{
  "model": "grayson-1",
  "state": {
    "alert": {
      "id": "IR-ALR-21093",
      "source": "Employee access monitoring over CRM, core banking and digital banking admin logs",
      "created": "2026-10-05T11:00:00Z",
      "window_start": "2026-09-28T00:00:00Z",
      "window_end": "2026-10-04T23:59:59Z",
      "priority": "P1",
      "rules_fired": [
        "IR-04: 3 or more account lookups in 7 days with no call, chat, ticket or case linked within 30 minutes (16 in this window)",
        "IR-07: Sessions outside the scheduled shift (2 sessions, 14 lookups)",
        "IR-12: Lookup of an account with a balance over $250,000 that is outside the employee's queue (4 accounts)",
        "IR-14: Phone or email change with no inbound call or chat handled by the employee in the 30 minutes before (5 changes on 3 accounts)",
        "IR-16: Session from a network not seen for this user in the last 30 days (2 sessions)",
        "IR-21: Account the employee accessed had a confirmed or suspected takeover within 7 days (3 accounts)"
      ]
    },
    "employee": {
      "employee_id": "E-71964",
      "employment_type": "Contractor through a contact-center staffing vendor (vendor V-114)",
      "role": "Digital banking support agent, tier 2",
      "start_date": "2026-06-15",
      "queue": "Inbound calls and chats about online and mobile banking: login problems, password resets, locked access, device enrollment",
      "work_location": "Remote, through a virtual desktop (VDI)",
      "scheduled_shift": "Monday to Friday, 12:00 to 20:30 UTC (08:00 to 16:30 Eastern)",
      "entitlements": "View customer profiles, balances, contact details, authentication profile and online banking status; send password reset links; unlock online banking; remove devices; change phone and email after identity verification. No payments or money movement.",
      "entitlement_changes": [
        "2026-09-08: phone and email change added after tier 2 training (standard for the role)"
      ],
      "identity_verification_policy": "Phone or email changes need a one-time code to the phone or email on file. If the customer can't receive one, the agent may verify with knowledge-based questions (KBA) on a live inbound call and must note it in a ticket.",
      "background_check": "Completed by the vendor 2026-06-02, no findings",
      "privacy_training": "Completed 2026-06-19",
      "employment_status": "Vendor told us on 2026-10-01 that the contractor gave notice; last day 2026-10-09",
      "conflict_of_interest_disclosures": "None on file",
      "quality_scores": "Call quality reviews July to September: 4 reviews, all passed",
      "prior_alerts": []
    },
    "weekly_history": {
      "columns": [
        "week_start",
        "lookups",
        "linked",
        "unlinked",
        "account_changes",
        "phone_or_email_changes",
        "sessions_outside_shift",
        "dlp_events"
      ],
      "rows": [
        [
          "2026-08-03",
          208,
          208,
          0,
          71,
          0,
          0,
          1
        ],
        [
          "2026-08-10",
          221,
          220,
          1,
          77,
          0,
          0,
          0
        ],
        [
          "2026-08-17",
          214,
          214,
          0,
          74,
          0,
          0,
          1
        ],
        [
          "2026-08-24",
          229,
          229,
          0,
          81,
          0,
          0,
          0
        ],
        [
          "2026-08-31",
          181,
          180,
          1,
          63,
          0,
          0,
          0
        ],
        [
          "2026-09-07",
          199,
          199,
          0,
          70,
          2,
          0,
          0
        ],
        [
          "2026-09-14",
          232,
          230,
          2,
          84,
          5,
          0,
          0
        ],
        [
          "2026-09-21",
          236,
          231,
          5,
          82,
          6,
          0,
          1
        ]
      ]
    },
    "peer_baseline": "Digital banking support agents, tier 2 (64 agents, employees and contractors), per agent per week over the last 8 weeks: lookups median 224 (95th percentile 281); unlinked lookups median 1 (95th percentile 4); phone or email changes median 5 (95th percentile 11), with no inbound contact before them median 0 (95th percentile 0); sessions outside shift median 0 (95th percentile 1, all approved overtime).",
    "monitoring_notes": "No phone, chat or CRM outages and no link-check incidents in this window. Tickets count as links for IR-04, so lookups within 30 minutes of a ticket the employee created are not counted as unlinked.",
    "sessions": {
      "columns": [
        "login",
        "logout",
        "client",
        "source_network",
        "phone_system"
      ],
      "rows": [
        [
          "2026-09-28T11:46:03Z",
          "2026-09-28T20:36:55Z",
          "VDI from personal laptop (seen since 2026-06-15)",
          "198.51.100.24, residential ISP, Tampa, FL",
          "logged in for the shift"
        ],
        [
          "2026-09-29T11:53:29Z",
          "2026-09-29T20:33:07Z",
          "VDI from personal laptop (seen since 2026-06-15)",
          "198.51.100.24, residential ISP, Tampa, FL",
          "logged in for the shift"
        ],
        [
          "2026-09-30T11:49:15Z",
          "2026-09-30T20:34:49Z",
          "VDI from personal laptop (seen since 2026-06-15)",
          "198.51.100.24, residential ISP, Tampa, FL",
          "logged in for the shift"
        ],
        [
          "2026-10-01T02:09:14Z",
          "2026-10-01T02:51:40Z",
          "VDI from personal laptop (same device)",
          "203.0.113.77, hosting provider ASN used by a commercial VPN service; first seen for this user",
          "not logged in"
        ],
        [
          "2026-10-01T11:50:31Z",
          "2026-10-01T20:32:28Z",
          "VDI from personal laptop (seen since 2026-06-15)",
          "198.51.100.24, residential ISP, Tampa, FL",
          "logged in for the shift"
        ],
        [
          "2026-10-02T11:50:04Z",
          "2026-10-02T20:39:42Z",
          "VDI from personal laptop (seen since 2026-06-15)",
          "198.51.100.24, residential ISP, Tampa, FL",
          "logged in for the shift"
        ],
        [
          "2026-10-03T03:02:26Z",
          "2026-10-03T03:41:05Z",
          "VDI from personal laptop (same device)",
          "203.0.113.81, same hosting provider ASN",
          "not logged in"
        ]
      ]
    },
    "access_log": {
      "columns": [
        "ts",
        "account",
        "holder",
        "viewed",
        "seconds",
        "change",
        "linked_to"
      ],
      "rows": [
        [
          "2026-09-28T12:07:02Z",
          "savings x5004",
          "customer",
          "profile, devices, login history, contact details",
          440,
          "online banking unlocked",
          "chat CH-552103"
        ],
        [
          "2026-09-28T12:19:14Z",
          "money market x6091",
          "customer",
          "profile, online banking status",
          445,
          "",
          "call CL-48810233"
        ],
        [
          "2026-09-28T12:37:52Z",
          "money market x0083",
          "customer",
          "profile, devices",
          299,
          "",
          "call CL-48810529"
        ],
        [
          "2026-09-28T12:46:24Z",
          "money market x5737",
          "customer",
          "profile, login history",
          464,
          "",
          "call CL-48810679"
        ],
        [
          "2026-09-28T12:59:05Z",
          "checking x9391",
          "customer",
          "profile, contact details, authentication profile",
          335,
          "password reset link sent to email on file",
          "call CL-48811077"
        ],
        [
          "2026-09-28T13:08:42Z",
          "money market x9775",
          "customer",
          "profile, devices, login history, contact details",
          291,
          "",
          "call CL-48811390"
        ],
        [
          "2026-09-28T13:09:16Z",
          "money market x4797",
          "customer",
          "profile, devices",
          125,
          "",
          "call CL-48811390"
        ],
        [
          "2026-09-28T13:23:40Z",
          "checking x4913",
          "customer",
          "profile, contact details, authentication profile",
          569,
          "",
          "call CL-48811607"
        ],
        [
          "2026-09-28T13:41:26Z",
          "checking x9797",
          "customer",
          "profile, contact details, authentication profile",
          192,
          "online banking unlocked",
          "chat CH-552128"
        ],
        [
          "2026-09-28T13:42:42Z",
          "savings x5740",
          "customer",
          "profile, contact details, authentication profile",
          60,
          "",
          "chat CH-552128"
        ],
        [
          "2026-09-28T13:53:14Z",
          "credit card x2931",
          "customer",
          "profile, online banking status",
          320,
          "",
          "call CL-48811897"
        ],
        [
          "2026-09-28T14:05:05Z",
          "money market x2203",
