{
  "model": "grayson-1",
  "state": {
    "alert": {
      "id": "IR-ALR-21102",
      "source": "Employee access monitoring over CRM, core banking and branch platform access logs",
      "created": "2026-10-05T11:00:00Z",
      "window_start": "2026-09-28T00:00:00Z",
      "window_end": "2026-10-04T23:59:59Z",
      "priority": "P1",
      "rules_fired": [
        "IR-04: 3 or more account lookups in 7 days with no call, chat, in-branch interaction, ticket or case linked within 30 minutes (12 in this window)",
        "IR-09: Lookup of an account held by an employee (2 lookups of 1 account)",
        "IR-21: Account the employee accessed had a confirmed or suspected takeover within 7 days (1 account)",
        "IR-23: Contact-detail change after an ID-scan override (1 visit, 3 changes)"
      ]
    },
    "employee": {
      "employee_id": "E-44718",
      "employment_type": "Employee",
      "role": "Personal banker, branch B-0233 (Dublin, OH)",
      "start_date": "2017-05-08",
      "queue": "Walk-in and appointment customers at B-0233; an assigned book of 286 households; calls to the branch and to her desk line, which is listed in the online branch directory.",
      "work_location": "Branch B-0233",
      "scheduled_shift": "Monday to Friday, 12:45 to 21:30 UTC (08:45 to 17:30 Eastern), and alternate Saturdays 12:45 to 16:30 UTC; Saturday 2026-10-03 was scheduled",
      "schedule_exceptions": "Covering the book of personal banker E-45120 (same branch, on leave) 2026-09-28 to 2026-10-02, including that book's October CD maturities",
      "entitlements": "View customer profiles, balances, history, statements, signature cards and authentication profile; open accounts; change contact details for a verified customer in the branch; order debit cards; renew CDs; reverse fees up to $100; initiate wires under dual control",
      "identity_verification_policy": "In the branch, verify with the customer's debit card and PIN on the desk PIN pad or a government ID through the ID scanner; either creates an in-branch interaction record. If the scan returns 'unable to verify', a branch manager may approve an override after a second ID is checked, and the second ID must be recorded. Calls to the branch are not recorded as contacts unless the banker logs them; no account changes by phone at branches.",
      "id_scan_overrides_last_90_days": "Requested 6 overrides in 41 scans (15%), all approved by the branch manager; a second ID is recorded for 4 of the 6. Personal bankers: median 3% (95th percentile 9%).",
      "privacy_training": "Completed 2026-02-24. It states that employees must not open their own account, or a coworker's, relative's or household member's account, in work systems.",
      "employment_status": "Active",
      "conflict_of_interest_disclosures": "None on file",
      "prior_alerts": [
        {
          "id": "IR-ALR-09217",
          "created": "2024-11-12",
          "rule": "IR-04",
          "outcome": "Closed as legitimate: calls to the branch line, matched in branch phone records"
        },
        {
          "id": "IR-ALR-15586",
          "created": "2025-08-04",
          "rule": "IR-04",
          "outcome": "Closed as legitimate: walk-in customers served without a PIN pad record, matched to teller transactions"
        }
      ]
    },
    "weekly_history": {
      "columns": [
        "week_start",
        "lookups",
        "linked",
        "unlinked",
        "account_changes",
        "phone_or_email_changes",
        "sessions_outside_shift",
        "dlp_events"
      ],
      "rows": [
        [
          "2026-08-03",
          171,
          166,
          5,
          29,
          1,
          0,
          0
        ],
        [
          "2026-08-10",
          158,
          155,
          3,
          26,
          0,
          0,
          0
        ],
        [
          "2026-08-17",
          182,
          175,
          7,
          33,
          2,
          0,
          0
        ],
        [
          "2026-08-24",
          166,
          161,
          5,
          27,
          1,
          0,
          0
        ],
        [
          "2026-08-31",
          139,
          135,
          4,
          21,
          0,
          0,
          0
        ],
        [
          "2026-09-07",
          175,
          169,
          6,
          31,
          1,
          0,
          0
        ],
        [
          "2026-09-14",
          169,
          165,
          4,
          28,
          2,
          0,
          0
        ],
        [
          "2026-09-21",
          187,
          180,
          7,
          34,
          1,
          0,
          0
        ]
      ]
    },
    "peer_baseline": "Personal bankers (212), per banker per week over the last 8 weeks: lookups median 164 (95th percentile 231); unlinked lookups median 6 (95th percentile 14); phone or email changes median 1 (95th percentile 4).",
    "monitoring_notes": "The link check reads in-branch interaction records, appointments (at the appointment time), tickets, cases and the employee's own assigned book. It does not read branch phone records, teller transactions or temporary book coverage. No outages in this window.",
    "sessions": {
      "columns": [
        "login",
        "logout",
        "client",
        "source_network"
      ],
      "rows": [
        [
          "2026-09-28T12:45:00Z",
          "2026-09-28T21:40:04Z",
          "WS-B0233-04 (assigned desk)",
          "Branch B-0233 network"
        ],
        [
          "2026-09-29T12:41:52Z",
          "2026-09-29T21:42:19Z",
          "WS-B0233-04 (assigned desk)",
          "Branch B-0233 network"
        ],
        [
          "2026-09-30T12:47:15Z",
          "2026-09-30T21:32:39Z",
          "WS-B0233-04 (assigned desk)",
          "Branch B-0233 network"
        ],
        [
          "2026-10-01T12:40:38Z",
          "2026-10-01T21:35:08Z",
          "WS-B0233-04 (assigned desk)",
          "Branch B-0233 network"
        ],
        [
          "2026-10-02T12:49:53Z",
          "2026-10-02T21:31:40Z",
          "WS-B0233-04 (assigned desk)",
          "Branch B-0233 network"
        ],
        [
          "2026-10-03T12:42:26Z",
          "2026-10-03T16:36:47Z",
          "WS-B0233-04 (assigned desk)",
          "Branch B-0233 network"
        ]
      ]
    },
    "access_log": {
      "columns": [
        "ts",
        "account",
        "holder",
        "viewed",
        "seconds",
        "change",
        "linked_to"
      ],
      "rows": [
        [
          "2026-09-28T12:54:10Z",
          "checking x8659",
          "customer",
          "profile, balances, products",
          428,
          "",
          "in-branch interaction CI-771204"
        ],
        [
          "2026-09-28T13:15:17Z",
          "checking x6203",
          "customer",
          "profile, contact details",
          1168,
          "",
          "in-branch interaction CI-771210"
        ],
        [
          "2026-09-28T13:16:42Z",
          "savings x5868",
          "customer",
          "profile, products",
          122,
          "",
          "in-branch interaction CI-771210"
        ],
        [
          "2026-09-28T13:53:33Z",
          "checking x9083",
          "customer",
          "profile, balances, products",
          595,
          "overdraft protection linked",
          "in-branch interaction CI-771217"
        ],
        [
          "2026-09-28T14:12:36Z",
          "CD x2208",
          "customer",
          "profile, CD details, balances",
          214,
          "",
          ""
        ],
        [
          "2026-09-28T14:21:42Z",
          "CD x6206",
          "customer",
          "profile, CD details, balances",
