with ours, and the username for our bank is not the email",
        "disposition": "Closed, no action"
      }
    ],
    "alert": {
      "alert_id": "TI-20261006-0098",
      "received": "2026-10-06T13:40:00Z",
      "vendor_feed": "Threat intelligence vendor: marketplace monitoring, bank access listings ('bank logs')",
      "vendor_severity": "high (listing names our bank)",
      "listing": {
        "posted": "2026-10-05T22:18:00Z",
        "venue": "Invite-only marketplace on Tor",
        "seller": {
          "first_seen_by_vendor": "2026-08",
          "listings_seen_by_vendor": 19,
          "marketplace_rating": "no ratings yet",
          "vendor_note_on_seller": "6 of the seller's 19 listings reuse screenshots the vendor first saw on another forum in 2024"
        },
        "title": "[OUR BANK] chk + sav | bal 6k | cookies | full info | checked 10/03",
        "price_usd": 45,
        "seller_claims": [
          "Online banking login and password",
          "Browser cookies",
          "Holder's full name, date of birth, address and SSN",
          "Email account access",
          "Checked valid 10/03"
        ],
        "screenshot_extract": {
          "method": "Vendor text extraction from the seller's screenshot",
          "name_shown": "Priya R.",
          "accounts_shown": [
            {
              "type": "checking",
              "last4": "8834",
              "balance_usd": 6118.42
            },
            {
              "type": "savings",
              "last4": "2290",
              "balance_usd": 3050
            }
          ],
          "clock_shown": "Mar 14, 8:02 PM (no year)",
          "browser_shown": "Edge on Windows"
        }
      },
      "linked_credential_record": {
        "source": "Infostealer log the vendor ties to this listing by machine name and screenshot",
        "captured": "2024-03-15T00:05:00Z",
        "first_seen_by_vendor": "2024-04-06",
        "computer_name": "LAPTOP-PR5T8Q",
        "os": "Windows 10 Home",
        "browser": "Edge 122",
        "ip_at_capture": "198.51.100.37 (residential cable ISP, Raleigh NC)",
        "entries_for_our_bank": "Username praman_nc, a password, and 3 cookies for online.ourbank.example (trusted-device token for dv_6b02, an expired session, language)",
        "other_entries_of_note": "Password for priya.raman@example.com; browser autofill with name, address and date of birth"
      },
      "vendor_match": {
        "matched_on": [
          "online banking username",
          "account last four 8834 and 2290",
          "first name and last initial"
        ],
        "vendor_confidence": "high"
      }
    },
    "alert_checks": {
      "credential_check": {
        "method": "Password from the log hashed with this login's salt and algorithm and compared with the current and previous hashes; plaintext discarded, never logged",
        "matches_current_password": false,
        "matches_a_previous_password": true,
        "which_previous_password": "The one replaced on 2024-04-09 by the forced reset",
        "password_changes_since_capture": 3,
        "current_password_set": "2026-07-22T12:05:40Z"
      },
      "device_token_check": {
        "token_in_log": "Trusted-device token for dv_6b02",
        "token_status": "revoked 2024-04-09 when dv_6b02 was removed",
        "presented_since_capture": "Never presented after 2024-04-08"
      },
      "log_machine_vs_our_records": "LAPTOP-PR5T8Q matches dv_6b02 (removed 2024-04-09); no Windows device has signed in since 2024-04-08",
      "balance_check": {
        "screenshot_clock": "Mar 14, 8:02 PM, no year; local time in Raleigh",
        "ledger_at_that_clock_time": [
          {
            "as_of": "2026-03-15T00:02:00Z",
            "checking_8834": 11402.9,
            "savings_2290": 9800,
            "matches_screenshot": false
          },
          {
            "as_of": "2025-03-15T00:02:00Z",
            "checking_8834": 4870.13,
            "savings_2290": 6300,
            "matches_screenshot": false
          },
          {
            "as_of": "2024-03-15T00:02:00Z",
            "checking_8834": 6118.42,
            "savings_2290": 3050,
            "matches_screenshot": true
          }
        ]
      },
      "sign_ins_around_seller_check_date": "2026-10-02 to 2026-10-04 (Raleigh time): 5 successful sign-ins, all from dv_a20e, dv_e913 at 203.0.113.164; 2 failed attempts, all on dv_e913 at 203.0.113.164; no sign-in or attempt from any other device"
    }
  },
  "questions": {
    "matches_customer": {
      "type": "noul",
      "instructions": "Does the vendor's alert refer to this customer's own login, account or card at our bank (including a card since closed or replaced), rather than to a different person?"
    },
    "still_exposed": {
      "type": "score",
      "instructions": "How likely is it that someone other than the customer can currently use the exposed data to sign in to this customer's online banking or make payments from the customer's accounts or cards?",
      "criteria": [
        "Very unlikely (under 10%)",
        "Unlikely (10-40%)",
        "Uncertain (40-60%)",
        "Likely (60-90%)",
        "Very likely (over 90%)"
      ]
    },
    "response": {
      "type": "choice",
      "instructions": "What should the bank do about this alert for this customer?",
      "criteria": {
        "no_action": "Log the alert and take no action: it doesn't match this customer, or nothing it exposes still works",
        "reset_step_up": "Force a password reset from a device not named in the alert, end all sessions, remove trusted devices and require a one-time code at the next sign-in",
        "reissue_card": "Block the exposed card and issue a new card number; online banking access needs no change",
        "restrict_contact": "Restrict outbound payments, new payees and contact-detail changes until the customer is reached at the phone number on file"
      }
    }
  }
}