          "customer",
          "profile, online banking status",
          632,
          "",
          "call CL-48812168"
        ],
        [
          "2026-09-28T14:22:04Z",
          "money market x7314",
          "customer",
          "profile, devices",
          445,
          "password reset link sent to email on file",
          "call CL-48812237"
        ],
        [
          "2026-09-28T14:34:29Z",
          "credit card x9141",
          "customer",
          "profile, devices, login history, contact details",
          469,
          "password reset link sent to email on file",
          "chat CH-552157"
        ],
        [
          "2026-09-28T14:48:34Z",
          "checking x7689",
          "customer",
          "profile, contact details, authentication profile",
          631,
          "",
          "chat CH-552189"
        ],
        [
          "2026-09-28T15:10:42Z",
          "savings x2129",
          "customer",
          "profile, devices",
          619,
          "online banking unlocked",
          "call CL-48812596"
        ],
        [
          "2026-09-28T15:11:32Z",
          "money market x8913",
          "customer",
          "profile, devices",
          248,
          "",
          "call CL-48812596"
        ],
        [
          "2026-09-28T15:25:21Z",
          "checking x3140",
          "customer",
          "profile, devices",
          507,
          "password reset link sent to email on file",
          "call CL-48812794"
        ],
        [
          "2026-09-28T15:42:45Z",
          "money market x2650",
          "customer",
          "profile, devices",
          315,
          "",
          "call CL-48813069"
        ],
        [
          "2026-09-28T15:51:41Z",
          "checking x8201",
          "customer",
          "profile, online banking status",
          248,
          "",
          "call CL-48813223"
        ],
        [
          "2026-09-28T16:31:36Z",
          "checking x2503",
          "customer",
          "profile, online banking status, login history",
          486,
          "",
          "call CL-48813588"
        ],
        [
          "2026-09-28T16:48:01Z",
          "money market x0330",
          "customer",
          "profile, online banking status, login history",
          291,
          "password reset link sent to email on file",
          "call CL-48813706"
        ],
        [
          "2026-09-28T16:56:23Z",
          "checking x2565",
          "customer",
          "profile, alerts settings",
          321,
          "password reset link sent to email on file",
          "chat CH-552210"
        ],
        [
          "2026-09-28T17:07:51Z",
          "credit card x6369",
          "customer",
          "profile, login history",
          395,
          "trusted devices reset",
          "chat CH-552237"
        ],
        [
          "2026-09-28T17:18:36Z",
          "checking x1855",
          "customer",
          "profile, devices, login history, contact details",
          541,
          "password reset link sent to email on file",
          "chat CH-552271"
        ],
        [
          "2026-09-28T17:19:16Z",
          "checking x6391",
          "customer",
          "profile, online banking status, login history",
          244,
          "",
          "chat CH-552271"
        ],
        [
          "2026-09-28T17:33:55Z",
          "savings x1724",
          "customer",
          "profile, devices, login history, contact details",
          265,
          "",
          "call CL-48813800"
        ],
        [
          "2026-09-28T17:47:22Z",
          "checking x3831",
          "customer",
          "profile, devices, login history, contact details",
          437,
          "online banking unlocked",
          "call CL-48814018"
        ],
        [
          "2026-09-28T17:58:03Z",
          "checking x1791",
          "customer",
          "profile, devices",
          340,
          "",
          "call CL-48814395"
        ],
        [
          "2026-09-28T18:09:38Z",
          "checking x5878",
          "customer",
          "profile, online banking status, login history",
          318,
          "",
          "chat CH-552290"
        ],
        [
          "2026-09-28T18:38:25Z",
          "checking x7300",
          "customer",
          "profile, online banking status, login history",
          390,
          "password reset link sent to email on file",
          "call CL-48814508"
        ],
        [
          "2026-09-28T18:55:37Z",
          "money market x1812",
          "customer",
          "profile, contact details, authentication profile",
          533,
          "trusted devices reset",
          "call CL-48814565"
        ],
        [
          "2026-09-28T19:14:34Z",
          "savings x1959",
          "customer",
          "profile, devices, login history, contact details",
          593,
          "",
          "chat CH-552321"
        ],
        [
          "2026-09-28T19:30:22Z",
          "checking x2361",
          "customer",
          "profile, online banking status, login history",
          420,
          "online banking unlocked",
          "call CL-48814624"
        ],
        [
          "2026-09-28T19:41:00Z",
          "checking x2974",
          "customer",
          "profile, login history",
          153,
          "password reset link sent to email on file",
          "call CL-48814926"
        ],
        [
          "2026-09-28T19:47:01Z",
          "checking x4982",
          "customer",
          "profile, devices",
          491,
          "",
          "call CL-48815297"
        ],
        [
          "2026-09-28T19:59:33Z",
          "credit card x4850",
          "customer",
          "profile, devices, login history, contact details",
          283,
          "online banking enrollment completed with customer",
          "call CL-48815484"
        ],
        [
          "2026-09-28T20:09:02Z",
          "checking x2052",
          "customer",
          "profile, devices",
          227,
          "",
          "call CL-48815644"
        ],
        [
          "2026-09-28T20:20:00Z",
          "checking x7556",
          "customer",
          "profile, login history",
          576,
          "",
          "call CL-48815802"
        ],
        [
          "2026-09-29T12:05:15Z",
          "money market x3154",
          "customer",
          "profile, online banking status, devices, login history",
          340,
          "",
          "chat CH-552340"
        ],
        [
          "2026-09-29T12:16:20Z",
          "money market x4875",
          "customer",
          "profile, contact details, authentication profile",
          525,
          "online banking unlocked",
          "chat CH-552367"
        ],
        [
          "2026-09-29T12:29:34Z",
          "money market x0353",
          "customer",
          "profile, devices",
          380,
          "",
          "call CL-48815998"
        ],
        [
          "2026-09-29T12:41:19Z",
          "money market x1827",
          "customer",
          "profile, devices",
          250,
          "password reset link sent to email on file",
          "call CL-48816178"
        ],
        [
          "2026-09-29T12:48:59Z",
          "checking x2347",
          "customer",
          "profile, login history",
          547,
          "alert preferences updated",
          "call CL-48816457"
        ],
        [
          "2026-09-29T12:50:58Z",
          "credit card x4602",
          "customer",
          "profile, contact details, authentication profile",
          225,
          "",
          "call CL-48816457"
        ],
        [
          "2026-09-29T13:02:55Z",
          "money market x0506",
          "customer",
          "profile, online banking status, devices, login history",
          378,
          "",
          "call CL-48816849"
        ],
        [
          "2026-09-29T13:11:46Z",
          "savings x7425",
          "customer",
          "profile, online banking status, devices, login history",
          389,
          "",
          "chat CH-552384"
        ],
        [
          "2026-09-29T13:23:11Z",
          "money market x2908",
          "customer",
          "profile, contact details, authentication profile",
          205,
          "device removed",
          "call CL-48817064"
        ],
        [
          "2026-09-29T13:30:07Z",
          "money market x6917",
          "customer",
          "profile, devices, login history, contact details",
          343,
          "",
          "call CL-48817307"
        ],
        [
          "2026-09-29T13:40:56Z",
          "money market x9465",
          "customer",
          "profile, online banking status, devices, login history",
          188,
          "device removed",
          "call CL-48817497"
        ],
        [
          "2026-09-29T13:49:01Z",
          "money market x2066",
          "customer",
          "profile, contact details, authentication profile",
          343,
          "device removed",
          "call CL-48817875"
        ],
        [
          "2026-09-29T13:51:02Z",
          "savings x9007",
          "customer",
          "profile, contact details, authentication profile",
          146,
          "",