          163,
          "CD renewed",
          "assigned book"
        ],
        [
          "2026-09-28T14:30:30Z",
          "credit card x6200",
          "customer",
          "profile, balances, statements",
          857,
          "",
          "in-branch interaction CI-771223"
        ],
        [
          "2026-09-28T14:32:25Z",
          "savings x8043",
          "customer",
          "profile, balances, history",
          183,
          "",
          "in-branch interaction CI-771223"
        ],
        [
          "2026-09-28T15:10:29Z",
          "checking x5518",
          "customer",
          "profile, history, holds",
          839,
          "stop payment placed",
          "appointment AP-30218"
        ],
        [
          "2026-09-28T15:43:22Z",
          "money market x3855",
          "customer",
          "profile, balances, history",
          138,
          "",
          "assigned book"
        ],
        [
          "2026-09-28T16:01:44Z",
          "checking x4581",
          "customer",
          "profile, contact details",
          995,
          "",
          "in-branch interaction CI-771231"
        ],
        [
          "2026-09-28T16:28:45Z",
          "savings x1118",
          "customer",
          "profile, products",
          107,
          "",
          "assigned book"
        ],
        [
          "2026-09-28T17:17:17Z",
          "credit card x9925",
          "customer",
          "profile, balances, statements",
          768,
          "fee reversal $35.00",
          "in-branch interaction CI-771238"
        ],
        [
          "2026-09-28T17:43:08Z",
          "credit card x8882",
          "customer",
          "profile, balances, statements",
          382,
          "address change",
          "in-branch interaction CI-771245"
        ],
        [
          "2026-09-28T17:55:37Z",
          "savings x4627",
          "customer",
          "profile, balances, history",
          308,
          "address change",
          "in-branch interaction CI-771254"
        ],
        [
          "2026-09-28T18:24:19Z",
          "checking x9200",
          "customer",
          "profile, balances, history",
          1845,
          "",
          "appointment AP-30219"
        ],
        [
          "2026-09-28T18:26:04Z",
          "savings x9495",
          "customer",
          "profile, balances",
          57,
          "",
          "appointment AP-30219"
        ],
        [
          "2026-09-28T19:16:14Z",
          "checking x5485",
          "customer",
          "profile, history, holds",
          235,
          "debit card ordered",
          "in-branch interaction CI-771258"
        ],
        [
          "2026-09-28T19:37:44Z",
          "HELOC x4990",
          "customer",
          "profile, balances, statements",
          178,
          "",
          "assigned book"
        ],
        [
          "2026-09-28T19:40:02Z",
          "checking x5163",
          "customer",
          "profile, history, holds",
          302,
          "",
          ""
        ],
        [
          "2026-09-28T19:53:40Z",
          "checking x3799",
          "customer",
          "profile, contact details",
          578,
          "",
          "in-branch interaction CI-771265"
        ],
        [
          "2026-09-28T20:12:41Z",
          "money market x7413",
          "customer",
          "profile, balances",
          187,
          "",
          "assigned book"
        ],
        [
          "2026-09-28T20:29:41Z",
          "checking x6987",
          "customer",
          "profile, balances, products",
          1046,
          "",
          "in-branch interaction CI-771270"
        ],
        [
          "2026-09-28T20:31:58Z",
          "credit card x0386",
          "customer",
          "profile, balances, statements",
          71,
          "",
          "in-branch interaction CI-771270"
        ],
        [
          "2026-09-28T20:55:01Z",
          "savings x0055",
          "customer",
          "profile, products",
          35,
          "",
          "assigned book"
        ],
        [
          "2026-09-28T21:00:35Z",
          "money market x5827",
          "customer",
          "profile, products",
          193,
          "",
          "assigned book"
        ],
        [
          "2026-09-28T21:06:59Z",
          "checking x2296",
          "customer",
          "profile, balances, history",
          284,
          "stop payment placed",
          "in-branch interaction CI-771273"
        ],
        [
          "2026-09-28T21:21:11Z",
          "checking x2953",
          "customer",
          "profile, balances, history",
          53,
          "",
          "assigned book"
        ],
        [
          "2026-09-29T12:55:52Z",
          "CD x5608",
          "customer",
          "profile, CD details",
          103,
          "CD renewed",
          "assigned book"
        ],
        [
          "2026-09-29T13:11:08Z",
          "savings x3483",
          "customer",
          "profile, products",
          132,
          "",
          "assigned book"
        ],
        [
          "2026-09-29T13:16:09Z",
          "savings x3244",
          "customer",
          "profile, balances, history",
          502,
          "",
          "in-branch interaction CI-771282"
        ],
        [
          "2026-09-29T13:20:09Z",
          "savings x7747",
          "customer",
          "profile, balances, history",
          112,
          "",
          "in-branch interaction CI-771282"
        ],
        [
          "2026-09-29T13:44:45Z",
          "credit card x3281",
          "customer",
          "profile, balances, statements",
          365,
          "",
          "in-branch interaction CI-771286"
        ],
        [
          "2026-09-29T14:02:23Z",
          "checking x8663",
          "customer",
          "profile, balances, products",
          179,
          "",
          "in-branch interaction CI-771291"
        ],
        [
          "2026-09-29T14:16:43Z",
          "savings x2774",
          "customer",
          "profile, balances, history",
          973,
          "",
          "appointment AP-30222"
        ],
        [
          "2026-09-29T14:55:38Z",
          "HELOC x5343",
          "customer",
          "profile, balances, statements",
          60,
          "",
          "assigned book"
        ],
        [
          "2026-09-29T14:59:12Z",
          "checking x5869",
          "customer",
          "profile, balances, statements",
          234,
          "",
          "ticket TK-603300"
        ],
        [
          "2026-09-29T15:05:47Z",
          "savings x8847",
          "customer",
          "profile, balances, products",
          388,
          "",
          ""
        ],
        [
          "2026-09-29T15:08:21Z",
          "money market x2400",
          "customer",
          "profile, products",
          49,
          "",
          "assigned book"
        ],
        [
          "2026-09-29T15:17:43Z",
          "savings x3483",
          "customer",
          "profile, products",
          189,
          "",
          "assigned book"
        ],
        [
          "2026-09-29T15:26:29Z",
          "savings x8035",
          "customer",
          "profile, balances",
          652,
          "",
          "in-branch interaction CI-771292"
        ],
        [
          "2026-09-29T15:28:39Z",
          "savings x4096",
          "customer",
          "profile, balances, history",
          179,
          "",
          "in-branch interaction CI-771292"
        ],
        [
          "2026-09-29T15:42:05Z",
          "premier checking x4471",
          "customer",
          "profile, contact details, balances, products, authentication profile",
          236,
          "",
          ""
        ],
        [
          "2026-09-29T15:50:44Z",
          "checking x4369",
          "customer",
          "profile, balances, statements",
          857,
          "",
          "appointment AP-30228"
        ],
        [
          "2026-09-29T15:53:54Z",
          "savings x1910",
          "customer",
          "profile, balances, history",
          113,
          "",
          "appointment AP-30228"
        ],
        [
          "2026-09-29T17:17:43Z",
          "checking x9805",
          "customer",
          "profile, balances, statements",
          458,
          "",
          "in-branch interaction CI-771293"
        ],
        [
          "2026-09-29T17:20:02Z",
          "credit card x4049",
          "customer",
          "profile, balances, statements",
          108,
          "",
          "in-branch interaction CI-771293"
        ],
        [
          "2026-09-29T17:40:13Z",
          "credit card x5910",
          "customer",
          "profile, balances, statements",
          550,
          "",
          "in-branch interaction CI-771299"
        ],
        [
          "2026-09-29T17:43:05Z",
          "CD x7770",
          "customer",
          "profile, CD details, balances",
          174,
          "",
          "in-branch interaction CI-771299"
        ],
        [
          "2026-09-29T18:09:40Z",
          "HELOC x4990",
          "customer",
          "profile, balances, statements",
          160,
          "",
          "assigned book"
        ],
        [
          "2026-09-29T18:23:45Z",
          "checking x7166",
          "customer",
          "profile, balances, statements",
          316,
          "",
          "in-branch interaction CI-771307"
        ],
        [
          "2026-09-29T18:26:49Z",
          "CD x0113",
          "customer",
          "profile, CD details, balances",
          59,
          "",
          "in-branch interaction CI-771307"
        ],
        [
          "2026-09-29T18:45:31Z",
          "checking x9936",
          "customer",
          "profile, history, holds",
          453,
          "",
          "in-branch interaction CI-771309"
        ],
        [
          "2026-09-29T19:46:29Z",
          "money market x8681",
          "customer",
          "profile, balances, history",
          199,
          "",
          "assigned book"
        ],
        [
          "2026-09-29T19:52:30Z",
          "checking x7417",
          "customer",
          "profile, contact details",
          707,
          "wire initiated (dual control)",
          "in-branch interaction CI-771311"
        ],
        [
          "2026-09-29T20:26:22Z",
          "credit card x5878",
          "customer",
          "profile, balances, statements",
          466,
          "",
          "in-branch interaction CI-771313"
        ],
        [
          "2026-09-29T20:53:07Z",
          "savings x1236",
          "customer",
          "profile, products",
          234,
          "",
          "in-branch interaction CI-771322"
        ],
        [
          "2026-09-29T21:06:23Z",
          "savings x4612",
          "customer",
          "profile, balances",
          291,
          "",
          "assigned book"
        ],
        [
          "2026-09-29T21:18:38Z",
          "savings x4815",
          "customer",
          "profile, balances, history",
          715,
          "",
          "appointment AP-30231"
        ],
        [
          "2026-09-30T12:54:52Z",
          "savings x1118",
          "customer",
          "profile, balances",
          84,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T13:00:22Z",
          "savings x4815",
          "customer",
          "profile, products",
          241,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T13:09:32Z",
          "savings x7453",
          "customer",
          "profile, balances, history",
          366,
          "",
          "in-branch interaction CI-771327"
        ],
        [
          "2026-09-30T13:25:17Z",
          "checking x7041",
          "customer",
          "profile, history, holds",
          105,
          "",
          "ticket TK-603310"
        ],
        [
          "2026-09-30T13:34:40Z",
          "savings x5683",
          "customer",
          "profile, balances, history",
          1228,
          "beneficiary updated",
          "appointment AP-30237"
        ],
        [
          "2026-09-30T14:11:52Z",
          "checking x4720",
          "customer",
          "profile, contact details",
          233,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T14:17:48Z",
          "checking x9346",
          "customer",
          "profile, balances, statements",
          844,
          "",
          "appointment AP-30241"
        ],
        [
          "2026-09-30T14:20:02Z",
          "CD x7680",
          "customer",
          "profile, CD details, balances",
          108,
          "",
          "appointment AP-30241"
        ],
        [
          "2026-09-30T14:52:25Z",
          "savings x9415",
          "customer",
          "profile, balances, history",
          109,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T14:58:52Z",
          "checking x0980",
          "customer",
          "profile, balances, history",
          543,
          "",
          "appointment AP-30245"
        ],
        [
          "2026-09-30T15:38:47Z",
          "money market x8964",
          "customer",
          "profile, balances, history",
          249,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T15:49:16Z",
          "savings x4143",
          "customer",
          "profile, balances, history",
          48,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T16:02:08Z",
          "checking x2953",
          "customer",
          "profile, balances, history",
          209,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T16:13:17Z",
          "checking x4794",
          "customer",
          "profile, contact details",
          1034,
          "",
          "in-branch interaction CI-771336"
        ],
        [
          "2026-09-30T16:17:12Z",
          "CD x5834",
          "customer",
          "profile, CD details",
          120,
          "",
          "in-branch interaction CI-771336"
        ],
        [
          "2026-09-30T16:31:55Z",
          "checking x6602",
          "customer",
          "profile, history",
          245,
          "",
          ""
        ],
        [
          "2026-09-30T17:15:58Z",
          "money market x2400",
          "customer",
          "profile, balances",
          147,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T17:26:02Z",
          "checking x7419",
          "customer",
          "profile, contact details",
          231,
          "",
          "in-branch interaction CI-771338"
        ],
        [
          "2026-09-30T17:28:06Z",
          "CD x1635",
          "customer",
          "profile, CD details, balances",
          152,
          "",
          "in-branch interaction CI-771338"
        ],
        [
          "2026-09-30T17:42:41Z",
          "HELOC x9180",
          "customer",
          "profile, balances, statements",
          156,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T17:49:23Z",
          "savings x5416",
          "customer",
          "profile, products",
          525,
          "",
          "in-branch interaction CI-771342"
        ],
        [
          "2026-09-30T17:51:17Z",
          "savings x3117",
          "customer",
          "profile, balances, history",
          146,
          "",
          "in-branch interaction CI-771342"
        ],
        [
          "2026-09-30T18:07:47Z",