          "call CL-48817875"
        ],
        [
          "2026-09-29T13:59:46Z",
          "checking x6768",
          "customer",
          "profile, online banking status, login history",
          415,
          "",
          "call CL-48818065"
        ],
        [
          "2026-09-29T14:23:11Z",
          "credit card x2030",
          "customer",
          "profile, login history",
          364,
          "",
          "call CL-48818198"
        ],
        [
          "2026-09-29T14:24:23Z",
          "checking x3340",
          "customer",
          "profile, devices",
          154,
          "",
          "call CL-48818198"
        ],
        [
          "2026-09-29T14:36:33Z",
          "savings x3020",
          "customer",
          "profile, online banking status, devices, login history",
          787,
          "",
          "call CL-48818304"
        ],
        [
          "2026-09-29T14:55:02Z",
          "credit card x2340",
          "customer",
          "profile, online banking status, devices, login history",
          361,
          "password reset link sent to email on file",
          "call CL-48818660"
        ],
        [
          "2026-09-29T15:06:04Z",
          "money market x7596",
          "customer",
          "profile, devices",
          370,
          "device removed",
          "call CL-48818818"
        ],
        [
          "2026-09-29T15:17:24Z",
          "savings x0789",
          "customer",
          "profile, devices, login history, contact details",
          131,
          "",
          "call CL-48819086"
        ],
        [
          "2026-09-29T15:26:00Z",
          "checking x5118",
          "customer",
          "profile, online banking status, login history",
          319,
          "",
          "call CL-48819422"
        ],
        [
          "2026-09-29T15:40:09Z",
          "checking x8815",
          "customer",
          "profile, online banking status",
          274,
          "phone change",
          "call CL-48819518"
        ],
        [
          "2026-09-29T15:50:38Z",
          "credit card x5620",
          "customer",
          "profile, online banking status",
          353,
          "password reset link sent to email on file",
          "call CL-48819864"
        ],
        [
          "2026-09-29T16:32:13Z",
          "savings x2614",
          "customer",
          "profile, devices, login history, contact details",
          204,
          "device removed",
          "call CL-48820028"
        ],
        [
          "2026-09-29T16:40:16Z",
          "checking x1427",
          "customer",
          "profile, login history",
          380,
          "",
          "chat CH-552387"
        ],
        [
          "2026-09-29T16:51:12Z",
          "premier checking x3318",
          "customer",
          "profile, contact details, authentication profile, online banking status, balances",
          214,
          "",
          ""
        ],
        [
          "2026-09-29T16:52:06Z",
          "credit card x3162",
          "customer",
          "profile, login history",
          314,
          "password reset link sent to email on file",
          "call CL-48820249"
        ],
        [
          "2026-09-29T16:59:48Z",
          "checking x5394",
          "customer",
          "profile, contact details, authentication profile",
          402,
          "online banking unlocked",
          "call CL-48820436"
        ],
        [
          "2026-09-29T17:11:23Z",
          "checking x4060",
          "customer",
          "profile, login history",
          288,
          "",
          "call CL-48820506"
        ],
        [
          "2026-09-29T17:21:07Z",
          "money market x2466",
          "customer",
          "profile, online banking status, login history",
          360,
          "trusted devices reset",
          "call CL-48820767"
        ],
        [
          "2026-09-29T17:32:42Z",
          "checking x0522",
          "customer",
          "profile, online banking status",
          201,
          "",
          "call CL-48821085"
        ],
        [
          "2026-09-29T17:46:47Z",
          "checking x2904",
          "customer",
          "profile, devices",
          520,
          "",
          "call CL-48821275"
        ],
        [
          "2026-09-29T18:06:17Z",
          "credit card x6359",
          "customer",
          "profile, devices, login history, contact details",
          136,
          "",
          "call CL-48821433"
        ],
        [
          "2026-09-29T18:14:20Z",
          "checking x9690",
          "customer",
          "profile, alerts settings",
          490,
          "",
          "call CL-48821522"
        ],
        [
          "2026-09-29T18:37:04Z",
          "money market x1070",
          "customer",
          "profile, devices, login history, contact details",
          500,
          "",
          "chat CH-552407"
        ],
        [
          "2026-09-29T18:51:14Z",
          "checking x6436",
          "customer",
          "profile, online banking status",
          427,
          "",
          "call CL-48821706"
        ],
        [
          "2026-09-29T19:04:02Z",
          "credit card x9587",
          "customer",
          "profile, devices, login history, contact details",
          523,
          "password reset link sent to email on file",
          "chat CH-552439"
        ],
        [
          "2026-09-29T19:19:51Z",
          "savings x0519",
          "customer",
          "profile, alerts settings",
          507,
          "",
          "call CL-48821971"
        ],
        [
          "2026-09-29T19:20:22Z",
          "checking x5131",
          "customer",
          "profile, devices",
          185,
          "",
          "call CL-48821971"
        ],
        [
          "2026-09-29T19:35:28Z",
          "checking x8403",
          "customer",
          "profile, contact details, authentication profile",
          550,
          "",
          "call CL-48822360"
        ],
        [
          "2026-09-29T19:52:32Z",
          "checking x3184",
          "customer",
          "profile, alerts settings",
          386,
          "",
          "call CL-48822628"
        ],
        [
          "2026-09-29T20:03:16Z",
          "money market x6673",
          "customer",
          "profile, login history",
          400,
          "online banking unlocked",
          "call CL-48822781"
        ],
        [
          "2026-09-29T20:15:15Z",
          "money market x3386",
          "customer",
          "profile, alerts settings",
          372,
          "online banking unlocked",
          "call CL-48823108"
        ],
        [
          "2026-09-30T12:03:00Z",
          "savings x0955",
          "customer",
          "profile, contact details, authentication profile",
          428,
          "password reset link sent to email on file",
          "call CL-48823423"
        ],
        [
          "2026-09-30T12:17:50Z",
          "credit card x9869",
          "customer",
          "profile, contact details, authentication profile",
          304,
          "trusted devices reset",
          "call CL-48823587"
        ],
        [
          "2026-09-30T12:27:14Z",
          "checking x1492",
          "customer",
          "profile, alerts settings",
          394,
          "",
          "call CL-48823762"
        ],
        [
          "2026-09-30T12:37:15Z",
          "credit card x7977",
          "customer",
          "profile, devices",
          437,
          "",
          "chat CH-552458"
        ],
        [
          "2026-09-30T12:50:27Z",
          "credit card x5296",
          "customer",
          "profile, online banking status, login history",
          436,
          "",
          "call CL-48823862"
        ],
        [
          "2026-09-30T12:52:14Z",
          "checking x1626",
          "customer",
          "profile, contact details, authentication profile",
          209,
          "",
          "call CL-48823862"
        ],
        [
          "2026-09-30T13:07:08Z",
          "money market x4897",
          "customer",
          "profile, online banking status",
          619,
          "",
          "chat CH-552493"
        ],
        [
          "2026-09-30T13:21:40Z",
          "credit card x1244",
          "customer",
          "profile, online banking status, login history",
          283,
          "",
          "call CL-48824141"
        ],
        [
          "2026-09-30T13:30:47Z",
          "credit card x0497",
          "customer",
          "profile, online banking status",
          449,
          "device removed",
          "call CL-48824250"
        ],
        [
          "2026-09-30T13:42:41Z",
          "checking x5329",
          "customer",
          "profile, contact details, authentication profile",
          361,
          "",
          "call CL-48824400"
        ],
        [
          "2026-09-30T13:54:27Z",
          "checking x1462",
          "customer",
          "profile, contact details, authentication profile",
          210,
          "password reset link sent to email on file",
          "call CL-48824572"
        ],
        [
          "2026-09-30T14:02:59Z",
          "money market x3066",
          "customer",