          "checking x5274",
          "customer",
          "profile, balances, statements",
          54,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T18:35:07Z",
          "checking x0980",
          "customer",
          "profile, balances, history",
          176,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T18:42:39Z",
          "savings x1860",
          "customer",
          "profile, balances",
          189,
          "",
          "ticket TK-603342"
        ],
        [
          "2026-09-30T18:54:51Z",
          "checking x0160",
          "customer",
          "profile, balances, statements",
          210,
          "",
          "ticket TK-603358"
        ],
        [
          "2026-09-30T19:06:42Z",
          "savings x7651",
          "customer",
          "profile, balances",
          692,
          "",
          "in-branch interaction CI-771343"
        ],
        [
          "2026-09-30T19:26:57Z",
          "credit card x0844",
          "customer",
          "profile, balances, statements",
          194,
          "address change",
          "in-branch interaction CI-771345"
        ],
        [
          "2026-09-30T19:28:19Z",
          "credit card x9226",
          "customer",
          "profile, balances, statements",
          48,
          "",
          "in-branch interaction CI-771345"
        ],
        [
          "2026-09-30T19:35:20Z",
          "checking x4199",
          "customer",
          "profile, balances, products",
          54,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T19:41:34Z",
          "credit card x5124",
          "customer",
          "profile, balances, statements",
          854,
          "",
          "in-branch interaction CI-771349"
        ],
        [
          "2026-09-30T19:44:30Z",
          "CD x7698",
          "customer",
          "profile, CD details, balances",
          88,
          "",
          "in-branch interaction CI-771349"
        ],
        [
          "2026-09-30T20:11:40Z",
          "checking x5555",
          "customer",
          "profile, balances, history",
          428,
          "",
          "in-branch interaction CI-771356"
        ],
        [
          "2026-09-30T20:14:10Z",
          "savings x3012",
          "customer",
          "profile, balances, history",
          105,
          "",
          "in-branch interaction CI-771356"
        ],
        [
          "2026-09-30T20:38:37Z",
          "CD x6206",
          "customer",
          "profile, CD details, balances",
          296,
          "",
          "assigned book"
        ],
        [
          "2026-09-30T20:45:00Z",
          "savings x1727",
          "customer",
          "profile, products",
          263,
          "",
          "ticket TK-603414"
        ],
        [
          "2026-09-30T20:52:02Z",
          "checking x3029",
          "customer",
          "profile, contact details",
          897,
          "debit card ordered",
          "appointment AP-30246"
        ],
        [
          "2026-09-30T21:22:24Z",
          "credit card x9990",
          "customer",
          "profile, balances, statements",
          747,
          "",
          "in-branch interaction CI-771358"
        ],
        [
          "2026-10-01T12:54:20Z",
          "credit card x9889",
          "customer",
          "profile, balances, statements",
          462,
          "",
          "in-branch interaction CI-771365"
        ],
        [
          "2026-10-01T13:26:13Z",
          "HELOC x4990",
          "customer",
          "profile, balances, statements",
          139,
          "",
          "assigned book"
        ],
        [
          "2026-10-01T13:34:01Z",
          "checking x9200",
          "customer",
          "profile, balances, products",
          706,
          "",
          "appointment AP-30249"
        ],
        [
          "2026-10-01T14:03:12Z",
          "premier checking x4471",
          "customer",
          "profile, contact details, authentication profile",
          724,
          "phone change; email added; online banking enrollment started",
          "appointment AP-30262"
        ],
        [
          "2026-10-01T14:05:40Z",
          "money market x4475",
          "customer",
          "profile, balances",
          66,
          "",
          "appointment AP-30262"
        ],
        [
          "2026-10-01T14:19:00Z",
          "checking x4047",
          "customer",
          "profile, balances, products",
          490,
          "address change",
          "in-branch interaction CI-771371"
        ],
        [
          "2026-10-01T14:40:13Z",
          "CD x3390",
          "customer",
          "profile, CD details",
          421,
          "CD renewed",
          ""
        ],
        [
          "2026-10-01T14:50:19Z",
          "credit card x3815",
          "customer",
          "profile, balances, statements",
          711,
          "fee reversal $35.00",
          "in-branch interaction CI-771378"
        ],
        [
          "2026-10-01T15:23:27Z",
          "CD x4937",
          "customer",
          "profile, CD details, balances",
          235,
          "",
          "assigned book"
        ],
        [
          "2026-10-01T15:39:30Z",
          "savings x9055",
          "customer",
          "profile, balances",
          133,
          "",
          "ticket TK-603456"
        ],
        [
          "2026-10-01T15:46:59Z",
          "checking x7842",
          "customer",
          "profile, balances, history",
          553,
          "",
          "appointment AP-30252"
        ],
        [
          "2026-10-01T16:26:58Z",
          "checking x7831",
          "customer",
          "profile, balances, products",
          580,
          "overdraft protection linked",
          "in-branch interaction CI-771385"
        ],
        [
          "2026-10-01T17:18:06Z",
          "savings x4143",
          "customer",
          "profile, products",
          241,
          "",
          "assigned book"
        ],
        [
          "2026-10-01T17:30:36Z",
          "savings x7528",
          "customer",
          "profile, products",
          1654,
          "",
          "appointment AP-30253"
        ],
        [
          "2026-10-01T18:16:40Z",
          "savings x4034",
          "customer",
          "profile, balances, history",
          834,
          "",
          "in-branch interaction CI-771391"
        ],
        [
          "2026-10-01T18:46:49Z",
          "savings x6311",
          "customer",
          "profile, balances, history",
          586,
          "beneficiary updated",
          "in-branch interaction CI-771397"
        ],
        [
          "2026-10-01T18:47:26Z",
          "checking x6159",
          "employee",
          "profile, balances, holds, pending deposits",
          95,
          "",
          ""
        ],
        [
          "2026-10-01T19:06:51Z",
          "savings x9445",
          "customer",
          "profile, balances",
          974,
          "",
          "in-branch interaction CI-771404"
        ],
        [
          "2026-10-01T19:07:27Z",
          "savings x3588",
          "customer",
          "profile, balances",
          182,
          "",
          "in-branch interaction CI-771404"
        ],
        [
          "2026-10-01T19:46:22Z",
          "savings x2624",
          "customer",
          "profile, products",
          597,
          "",
          "in-branch interaction CI-771413"
        ],
        [
          "2026-10-01T19:50:41Z",
          "CD x8320",
          "customer",
          "profile, CD details, balances",
          94,
          "",
          "in-branch interaction CI-771413"
        ],
        [
          "2026-10-01T20:15:40Z",