          "profile, alerts settings",
          612,
          "",
          "call CL-48824734"
        ],
        [
          "2026-09-30T14:07:40Z",
          "checking x5120",
          "customer",
          "profile, contact details, authentication profile, balances",
          166,
          "",
          ""
        ],
        [
          "2026-09-30T14:22:12Z",
          "money market x2155",
          "customer",
          "profile, online banking status, devices, login history",
          275,
          "",
          "call CL-48825018"
        ],
        [
          "2026-09-30T14:31:26Z",
          "checking x5930",
          "customer",
          "profile, online banking status",
          627,
          "password reset link sent to email on file",
          "chat CH-552531"
        ],
        [
          "2026-09-30T14:48:15Z",
          "checking x4647",
          "customer",
          "profile, devices, login history, contact details",
          218,
          "",
          "call CL-48825189"
        ],
        [
          "2026-09-30T14:58:12Z",
          "checking x6628",
          "customer",
          "profile, login history",
          461,
          "online banking unlocked",
          "call CL-48825499"
        ],
        [
          "2026-09-30T15:11:36Z",
          "checking x8214",
          "customer",
          "profile, devices",
          110,
          "",
          "call CL-48825863"
        ],
        [
          "2026-09-30T15:16:26Z",
          "checking x2695",
          "customer",
          "profile, online banking status",
          456,
          "",
          "call CL-48826157"
        ],
        [
          "2026-09-30T15:28:42Z",
          "checking x9416",
          "customer",
          "profile, login history",
          455,
          "",
          "call CL-48826453"
        ],
        [
          "2026-09-30T15:45:07Z",
          "checking x0751",
          "customer",
          "profile, login history",
          406,
          "",
          "call CL-48826639"
        ],
        [
          "2026-09-30T15:59:49Z",
          "checking x1154",
          "customer",
          "profile, login history",
          206,
          "",
          "call CL-48826945"
        ],
        [
          "2026-09-30T16:01:28Z",
          "checking x5622",
          "customer",
          "profile, contact details, authentication profile",
          74,
          "",
          "call CL-48826945"
        ],
        [
          "2026-09-30T16:33:06Z",
          "money market x5939",
          "customer",
          "profile, login history",
          231,
          "",
          "chat CH-552567"
        ],
        [
          "2026-09-30T16:41:41Z",
          "checking x1549",
          "customer",
          "profile, online banking status, devices, login history",
          306,
          "online banking unlocked",
          "call CL-48827075"
        ],
        [
          "2026-09-30T16:42:49Z",
          "savings x2070",
          "customer",
          "profile, contact details, authentication profile",
          111,
          "",
          "call CL-48827075"
        ],
        [
          "2026-09-30T16:50:11Z",
          "credit card x1136",
          "customer",
          "profile, devices, login history, contact details",
          281,
          "password reset link sent to email on file",
          "call CL-48827178"
        ],
        [
          "2026-09-30T16:58:02Z",
          "credit card x7546",
          "customer",
          "profile, login history",
          201,
          "device removed",
          "chat CH-552591"
        ],
        [
          "2026-09-30T17:04:56Z",
          "checking x0728",
          "customer",
          "profile, contact details, authentication profile",
          343,
          "email change",
          "chat CH-552622"
        ],
        [
          "2026-09-30T17:18:11Z",
          "money market x5402",
          "customer",
          "profile, contact details, authentication profile",
          324,
          "",
          "chat CH-552662"
        ],
        [
          "2026-09-30T17:35:35Z",
          "money market x1023",
          "customer",
          "profile, devices, login history, contact details",
          458,
          "password reset link sent to email on file",
          "call CL-48827392"
        ],
        [
          "2026-09-30T17:52:37Z",
          "savings x2683",
          "customer",
          "profile, alerts settings",
          262,
          "",
          "call CL-48827441"
        ],
        [
          "2026-09-30T18:01:38Z",
          "savings x6859",
          "customer",
          "profile, login history",
          397,
          "online banking unlocked",
          "call CL-48827800"
        ],
        [
          "2026-09-30T18:14:00Z",
          "savings x0177",
          "customer",
          "profile, online banking status",
          251,
          "",
          "chat CH-552697"
        ],
        [
          "2026-09-30T18:37:17Z",
          "checking x3462",
          "customer",
          "profile, devices",
          331,
          "",
          "call CL-48827907"
        ],
        [
          "2026-09-30T18:40:05Z",
          "money market x6631",
          "customer",
          "profile, contact details, authentication profile, balances",
          131,
          "",
          ""
        ],
        [
          "2026-09-30T18:46:37Z",
          "checking x6047",
          "customer",
          "profile, login history",
          709,
          "",
          "call CL-48828025"
        ],
        [
          "2026-09-30T19:03:29Z",
          "savings x4030",
          "customer",
          "profile, devices, login history, contact details",
          326,
          "",
          "call CL-48828234"
        ],
        [
          "2026-09-30T19:13:59Z",
          "credit card x0106",
          "customer",
          "profile, alerts settings",
          553,
          "device removed",
          "call CL-48828566"
        ],
        [
          "2026-09-30T19:15:27Z",
          "money market x1193",
          "customer",
          "profile, devices",
          236,
          "",
          "call CL-48828566"
        ],
        [
          "2026-09-30T19:28:01Z",
          "checking x5275",
          "customer",
          "profile, devices",
          515,
          "",
          "call CL-48828697"
        ],
        [
          "2026-09-30T19:46:59Z",
          "checking x7804",
          "customer",
          "profile, alerts settings",
          397,
          "online banking unlocked",
          "call CL-48829022"
        ],
        [
          "2026-09-30T20:00:58Z",
          "checking x9392",
          "customer",
          "profile, online banking status",
          374,
          "password reset link sent to email on file",
          "call CL-48829202"
        ],
        [
          "2026-09-30T20:13:30Z",
          "credit card x7548",
          "customer",
          "profile, online banking status, devices, login history",
          475,
          "online banking unlocked",
          "chat CH-552737"
        ],
        [
          "2026-10-01T02:12:31Z",
          "premier checking x3318",
          "customer",
          "profile, contact details, authentication profile, online banking status",
          188,
          "",
          "ticket TK-604417"
        ],
        [
          "2026-10-01T02:15:58Z",
          "money market x1186",
          "customer",
          "profile, contact details, authentication profile, balances",
          171,
          "",
          ""
        ],
        [
          "2026-10-01T02:19:20Z",
          "savings x7742",
          "customer",
          "profile, contact details, authentication profile, balances",
          142,
          "",
          ""
        ],
        [
          "2026-10-01T02:22:47Z",
          "checking x2659",
          "customer",
          "profile, contact details, balances, online banking status",
          119,
          "",
          ""
        ],
        [
          "2026-10-01T02:27:03Z",
          "premier checking x3318",
          "customer",
          "profile, contact details",
          402,
          "phone change; email change",
          "ticket TK-604417"
        ],
        [
          "2026-10-01T02:38:14Z",
          "checking x5120",
          "customer",
          "profile, contact details, authentication profile, online banking status",
          205,
          "",
          ""
        ],
        [
          "2026-10-01T02:43:36Z",
          "savings x0457",
          "customer",
          "profile, contact details, authentication profile, devices",
          154,
          "",
          ""
        ],
        [
          "2026-10-01T02:47:22Z",
          "savings x8203",
          "customer",
          "profile, contact details, balances",
          96,
          "",
          ""
        ],
        [
          "2026-10-01T12:05:07Z",
          "savings x7663",
          "customer",
          "profile, online banking status, devices, login history",
          334,
          "",
          "call CL-48829560"
        ],
        [
          "2026-10-01T12:29:12Z",
          "checking x7286",
          "customer",
          "profile, online banking status",
          618,