          "checking x7004",
          "customer",
          "profile, balances, history",
          211,
          "",
          ""
        ],
        [
          "2026-10-01T20:31:28Z",
          "savings x1720",
          "customer",
          "profile, balances",
          250,
          "",
          "ticket TK-603482"
        ],
        [
          "2026-10-01T20:57:28Z",
          "checking x6601",
          "customer",
          "profile, history, holds",
          227,
          "",
          "assigned book"
        ],
        [
          "2026-10-01T21:09:47Z",
          "checking x0215",
          "customer",
          "profile, balances, history",
          584,
          "stop payment placed",
          "in-branch interaction CI-771420"
        ],
        [
          "2026-10-02T12:55:10Z",
          "savings x4143",
          "customer",
          "profile, products",
          267,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T13:08:34Z",
          "checking x0535",
          "customer",
          "profile, history, holds",
          192,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T13:18:09Z",
          "savings x3483",
          "customer",
          "profile, balances",
          92,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T13:26:05Z",
          "savings x2955",
          "customer",
          "profile, balances, history",
          258,
          "address change",
          "in-branch interaction CI-771423"
        ],
        [
          "2026-10-02T13:27:41Z",
          "credit card x0320",
          "customer",
          "profile, balances, statements",
          185,
          "",
          "in-branch interaction CI-771423"
        ],
        [
          "2026-10-02T13:37:36Z",
          "checking x5280",
          "customer",
          "profile, balances, history",
          53,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T13:45:18Z",
          "money market x4037",
          "customer",
          "profile, balances",
          30,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T13:55:02Z",
          "checking x1529",
          "customer",
          "profile, history, holds",
          433,
          "",
          ""
        ],
        [
          "2026-10-02T14:22:28Z",
          "savings x0336",
          "customer",
          "profile, products",
          486,
          "",
          "in-branch interaction CI-771425"
        ],
        [
          "2026-10-02T14:52:16Z",
          "checking x5500",
          "customer",
          "profile, balances, products",
          90,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T15:19:19Z",
          "checking x8229",
          "customer",
          "profile, balances, history",
          31,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T15:24:14Z",
          "credit card x3683",
          "customer",
          "profile, balances, statements",
          230,
          "fee reversal $35.00",
          "in-branch interaction CI-771434"
        ],
        [
          "2026-10-02T15:38:38Z",
          "credit card x8010",
          "customer",
          "profile, balances, statements",
          591,
          "",
          "in-branch interaction CI-771440"
        ],
        [
          "2026-10-02T15:41:57Z",
          "credit card x8968",
          "customer",
          "profile, balances, statements",
          48,
          "",
          "in-branch interaction CI-771440"
        ],
        [
          "2026-10-02T16:05:14Z",
          "CD x3046",
          "customer",
          "profile, CD details, balances",
          166,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T16:14:39Z",
          "checking x9156",
          "customer",
          "profile, balances, products",
          262,
          "",
          "ticket TK-603489"
        ],
        [
          "2026-10-02T16:26:28Z",
          "checking x9200",
          "customer",
          "profile, contact details",
          37,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T16:29:23Z",
          "checking x1724",
          "customer",
          "profile, contact details",
          1591,
          "",
          "appointment AP-30259"
        ],
        [
          "2026-10-02T17:16:08Z",
          "checking x9339",
          "customer",
          "profile, history, holds",
          188,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T17:33:33Z",
          "checking x1762",
          "customer",
          "profile, history, holds",
          1599,
          "",
          "appointment AP-30263"
        ],
        [
          "2026-10-02T18:20:38Z",
          "savings x4120",
          "customer",
          "profile, balances, statements",
          158,
          "",
          ""
        ],
        [
          "2026-10-02T18:37:46Z",
          "savings x4188",
          "customer",
          "profile, balances, history",
          259,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T18:51:18Z",
          "checking x7899",
          "customer",
          "profile, balances, statements",
          213,
          "",
          "ticket TK-603495"
        ],
        [
          "2026-10-02T19:02:29Z",
          "money market x8681",
          "customer",
          "profile, balances",
          1185,
          "",
          "appointment AP-30268"
        ],
        [
          "2026-10-02T19:35:39Z",
          "checking x3043",
          "customer",
          "profile, balances, history",
          487,
          "",
          "in-branch interaction CI-771445"
        ],
        [
          "2026-10-02T19:52:10Z",
          "checking x6159",
          "employee",
          "history, pending deposits",
          71,
          "",
          ""
        ],
        [
          "2026-10-02T20:06:34Z",
          "savings x6740",
          "customer",
          "profile, balances, history",
          596,
          "",
          "in-branch interaction CI-771446"
        ],
        [
          "2026-10-02T20:28:29Z",
          "money market x0008",
          "customer",
          "profile, balances",
          164,
          "",
          "assigned book"
        ],
        [
          "2026-10-02T20:37:14Z",
          "savings x9193",
          "customer",
          "profile, products",
          152,
          "address change",
          "in-branch interaction CI-771449"
        ],
        [
          "2026-10-02T20:48:57Z",
          "checking x4800",
          "customer",
          "profile, balances, history",
          409,
          "",
          "in-branch interaction CI-771451"
        ],
        [
          "2026-10-02T21:12:47Z",
          "credit card x0004",
          "customer",
          "profile, balances, statements",
          341,
          "fee reversal $35.00",
          "in-branch interaction CI-771457"
        ],
        [
          "2026-10-03T12:53:35Z",
          "checking x3415",
          "customer",
          "profile, history, holds",
          236,
          "",
          "ticket TK-603531"
        ],
        [
          "2026-10-03T13:01:50Z",
          "checking x8382",
          "customer",
          "profile, history, holds",
          1087,
          "",
          "appointment AP-30274"
        ],
        [
          "2026-10-03T13:04:29Z",
          "savings x6074",
          "customer",
          "profile, balances, history",
          114,
          "",
          "appointment AP-30274"
        ],
        [
          "2026-10-03T13:32:43Z",
          "checking x2454",
          "customer",
          "profile, balances, statements",
          531,
          "",
          "in-branch interaction CI-771463"
        ],
        [
          "2026-10-03T13:33:37Z",
          "savings x9817",
          "customer",