          "",
          "call CL-48829941"
        ],
        [
          "2026-10-01T12:30:46Z",
          "checking x6329",
          "customer",
          "profile, online banking status, login history",
          243,
          "",
          "call CL-48829941"
        ],
        [
          "2026-10-01T12:56:11Z",
          "savings x1597",
          "customer",
          "profile, alerts settings",
          336,
          "device removed",
          "call CL-48830215"
        ],
        [
          "2026-10-01T12:58:39Z",
          "savings x0868",
          "customer",
          "profile, contact details, authentication profile",
          127,
          "",
          "call CL-48830215"
        ],
        [
          "2026-10-01T13:05:40Z",
          "credit card x6971",
          "customer",
          "profile, contact details, authentication profile",
          508,
          "",
          "call CL-48830418"
        ],
        [
          "2026-10-01T13:06:14Z",
          "checking x2394",
          "customer",
          "profile, online banking status, login history",
          174,
          "",
          "call CL-48830418"
        ],
        [
          "2026-10-01T13:22:23Z",
          "checking x0765",
          "customer",
          "profile, login history",
          540,
          "password reset link sent to email on file",
          "call CL-48830695"
        ],
        [
          "2026-10-01T13:22:51Z",
          "savings x0457",
          "customer",
          "profile, contact details, online banking status, devices",
          148,
          "",
          ""
        ],
        [
          "2026-10-01T13:35:55Z",
          "checking x7027",
          "customer",
          "profile, devices, login history, contact details",
          388,
          "",
          "call CL-48831054"
        ],
        [
          "2026-10-01T13:59:54Z",
          "checking x6115",
          "customer",
          "profile, alerts settings",
          328,
          "",
          "call CL-48831233"
        ],
        [
          "2026-10-01T14:22:42Z",
          "savings x5153",
          "customer",
          "profile, devices",
          282,
          "online banking enrollment completed with customer",
          "call CL-48831479"
        ],
        [
          "2026-10-01T14:33:41Z",
          "checking x7655",
          "customer",
          "profile, online banking status, login history",
          406,
          "",
          "chat CH-552774"
        ],
        [
          "2026-10-01T14:49:27Z",
          "checking x3988",
          "customer",
          "profile, login history",
          296,
          "",
          "call CL-48831800"
        ],
        [
          "2026-10-01T15:01:15Z",
          "credit card x5314",
          "customer",
          "profile, contact details, authentication profile",
          100,
          "",
          "call CL-48832058"
        ],
        [
          "2026-10-01T15:11:58Z",
          "money market x2463",
          "customer",
          "profile, devices",
          315,
          "",
          "call CL-48832400"
        ],
        [
          "2026-10-01T15:25:38Z",
          "credit card x0761",
          "customer",
          "profile, online banking status",
          211,
          "",
          "chat CH-552814"
        ],
        [
          "2026-10-01T15:32:15Z",
          "checking x0137",
          "customer",
          "profile, devices, login history, contact details",
          407,
          "",
          "call CL-48832468"
        ],
        [
          "2026-10-01T15:44:23Z",
          "credit card x9000",
          "customer",
          "profile, alerts settings",
          405,
          "online banking unlocked",
          "call CL-48832857"
        ],
        [
          "2026-10-01T15:46:27Z",
          "checking x6138",
          "customer",
          "profile, contact details, authentication profile",
          149,
          "",
          "call CL-48832857"
        ],
        [
          "2026-10-01T15:55:33Z",
          "savings x4315",
          "customer",
          "profile, devices",
          393,
          "",
          "call CL-48832897"
        ],
        [
          "2026-10-01T15:57:16Z",
          "checking x7768",
          "customer",
          "profile, contact details, authentication profile",
          147,
          "",
          "call CL-48832897"
        ],
        [
          "2026-10-01T16:30:56Z",
          "savings x2851",
          "customer",
          "profile, online banking status, devices, login history",
          406,
          "online banking unlocked",
          "chat CH-552835"
        ],
        [
          "2026-10-01T16:32:11Z",
          "money market x8474",
          "customer",
          "profile, contact details, authentication profile",
          158,
          "",
          "chat CH-552835"
        ],
        [
          "2026-10-01T16:42:23Z",
          "savings x1910",
          "customer",
          "profile, alerts settings",
          425,
          "",
          "call CL-48833035"
        ],
        [
          "2026-10-01T16:54:40Z",
          "savings x8955",
          "customer",
          "profile, alerts settings",
          117,
          "",
          "call CL-48833242"
        ],
        [
          "2026-10-01T16:58:37Z",
          "money market x6319",
          "customer",
          "profile, devices, login history, contact details",
          358,
          "password reset link sent to email on file",
          "call CL-48833478"
        ],
        [
          "2026-10-01T17:17:30Z",
          "credit card x4866",
          "customer",
          "profile, alerts settings",
          272,
          "device removed",
          "chat CH-552850"
        ],
        [
          "2026-10-01T17:29:14Z",
          "checking x3951",
          "customer",
          "profile, online banking status, login history",
          376,
          "online banking unlocked",
          "call CL-48833863"
        ],
        [
          "2026-10-01T17:42:00Z",
          "checking x5997",
          "customer",
          "profile, devices, login history, contact details",
          227,
          "phone change",
          "call CL-48833973"
        ],
        [
          "2026-10-01T17:51:58Z",
          "money market x4739",
          "customer",
          "profile, online banking status",
          386,
          "",
          "chat CH-552873"
        ],
        [
          "2026-10-01T18:05:52Z",
          "credit card x1984",
          "customer",
          "profile, alerts settings",
          468,
          "",
          "call CL-48834267"
        ],
        [
          "2026-10-01T18:18:31Z",
          "credit card x5685",
          "customer",
          "profile, alerts settings",
          89,
          "online banking unlocked",
          "call CL-48834341"
        ],
        [
          "2026-10-01T18:38:33Z",
          "credit card x9170",
          "customer",
          "profile, login history",
          429,
          "",
          "chat CH-552884"
        ],
        [
          "2026-10-01T18:52:35Z",
          "checking x8316",
          "customer",
          "profile, online banking status",
          189,
          "online banking enrollment completed with customer",
          "call CL-48834546"
        ],
        [
          "2026-10-01T19:01:15Z",
          "checking x6163",
          "customer",
          "profile, login history",
          516,
          "",
          "call CL-48834929"
        ],
        [
          "2026-10-01T19:13:26Z",
          "checking x4829",
          "customer",
          "profile, contact details, authentication profile",
          210,
          "",
          "call CL-48835151"
        ],
        [
          "2026-10-01T19:15:04Z",
          "money market x5340",
          "customer",
          "profile, contact details, authentication profile",
          74,
          "",
          "call CL-48835151"
        ],
        [
          "2026-10-01T19:19:07Z",
          "credit card x4372",
          "customer",
          "profile, online banking status, devices, login history",
          318,
          "alert preferences updated",
          "call CL-48835435"
        ],
        [
          "2026-10-01T19:30:19Z",
          "checking x9661",
          "customer",
          "profile, contact details, authentication profile",
          263,
          "password reset link sent to email on file",
          "call CL-48835555"
        ],
        [
          "2026-10-01T19:37:03Z",
          "checking x7182",
          "customer",
          "profile, alerts settings",
          421,
          "",
          "chat CH-552892"
        ],
        [
          "2026-10-01T19:37:47Z",
          "money market x3484",
          "customer",
          "profile, online banking status, login history",
          154,
          "",
          "chat CH-552892"
        ],
        [
          "2026-10-01T19:47:20Z",
          "credit card x6716",
          "customer",
          "profile, online banking status",
          216,
          "",
          "call CL-48835779"
        ],
        [
          "2026-10-01T19:57:06Z",
          "checking x0950",
          "customer",
          "profile, online banking status",
          768,
          "",
          "call CL-48835999"
        ],
        [
          "2026-10-01T20:16:32Z",
          "checking x8081",
          "customer",
          "profile, devices, login history, contact details",
          480,
          "",
          "call CL-48836373"
        ],
        [
          "2026-10-02T12:06:07Z",
          "savings x4971",
          "customer",
          "profile, login history",
          570,
          "device removed",
          "call CL-48836445"
        ],
        [
          "2026-10-02T12:07:23Z",
          "checking x1560",
          "customer",
          "profile, devices",
          196,
          "",
          "call CL-48836445"
        ],
        [
          "2026-10-02T12:19:30Z",
          "savings x9758",
          "customer",
          "profile, devices",
          383,
          "",
          "call CL-48836674"
        ],
        [
          "2026-10-02T12:32:13Z",
          "checking x8193",
          "customer",
          "profile, alerts settings",
          401,
          "",
          "call CL-48836980"
        ],
        [
          "2026-10-02T12:47:50Z",
          "checking x7700",
          "customer",
          "profile, devices",
          416,
          "online banking enrollment completed with customer",
          "call CL-48837114"
        ],
        [
          "2026-10-02T12:48:50Z",
          "checking x1712",
          "customer",
          "profile, devices",
          165,
          "",
          "call CL-48837114"
        ],
        [
          "2026-10-02T13:03:44Z",
          "savings x0586",
          "customer",
          "profile, online banking status, login history",
          395,
          "",
          "chat CH-552915"
        ],
        [
          "2026-10-02T13:04:28Z",
          "checking x1887",
          "customer",
          "profile, online banking status, login history",
          163,
          "",
          "chat CH-552915"
        ],
        [
          "2026-10-02T13:14:55Z",
          "credit card x9113",
          "customer",
          "profile, contact details, authentication profile",
          135,
          "",
          "call CL-48837372"
        ],
        [
          "2026-10-02T13:22:53Z",
          "checking x1694",
          "customer",
          "profile, devices",
          571,
          "",
          "call CL-48837516"
        ],
        [
          "2026-10-02T13:44:43Z",
          "checking x9212",
          "customer",
          "profile, online banking status, login history",
          613,
          "",
          "call CL-48837721"
        ],
        [
          "2026-10-02T14:01:34Z",
          "money market x4612",
          "customer",
          "profile, contact details, authentication profile",
          274,
          "",
          "chat CH-552919"
        ],
        [
          "2026-10-02T14:21:18Z",
          "savings x9069",
          "customer",
          "profile, contact details, authentication profile",
          431,
          "online banking unlocked",
          "chat CH-552927"
        ],
        [
          "2026-10-02T14:32:30Z",
          "credit card x6580",
          "customer",
          "profile, online banking status, devices, login history",
          596,
          "",
          "call CL-48837831"
        ],
        [
          "2026-10-02T14:34:49Z",
          "money market x0826",
          "customer",
          "profile, online banking status, login history",
          229,
          "",
          "call CL-48837831"
        ],
        [
          "2026-10-02T14:53:30Z",
          "credit card x9555",
          "customer",
          "profile, alerts settings",
          778,
          "password reset link sent to email on file",
          "call CL-48838227"
        ],
        [
          "2026-10-02T15:12:27Z",
          "savings x4698",
          "customer",
          "profile, alerts settings",
          400,
          "",
          "chat CH-552959"
        ],
        [
          "2026-10-02T15:18:26Z",
          "money market x1186",
          "customer",
          "profile, balances, contact details",
          97,
          "",
          ""
        ],
        [
          "2026-10-02T15:27:13Z",
          "credit card x5953",
          "customer",
          "profile, devices, login history, contact details",
          337,
          "password reset link sent to email on file",
          "chat CH-552989"
        ],
        [
          "2026-10-02T15:38:51Z",
          "money market x5535",
          "customer",
          "profile, online banking status",
          388,
          "",
          "chat CH-553026"
        ],
        [
          "2026-10-02T15:50:26Z",
          "savings x6352",
          "customer",
          "profile, alerts settings",
          178,
          "",
          "chat CH-553063"
        ],
        [
          "2026-10-02T15:56:11Z",
          "checking x2081",
          "customer",
          "profile, online banking status, devices, login history",
          489,
          "phone change",
          "call CL-48838599"
        ],
        [
          "2026-10-02T16:33:14Z",
          "savings x0348",
          "customer",
          "profile, devices",
          576,
          "",
          "call CL-48838935"
        ],
        [
          "2026-10-02T16:55:50Z",
          "checking x2610",
          "customer",
          "profile, alerts settings",
          455,
          "password reset link sent to email on file",
          "call CL-48839188"
        ],
        [
          "2026-10-02T17:10:03Z",
          "savings x9306",
          "customer",
          "profile, online banking status",
          218,
          "",
          "chat CH-553076"
        ],
        [
          "2026-10-02T17:11:32Z",
          "money market x7413",
          "customer",
          "profile, online banking status, login history",
          66,
          "",
          "chat CH-553076"
        ],
        [
          "2026-10-02T17:16:06Z",
          "checking x5059",
          "customer",
          "profile, devices",
          327,
          "",
          "call CL-48839585"
        ],
        [
          "2026-10-02T17:29:03Z",
          "money market x4325",
          "customer",
          "profile, alerts settings",
          266,
          "",
          "chat CH-553104"
        ],
        [
          "2026-10-02T17:33:09Z",
          "premier checking x7310",
          "customer",
          "profile, contact details, authentication profile, balances",
          122,
          "",
          ""
        ],
        [
          "2026-10-02T17:43:41Z",
          "checking x0733",
          "customer",
          "profile, online banking status, login history",
          675,
          "phone change",
          "call CL-48839965"
        ],
        [
          "2026-10-02T18:04:09Z",
          "savings x4256",
          "customer",
          "profile, devices",
          521,
          "device removed",
          "call CL-48840244"
        ],
        [
          "2026-10-02T18:18:06Z",
          "checking x3715",
          "customer",
          "profile, alerts settings",
          384,
          "",
          "call CL-48840378"
        ],
        [
          "2026-10-02T18:38:33Z",
          "checking x7717",
          "customer",
          "profile, online banking status, devices, login history",
          405,
          "online banking unlocked",
          "call CL-48840756"
        ],
        [
          "2026-10-02T18:49:20Z",
          "savings x0040",
          "customer",
          "profile, devices, login history, contact details",
          291,
          "device removed",
          "call CL-48840931"
        ],
        [
          "2026-10-02T18:58:15Z",
          "checking x3199",
          "customer",
          "profile, login history",
          609,
          "",
          "call CL-48841163"
        ],
        [
          "2026-10-02T19:13:41Z",
          "checking x7327",
          "customer",
          "profile, alerts settings",
          378,
          "",
          "call CL-48841433"
        ],
        [
          "2026-10-02T19:14:58Z",
          "money market x0030",
          "customer",
          "profile, contact details, authentication profile",
          184,
          "",
          "call CL-48841433"
        ],
        [
          "2026-10-02T19:25:49Z",
          "credit card x2570",
          "customer",
          "profile, online banking status, login history",
          205,
          "",
          "call CL-48841831"
        ],
        [
          "2026-10-02T19:39:21Z",
          "money market x4469",
          "customer",
          "profile, devices, login history, contact details",
          489,
          "",
          "call CL-48842093"
        ],
        [
          "2026-10-02T19:53:56Z",
          "savings x4344",
          "customer",
          "profile, online banking status, login history",
          333,
          "email change",
          "call CL-48842454"
        ],
        [
          "2026-10-02T20:12:04Z",
          "checking x5104",
          "customer",
          "profile, login history",
          556,
          "password reset link sent to email on file",
          "call CL-48842714"
        ],
        [
          "2026-10-02T20:13:31Z",