          "profile, balances",
          188,
          "",
          "in-branch interaction CI-771463"
        ],
        [
          "2026-10-03T13:53:58Z",
          "credit card x3232",
          "customer",
          "profile, balances, statements",
          702,
          "address change",
          "in-branch interaction CI-771464"
        ],
        [
          "2026-10-03T14:10:21Z",
          "checking x2771",
          "customer",
          "profile, history",
          197,
          "",
          ""
        ],
        [
          "2026-10-03T14:23:59Z",
          "money market x7413",
          "customer",
          "profile, balances, history",
          31,
          "",
          "assigned book"
        ],
        [
          "2026-10-03T14:29:59Z",
          "checking x2094",
          "customer",
          "profile, balances, statements",
          111,
          "",
          "in-branch interaction CI-771472"
        ],
        [
          "2026-10-03T14:32:16Z",
          "credit card x1273",
          "customer",
          "profile, balances, statements",
          104,
          "",
          "in-branch interaction CI-771472"
        ],
        [
          "2026-10-03T14:40:57Z",
          "checking x6833",
          "customer",
          "profile, balances, statements",
          817,
          "",
          "appointment AP-30280"
        ],
        [
          "2026-10-03T15:07:03Z",
          "checking x5642",
          "customer",
          "profile, history, holds",
          828,
          "fee reversal $35.00",
          "in-branch interaction CI-771475"
        ],
        [
          "2026-10-03T15:37:52Z",
          "checking x1568",
          "customer",
          "profile, balances, statements",
          214,
          "",
          "assigned book"
        ],
        [
          "2026-10-03T15:42:13Z",
          "CD x4937",
          "customer",
          "profile, CD details",
          112,
          "",
          "assigned book"
        ],
        [
          "2026-10-03T16:05:17Z",
          "checking x8262",
          "customer",
          "profile, contact details",
          270,
          "debit card ordered",
          "in-branch interaction CI-771483"
        ],
        [
          "2026-10-03T16:15:01Z",
          "savings x0125",
          "customer",
          "profile, balances",
          851,
          "",
          "in-branch interaction CI-771491"
        ],
        [
          "2026-10-03T16:18:12Z",
          "credit card x1486",
          "customer",
          "profile, balances, statements",
          140,
          "",
          "in-branch interaction CI-771491"
        ]
      ]
    },
    "branch_phone_records_desk_extension": {
      "columns": [
        "ts",
        "direction",
        "matched_account",
        "number_matches_phone_on_file",
        "seconds"
      ],
      "rows": [
        [
          "2026-09-28T14:14:02Z",
          "outbound",
          "CD x2208",
          "yes",
          318
        ],
        [
          "2026-09-28T15:18:22Z",
          "outbound",
          "savings x1318",
          "yes",
          100
        ],
        [
          "2026-09-28T15:39:37Z",
          "outbound",
          "checking x2953",
          "yes",
          276
        ],
        [
          "2026-09-28T17:15:54Z",
          "inbound",
          "HELOC x8691",
          "yes",
          579
        ],
        [
          "2026-09-28T19:37:10Z",
          "inbound",
          "checking x5163",
          "yes",
          412
        ],
        [
          "2026-09-29T13:19:54Z",
          "inbound",
          "checking x2953",
          "yes",
          310
        ],
        [
          "2026-09-29T15:12:18Z",
          "outbound",
          "savings x9425",
          "yes",
          109
        ],
        [
          "2026-09-29T15:41:20Z",
          "inbound",
          "none: (614) 555-0186 is not on file for any customer",
          "no",
          250
        ],
        [
          "2026-09-29T17:28:12Z",
          "inbound",
          "checking x8229",
          "yes",
          198
        ],
        [
          "2026-09-29T19:20:01Z",
          "outbound",
          "checking x6601",
          "yes",
          482
        ],
        [
          "2026-09-30T15:21:39Z",
          "outbound",
          "CD x2881",
          "yes",
          339
        ],
        [
          "2026-09-30T16:16:48Z",
          "outbound",
          "checking x0535",
          "yes",
          321
        ],
        [
          "2026-09-30T16:29:41Z",
          "inbound",
          "checking x6602",
          "yes",
          296
        ],
        [
          "2026-09-30T17:53:18Z",
          "outbound",
          "savings x9415",
          "yes",
          473
        ],
        [
          "2026-09-30T18:13:42Z",
          "outbound",
          "checking x9339",
          "yes",
          62
        ],
        [
          "2026-09-30T19:45:47Z",
          "outbound",
          "HELOC x0940",
          "yes",
          101
        ],
        [
          "2026-09-30T20:05:12Z",
          "inbound",
          "none: (614) 555-0186 is not on file for any customer",
          "no",
          38
        ],
        [
          "2026-10-01T14:42:30Z",
          "outbound",
          "CD x3390",
          "yes",
          251
        ],
        [
          "2026-10-01T15:28:36Z",
          "inbound",
          "HELOC x5901",
          "yes",
          90
        ],
        [
          "2026-10-01T17:26:57Z",
          "outbound",
          "checking x6601",
          "yes",
          596
        ],
        [
          "2026-10-01T18:55:17Z",
          "outbound",
          "savings x4815",
          "yes",
          154
        ],
        [
          "2026-10-01T20:12:55Z",
          "inbound",
          "checking x7004",
          "yes",
          333
        ],
        [
          "2026-10-02T13:31:27Z",
          "outbound",
          "CD x3046",
          "yes",
          445
        ],
        [
          "2026-10-02T13:56:28Z",
          "outbound",
          "money market x7413",
          "yes",
          552
        ],
        [
          "2026-10-02T17:21:38Z",
          "outbound",
          "money market x4037",
          "yes",
          452
        ],
        [
          "2026-10-02T17:34:24Z",
          "outbound",
          "checking x0980",
          "yes",
          596
        ],
        [
          "2026-10-02T18:24:10Z",
          "outbound",
          "savings x4120",
          "yes",
          189
        ],
        [
          "2026-10-02T20:36:36Z",
          "inbound",
          "money market x8681",
          "yes",
          512
        ],
        [
          "2026-10-03T14:08:17Z",
          "inbound",
          "checking x2771",
          "yes",
          264
        ],
        [
          "2026-10-03T14:28:23Z",
          "inbound",
          "money market x0008",
          "yes",
          552
        ]
      ]
    },
    "appointments": {
      "columns": [
        "check_in",
        "id",
        "account",
        "purpose",
        "status"
      ],
      "rows": [
        [
          "2026-09-28T15:05:18Z",
          "AP-30218",
          "checking x5518",
          "new account opening",
          "completed"
        ],
        [
          "2026-09-28T18:21:11Z",
          "AP-30219",
          "checking x9200",
          "new account opening",
          "completed"
        ],
        [
          "2026-09-29T14:14:09Z",
          "AP-30222",
          "savings x2774",
          "estate account review",
          "completed"
        ],
        [
          "2026-09-29T15:46:15Z",
          "AP-30228",
          "checking x4369",
          "new account opening",
          "completed"
        ],
        [
          "2026-09-29T21:15:52Z",
          "AP-30231",
          "savings x4815",
          "estate account review",
          "completed"
        ],
        [
          "2026-09-30T13:32:28Z",
          "AP-30237",
          "savings x5683",
          "estate account review",
          "completed"
        ],
        [
          "2026-09-30T14:12:51Z",
          "AP-30241",
          "checking x9346",
          "new account opening",
          "completed"
        ],
        [
          "2026-09-30T14:57:09Z",
          "AP-30245",
          "checking x0980",
          "debit card dispute",
          "completed"
        ],
        [
          "2026-09-30T20:48:31Z",
          "AP-30246",
          "checking x3029",
          "debit card dispute",
          "completed"
        ],
        [
          "2026-10-01T13:31:21Z",
          "AP-30249",
          "checking x9200",
          "debit card dispute",
          "completed"
        ],
        [
          "2026-10-01T13:58:30Z",
          "AP-30262",
          "premier checking x4471",
          "Update contact info, lost phone (booked by E-44718 on 2026-09-29 at 15:44:51Z)",
          "completed"
        ],
        [
          "2026-10-01T15:42:50Z",
          "AP-30252",
          "checking x7842",
          "debit card dispute",
          "completed"
        ],
        [
          "2026-10-01T17:27:06Z",
          "AP-30253",
          "savings x7528",
          "estate account review",
          "completed"
        ],
        [
          "2026-10-02T16:27:28Z",
          "AP-30259",
          "checking x1724",
          "small business account questions",
          "completed"
        ],
        [
          "2026-10-02T17:29:01Z",
          "AP-30263",
          "checking x1762",
          "new account opening",
          "completed"
        ],
        [
          "2026-10-02T18:59:44Z",
          "AP-30268",
          "money market x8681",
          "estate account review",
          "completed"
        ],
        [
          "2026-10-03T12:59:43Z",
          "AP-30274",
          "checking x8382",
          "debit card dispute",
          "completed"
        ],
        [
          "2026-10-03T14:37:00Z",
          "AP-30280",
          "checking x6833",
          "debit card dispute",
          "completed"
        ]
      ]
    },
    "contact_and_security_changes": {
      "columns": [
        "ts",
        "account",
        "change",
        "verification_recorded",
        "linked_to"
      ],
      "rows": [
        [
          "2026-09-28T17:47:32Z",
          "credit card x8882",
          "address change",
          "debit card and PIN on the desk PIN pad",
          "in-branch interaction CI-771245"
        ],
        [
          "2026-09-28T17:56:44Z",
          "savings x4627",
          "address change",
          "debit card and PIN on the desk PIN pad",
          "in-branch interaction CI-771254"
        ],
        [
          "2026-09-29T19:58:06Z",
          "checking x7417",
          "wire initiated (dual control)",
          "debit card and PIN on the desk PIN pad",
          "in-branch interaction CI-771311"
        ],
        [
          "2026-09-30T13:39:08Z",
          "savings x5683",
          "beneficiary updated",
          "ID scan: verified",
          "appointment AP-30237"
        ],
        [
          "2026-09-30T19:28:07Z",
          "credit card x0844",
          "address change",
          "debit card and PIN on the desk PIN pad",
          "in-branch interaction CI-771345"
        ],
        [
          "2026-10-01T14:09:18Z",
          "premier checking x4471",
          "phone change: home landline (614) 555-0152 to mobile (614) 555-0186",
          "ID scan 14:04:02Z: unable to verify (barcode unreadable). Override requested by E-44718 and approved by branch manager E-40990 at 14:06:30Z, reason 'License worn, photo matches'. Second ID: not recorded. Debit card: not presented (visitor said it was in the lost phone's wallet case).",
          "appointment AP-30262"
        ],
        [
          "2026-10-01T14:10:02Z",
          "premier checking x4471",
          "email added (none on file before): an address at a free webmail domain",
          "same visit",
          "appointment AP-30262"
        ],
        [
          "2026-10-01T14:11:47Z",
          "premier checking x4471",
          "online banking enrollment started; activation link sent to the new email",
          "same visit",
          "appointment AP-30262"
        ],
        [
          "2026-10-01T14:22:12Z",
          "checking x4047",
          "address change",
          "debit card and PIN on the desk PIN pad",
          "in-branch interaction CI-771371"
        ],
        [
          "2026-10-01T18:54:39Z",
          "savings x6311",
          "beneficiary updated",
          "debit card and PIN on the desk PIN pad",
          "in-branch interaction CI-771397"
        ],
        [
          "2026-10-02T13:29:08Z",
          "savings x2955",
          "address change",
          "debit card and PIN on the desk PIN pad",
          "in-branch interaction CI-771423"
        ],
        [
          "2026-10-02T20:37:56Z",
          "savings x9193",
          "address change",
          "debit card and PIN on the desk PIN pad",
          "in-branch interaction CI-771449"
        ],
        [
          "2026-10-03T13:56:49Z",
          "credit card x3232",
          "address change",
          "debit card and PIN on the desk PIN pad",
          "in-branch interaction CI-771464"
        ]
      ]
    },
    "endpoint_events": {
      "columns": [
        "ts",
        "event",
        "detail"
      ],
      "rows": []
    },
    "endpoint_summary": "No prints, screen captures, USB use or external email in the window. Branch workstations block screen-capture tools.",
    "accounts_in_the_alert": {
      "columns": [
        "account",
        "holder",
        "balance_usd",
        "customer_since",
        "online_banking",
        "phone_on_file",
        "notes"
      ],
      "rows": [
        [
          "premier checking x4471 and money market x4475 (same customer)",
          "customer",
          164920.31,
          "1996-02",
          "not enrolled before 2026-10-01",
          "home landline before 2026-10-01",
          "Home branch B-0107 (about 25 miles away), assigned to personal banker E-40311; no visits to B-0233 on record. Dark-web alert DW-ALR-88213 on 2026-08-19: name, date of birth, SSN, address and email found in a dump attributed to a third-party breach; customer told and given SSN-protection advice 2026-08-20."
        ],
        [
          "checking x6159",
          "Employee E-47302, teller at B-0233 (works the same hours)",
          2210.87,
          "2020-01",
          "enrolled, last login 2026-10-01",
          "mobile",
          "Home branch B-0233, no assigned banker. Mobile check deposit $1,840.00 on 2026-10-01 at 13:02Z with an exception hold until 2026-10-05."
        ]
      ]
    },
    "unlinked_lookups_with_other_records": {
      "columns": [
        "lookup_ts",
        "account",
        "holder",
        "viewed",
        "other_records"
      ],
      "rows": [
        [
          "2026-09-28T14:12:36Z",
          "CD x2208",
          "customer",
          "profile, CD details, balances",
          "In the book of E-45120, which she is covering; CD matures 2026-10-01. Outbound call from her desk line 14:14:02Z to the phone on file, 318 s."
        ],
        [
          "2026-09-28T19:40:02Z",
          "checking x5163",
          "customer",
          "profile, history, holds",
          "Inbound call to her desk line 19:37:10Z from the phone on file, 412 s."