          "credit card x6587",
          "customer",
          "profile, contact details, authentication profile",
          204,
          "",
          "call CL-48842714"
        ],
        [
          "2026-10-03T03:05:10Z",
          "checking x5120",
          "customer",
          "profile, contact details",
          431,
          "phone change",
          "ticket TK-605190"
        ],
        [
          "2026-10-03T03:15:44Z",
          "savings x0457",
          "customer",
          "profile, contact details, devices",
          362,
          "phone change; email change; trusted devices reset",
          "ticket TK-605193"
        ],
        [
          "2026-10-03T03:24:58Z",
          "money market x6631",
          "customer",
          "profile, contact details, authentication profile, balances",
          188,
          "",
          ""
        ],
        [
          "2026-10-03T03:28:41Z",
          "savings x9014",
          "customer",
          "profile, contact details, authentication profile, balances",
          133,
          "",
          ""
        ],
        [
          "2026-10-03T03:32:17Z",
          "checking x2287",
          "customer",
          "profile, contact details, balances, online banking status",
          127,
          "",
          ""
        ],
        [
          "2026-10-03T03:36:30Z",
          "savings x5508",
          "customer",
          "profile, contact details, authentication profile",
          109,
          "",
          ""
        ]
      ]
    },
    "contact_and_security_changes": {
      "columns": [
        "ts",
        "account",
        "change",
        "verification_recorded",
        "linked_to",
        "contact_behind_the_link"
      ],
      "rows": [
        [
          "2026-09-28T17:10:36Z",
          "credit card x6369",
          "trusted devices reset",
          "customer signed in to the mobile app chat",
          "chat CH-552237",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-28T18:58:16Z",
          "money market x1812",
          "trusted devices reset",
          "caller authenticated in IVR (card and PIN)",
          "call CL-48814565",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-29T13:25:55Z",
          "money market x2908",
          "device removed",
          "caller authenticated in IVR (card and PIN)",
          "call CL-48817064",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-29T13:42:08Z",
          "money market x9465",
          "device removed",
          "OTP to phone on file",
          "call CL-48817497",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-29T13:50:21Z",
          "money market x2066",
          "device removed",
          "caller authenticated in IVR (card and PIN)",
          "call CL-48817875",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-29T15:09:00Z",
          "money market x7596",
          "device removed",
          "OTP to phone on file",
          "call CL-48818818",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-29T15:41:53Z",
          "checking x8815",
          "phone change",
          "OTP to email on file",
          "call CL-48819518",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-29T16:35:17Z",
          "savings x2614",
          "device removed",
          "OTP to phone on file",
          "call CL-48820028",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-29T17:23:58Z",
          "money market x2466",
          "trusted devices reset",
          "OTP to phone on file",
          "call CL-48820767",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-30T12:18:55Z",
          "credit card x9869",
          "trusted devices reset",
          "caller authenticated in IVR (card and PIN)",
          "call CL-48823587",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-30T13:31:45Z",
          "credit card x0497",
          "device removed",
          "OTP to phone on file",
          "call CL-48824250",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-30T16:59:04Z",
          "credit card x7546",
          "device removed",
          "customer signed in to the mobile app chat",
          "chat CH-552591",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-30T17:10:05Z",
          "checking x0728",
          "email change",
          "OTP to phone on file",
          "chat CH-552622",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-09-30T19:19:15Z",
          "credit card x0106",
          "device removed",
          "caller authenticated in IVR (card and PIN)",
          "call CL-48828566",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-10-01T02:31:48Z",
          "premier checking x3318",
          "phone change: home landline (614) 555-0118 to mobile (727) 555-0143; carrier check on new number: non-fixed VoIP, in service since 2026-09-24",
          "Ticket says 'KBA passed, caller lost phone'",
          "ticket TK-604417",
          "none: E-71964 not logged in to the phone system; no call or chat about this customer that day"
        ],
        [
          "2026-10-01T02:33:20Z",
          "premier checking x3318",
          "email change: to a new address at a free webmail domain, created on the account for the first time (no email on file before)",
          "Ticket says 'KBA passed, caller lost phone'",
          "ticket TK-604417",
          "none, as above"
        ],
        [
          "2026-10-01T12:59:08Z",
          "savings x1597",
          "device removed",
          "OTP to phone on file",
          "call CL-48830215",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-10-01T17:18:28Z",
          "credit card x4866",
          "device removed",
          "customer signed in to the mobile app chat",
          "chat CH-552850",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-10-01T17:44:12Z",
          "checking x5997",
          "phone change",
          "OTP to email on file",
          "call CL-48833973",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-10-02T12:13:41Z",
          "savings x4971",
          "device removed",
          "OTP to phone on file",
          "call CL-48836445",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-10-02T15:57:53Z",
          "checking x2081",
          "phone change",
          "OTP to email on file",
          "call CL-48838599",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-10-02T17:48:37Z",
          "checking x0733",
          "phone change",
          "OTP to email on file",
          "call CL-48839965",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-10-02T18:05:07Z",
          "savings x4256",
          "device removed",
          "caller authenticated in IVR (card and PIN)",
          "call CL-48840244",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-10-02T18:51:26Z",
          "savings x0040",
          "device removed",
          "caller authenticated in IVR (card and PIN)",
          "call CL-48840931",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-10-02T19:57:36Z",
          "savings x4344",
          "email change",
          "OTP to phone on file",
          "call CL-48842454",
          "inbound contact handled by E-71964"
        ],
        [
          "2026-10-03T03:12:02Z",
          "checking x5120",
          "phone change: home landline (937) 555-0161 to mobile (727) 555-0179; carrier check: non-fixed VoIP, in service since 2026-09-29",
          "Ticket says 'KBA passed, customer lost phone'",
          "ticket TK-605190",
          "none: E-71964 not logged in to the phone system; no call or chat about this customer that day"
        ],
        [
          "2026-10-03T03:20:36Z",
          "savings x0457",
          "phone change: mobile (614) 555-0127 to mobile (727) 555-0143; carrier check: non-fixed VoIP",
          "Ticket says 'KBA passed, new phone'",
          "ticket TK-605193",
          "none, as above"
        ],
        [
          "2026-10-03T03:21:15Z",
          "savings x0457",
          "email change: to a new address at a free webmail domain",
          "Ticket says 'KBA passed, new phone'",
          "ticket TK-605193",
          "none, as above"
        ],
        [
          "2026-10-03T03:22:02Z",
          "savings x0457",
          "trusted devices reset (1 device removed, last used 2025-12-02)",
          "Ticket says 'KBA passed, new phone'",
          "ticket TK-605193",
          "none, as above"
        ]
      ]
    },
    "tickets_created_without_a_contact": [
      {
        "id": "TK-604417",
        "created": "2026-10-01T02:29:51Z",
        "account": "premier checking x3318",
        "category": "Contact details update",
        "text": "Cust called in, lost phone, cant receive code. Verified via KBA (4/4). Updated mobile and added email per cust request."
      },
      {
        "id": "TK-605190",
        "created": "2026-10-03T03:10:12Z",
        "account": "checking x5120",
        "category": "Contact details update",
        "text": "Customer lost phone. KBA passed. Updated phone per customer."
      },
      {
        "id": "TK-605193",
        "created": "2026-10-03T03:18:40Z",
        "account": "savings x0457",
        "category": "Contact details update",
        "text": "New phone, cust cant get code on old number. KBA passed. Updated phone, email, cleared old device."