        ],
        [
          "2026-09-29T15:05:47Z",
          "savings x8847",
          "customer",
          "profile, balances, products",
          "Teller deposit $2,300.00 at B-0233 14:51:09Z (teller E-47302); lobby queue shows the customer waiting for a banker, seated 15:03:40Z."
        ],
        [
          "2026-09-29T15:42:05Z",
          "premier checking x4471",
          "customer",
          "profile, contact details, balances, products, authentication profile",
          "Inbound call to her desk line 15:41:20Z from (614) 555-0186, not on file for any customer, 250 s. At 15:44:51Z she booked appointment AP-30262 under this customer for 2026-10-01 14:00Z, purpose 'Update contact info, lost phone'. The same number called her desk line again on 2026-09-30 at 20:05:12Z (38 s)."
        ],
        [
          "2026-09-30T16:31:55Z",
          "checking x6602",
          "customer",
          "profile, history",
          "Inbound call to her desk line 16:29:41Z from the phone on file, 296 s."
        ],
        [
          "2026-10-01T14:40:13Z",
          "CD x3390",
          "customer",
          "profile, CD details",
          "In the book of E-45120, which she is covering; CD matures 2026-10-02. Outbound call 14:42:30Z to the phone on file, 251 s; CD renewed."
        ],
        [
          "2026-10-01T18:47:26Z",
          "checking x6159",
          "employee",
          "profile, balances, holds, pending deposits",
          "None found: no call, ticket, case or work item. Teller E-47302 was posting customer transactions at her teller window from 18:41:02Z to 18:58:47Z."
        ],
        [
          "2026-10-01T20:15:40Z",
          "checking x7004",
          "customer",
          "profile, balances, history",
          "Inbound call to her desk line 20:12:55Z from the phone on file, 333 s."
        ],
        [
          "2026-10-02T13:55:02Z",
          "checking x1529",
          "customer",
          "profile, history, holds",
          "Teller withdrawal $400.00 at B-0233 13:40:27Z (teller E-46651); lobby queue: 'question about a deposit hold', seated 13:53:58Z."
        ],
        [
          "2026-10-02T18:20:38Z",
          "savings x4120",
          "customer",
          "profile, balances, statements",
          "Voicemail on the branch main line from the phone on file 17:58:12Z, forwarded to her; outbound call 18:24:10Z to the phone on file, 189 s."
        ],
        [
          "2026-10-02T19:52:10Z",
          "checking x6159",
          "employee",
          "history, pending deposits",
          "None found: no call, ticket, case or work item."
        ],
        [
          "2026-10-03T14:10:21Z",
          "checking x2771",
          "customer",
          "profile, history",
          "Inbound call to her desk line 14:08:17Z from the phone on file, 264 s."
        ]
      ]
    },
    "activity_after_access": {
      "columns": [
        "ts",
        "account",
        "event"
      ],
      "rows": [
        [
          "2026-10-01T14:09:40Z",
          "premier checking x4471",
          "Phone-change notice by text to the previous number failed (landline); no email on file before the change; notice letter mailed to the address on file 2026-10-01"
        ],
        [
          "2026-10-01T18:32:16Z",
          "premier checking x4471",
          "Online banking activated from the link sent to the new email; first login from a new Android device, IP 203.0.113.140 (hosting provider ASN); one-time code to (614) 555-0186"
        ],
        [
          "2026-10-02T12:58:03Z",
          "premier checking x4471",
          "External account added for transfers by instant verification; owner name on the external account does not match the customer"
        ],
        [
          "2026-10-02T13:20:44Z",
          "premier checking x4471",
          "External transfer $9,900.00 from money market x4475 to the new external account blocked by the takeover model (new device, new external account and contact change within 24 hours); accounts restricted 13:21:15Z. No money left the accounts."
        ],
        [
          "2026-10-02T16:05:27Z",
          "premier checking x4471",
          "Fraud operations reached the customer on the previous home landline from the change history: she did not visit any branch, has not lost her phone or wallet, and did not enroll in online banking. Contact details restored and online banking access removed; fraud case FC-2026-118266 opened with no loss."
        ],
        [
          "2026-10-03T11:40:52Z",
          "premier checking x4471",
          "Fraud operations matched the license number from the B-0233 ID scan to a scan at branch B-0151 on 2026-09-30 at 17:22Z: a visitor asked to change the phone number on savings x7730 (another customer), the scan returned 'unable to verify', and banker E-43305 refused without a second ID. The B-0151 visitor gave (614) 555-0193. E-44718 has never opened x7730."
        ],
        [
          "2026-10-03T15:18:09Z",
          "premier checking x4471",
          "ID-scan vendor review of the B-0233 license image: consistent with a counterfeit (printing and hologram), issued in the customer's name with her date of birth and address"
        ],
        [
          "2026-10-05T10:00:00Z",
          "checking x6159",
          "No changes since the lookup"
        ],
        [
          "2026-10-05T10:00:00Z",
          "all other accounts in the access log",
          "No contact-detail change, new device, new payee or fraud claim since the lookups"
        ]
      ]
    }
  },
  "questions": {
    "access_without_business_reason": {
      "type": "noul",
      "instructions": "Did the employee open or change any customer account in this alert without a business reason, meaning that no customer contact, ticket, assigned case or other work item explains it?"
    },
    "enabling_fraud_likelihood": {
      "type": "score",
      "instructions": "How likely is it that the employee is helping people outside the institution commit fraud against customer accounts, for example by passing on account details or changing accounts so that others can take them over?",
      "criteria": [
        "Very unlikely (under 10%)",
        "Unlikely (10-40%)",
        "Uncertain (40-60%)",
        "Likely (60-90%)",
        "Very likely (over 90%)"
      ]
    },
    "explanation": {
      "type": "choice",
      "instructions": "What is the most likely explanation for the employee's activity flagged in this alert?",
      "criteria": {
        "legitimate_work": "Legitimate work: customer contacts, tickets, assigned cases, training or supervisory review explain the activity",
        "snooping": "Curiosity or snooping: the employee viewed accounts with no business reason, without changing them or using what they saw for gain",
        "self_dealing": "Self-dealing: the employee used their access to benefit themselves or someone linked to them, for example by reversing fees or raising limits on their own or a household member's account",
        "enabling_fraud": "Enabling outside fraud: the employee looked up or changed accounts so that people outside the institution could take them over or take money from them",
        "policy_mistake": "Policy mistake: the employee was handling a real customer's real request but skipped a required step, such as logging the contact or verifying identity"
      }
    },
    "action": {
      "type": "choice",
      "instructions": "What should happen with this alert now?",
      "criteria": {
        "no_action": "Close the alert as legitimate activity, with no action against the employee",
        "refer": "Refer the employee to the insider risk team for investigation, leaving their system access in place for now",
        "suspend": "Suspend the employee's system access now and escalate to the insider risk team and HR"
      }
    }
  }
}