      }
    ],
    "endpoint_events": {
      "columns": [
        "ts",
        "event",
        "detail"
      ],
      "rows": [
        [
          "2026-08-19T15:02:11Z",
          "clipboard copy from VDI to local device blocked",
          "window: Ticketing - TK-571220"
        ],
        [
          "2026-09-24T13:40:52Z",
          "clipboard copy from VDI to local device blocked",
          "window: CRM - Customer profile"
        ],
        [
          "2026-09-29T16:52:30Z",
          "clipboard copy from VDI to local device blocked",
          "window: CRM - Contact details"
        ],
        [
          "2026-10-01T02:13:05Z",
          "screen capture by a local tool blocked by VDI screen protection",
          "window: CRM - Authentication profile"
        ],
        [
          "2026-10-01T02:16:40Z",
          "clipboard copy from VDI to local device blocked",
          "window: CRM - Contact details"
        ],
        [
          "2026-10-01T02:20:02Z",
          "clipboard copy from VDI to local device blocked",
          "window: CRM - Contact details"
        ],
        [
          "2026-10-01T02:39:11Z",
          "clipboard copy from VDI to local device blocked",
          "window: CRM - Contact details"
        ],
        [
          "2026-10-03T03:25:47Z",
          "screen capture by a local tool blocked by VDI screen protection",
          "window: CRM - Balances"
        ],
        [
          "2026-10-03T03:29:20Z",
          "clipboard copy from VDI to local device blocked",
          "window: CRM - Contact details"
        ],
        [
          "2026-10-03T03:33:01Z",
          "clipboard copy from VDI to local device blocked",
          "window: CRM - Contact details"
        ]
      ]
    },
    "endpoint_summary": "No prints, file downloads, USB use or external email from the VDI in the window. The VDI blocks clipboard transfer and local screen capture; it can't detect a phone camera.",
    "accounts_in_the_alert": {
      "columns": [
        "account",
        "holder",
        "balance_usd",
        "customer_since",
        "online_banking",
        "phone_on_file",
        "notes"
      ],
      "rows": [
        [
          "premier checking x3318",
          "customer",
          287410.55,
          "1994-03",
          "not enrolled",
          "home landline (before the window)",
          "Last contact with us: branch visit 2026-08-14 (B-0107); phone and email changed 2026-10-01; fraud claim FC-2026-118240 opened 2026-10-03"
        ],
        [
          "money market x1186",
          "customer",
          412006.12,
          "2001-11",
          "not enrolled",
          "home landline (before the window)",
          "Last contact with us: phone call 2026-05-02"
        ],
        [
          "savings x7742",
          "customer",
          96220,
          "2008-06",
          "enrolled, last login 2025-10-19",
          "home landline (before the window)",
          "Last contact with us: branch visit 2026-07-30"
        ],
        [
          "checking x2659",
          "customer",
          58913.4,
          "1999-01",
          "not enrolled",
          "home landline (before the window)",
          "Last contact with us: branch visit 2026-09-03"
        ],
        [
          "checking x5120",
          "customer",
          236775.09,
          "1988-09",
          "not enrolled",
          "home landline (before the window)",
          "Last contact with us: branch visit 2026-08-27; phone changed 2026-10-03; fraud claim FC-2026-118231 opened 2026-10-03"
        ],
        [
          "savings x0457",
          "customer",
          71304.18,
          "2012-02",
          "enrolled, last login 2025-12-02",
          "mobile (before the window)",
          "Last contact with us: phone call 2026-01-15; phone and email changed 2026-10-03; fraud claim FC-2026-118302 opened 2026-10-04"
        ],
        [
          "savings x8203",
          "customer",
          133650,
          "2004-07",
          "not enrolled",
          "home landline (before the window)",
          "Last contact with us: branch visit 2026-06-11"
        ],
        [
          "money market x6631",
          "customer",
          318442.7,
          "1997-05",
          "not enrolled",
          "home landline (before the window)",
          "Last contact with us: branch visit 2026-09-18"
        ],
        [
          "savings x9014",
          "customer",
          87115.33,
          "2010-10",
          "enrolled, last login 2026-02-07",
          "home landline (before the window)",
          "Last contact with us: phone call 2026-03-26"
        ],
        [
          "checking x2287",
          "customer",
          149880,
          "1991-12",
          "not enrolled",
          "home landline (before the window)",
          "Last contact with us: branch visit 2026-08-05"
        ],
        [
          "savings x5508",
          "customer",
          61027.95,
          "2006-04",
          "not enrolled",
          "mobile (before the window)",
          "Last contact with us: branch visit 2026-09-10"
        ],
        [
          "premier checking x7310",
          "customer",
          265118.02,
          "1985-08",
          "not enrolled",
          "home landline (before the window)",
          "Last contact with us: branch visit 2026-09-22"
        ]
      ]
    },
    "unlinked_lookups_with_other_records": {
      "columns": [
        "lookup_ts",
        "account",
        "holder",
        "employee_phone_state",
        "other_records"
      ],
      "rows": [
        [
          "2026-09-29T16:51:12Z",
          "premier checking x3318",
          "customer",
          "after-call work following chat CH-552387 with another customer",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-09-30T14:07:40Z",
          "checking x5120",
          "customer",
          "available, no call",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-09-30T18:40:05Z",
          "money market x6631",
          "customer",
          "after-call work following call CL-48827907 with another customer",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-01T02:15:58Z",
          "money market x1186",
          "customer",
          "not logged in to the phone system",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-01T02:19:20Z",
          "savings x7742",
          "customer",
          "not logged in to the phone system",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-01T02:22:47Z",
          "checking x2659",
          "customer",
          "not logged in to the phone system",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-01T02:38:14Z",
          "checking x5120",
          "customer",
          "not logged in to the phone system",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-01T02:43:36Z",
          "savings x0457",
          "customer",
          "not logged in to the phone system",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-01T02:47:22Z",
          "savings x8203",
          "customer",
          "not logged in to the phone system",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-01T13:22:51Z",
          "savings x0457",
          "customer",
          "available, no call",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-02T15:18:26Z",
          "money market x1186",
          "customer",
          "after-call work following chat CH-552959 with another customer",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-02T17:33:09Z",
          "premier checking x7310",
          "customer",
          "available, no call",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-03T03:24:58Z",
          "money market x6631",
          "customer",
          "not logged in to the phone system",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-03T03:28:41Z",
          "savings x9014",
          "customer",
          "not logged in to the phone system",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-03T03:32:17Z",
          "checking x2287",
          "customer",
          "not logged in to the phone system",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ],
        [
          "2026-10-03T03:36:30Z",
          "savings x5508",
          "customer",
          "not logged in to the phone system",
          "No call, chat or ticket about this customer with any agent within 24 hours; no IVR call from the phone on file"
        ]
      ]
    },
    "activity_after_access": {
      "columns": [
        "ts",
        "account",
        "event"
      ],
      "rows": [
        [
          "2026-10-01T02:32:05Z",
          "premier checking x3318",
          "Phone-change notice by text to the previous number failed (landline); notice letter mailed to the address on file 2026-10-01"
        ],
        [
          "2026-10-01T15:12:44Z",
          "premier checking x3318",
          "First online banking enrollment on this account, from a new Android device, IP 203.0.113.140 (hosting provider ASN); one-time code sent to (727) 555-0143 and entered"
        ],
        [
          "2026-10-01T15:31:09Z",
          "premier checking x3318",
          "External account added for transfers by instant verification; owner name on the external account does not match the customer"
        ],
        [
          "2026-10-02T14:05:37Z",
          "premier checking x3318",
          "Online wire request $48,500.00 to Kestrelmoor Supply LLC, a new beneficiary; wire-room callback to the phone on file, (727) 555-0143, confirmed; released 16:40:12Z"
        ],
        [
          "2026-10-03T03:12:40Z",
          "checking x5120",
          "Phone-change notice by text to the previous number failed (landline); notice letter mailed 2026-10-03"
        ],
        [
          "2026-10-03T14:02:51Z",
          "checking x5120",
          "First online banking enrollment, new Android device, IP 203.0.113.140; one-time code sent to (727) 555-0179 and entered"
        ],
        [
          "2026-10-03T14:20:16Z",
          "checking x5120",
          "P2P payment $2,500.00 to a new recipient sent; second P2P payment $2,500.00 to another new recipient blocked by the takeover model at 14:23:40Z; account restricted 14:25:02Z"
        ],
        [
          "2026-10-03T16:48:30Z",
          "checking x5120",
          "Fraud operations reached the customer on the previous home number from the change history: customer made no changes, has no online banking and did not send the payment; fraud claim FC-2026-118231 opened"
        ],
        [
          "2026-10-03T19:22:15Z",
          "premier checking x3318",
          "Fraud operations, reviewing other phone changes made by E-71964 after the x5120 takeover, reached the customer on the previous home number: did not change phone or email, did not enroll in online banking, did not send a wire. Fraud claim FC-2026-118240 opened; wire recall requested from the beneficiary bank"
        ],
        [
          "2026-10-04T13:10:58Z",
          "savings x0457",
          "Online banking password reset by one-time code to (727) 555-0143, then login from a new Android device, IP 203.0.113.140"
        ],
        [
          "2026-10-04T13:18:44Z",
          "savings x0457",
          "External account added for transfers; takeover model alert; account locked by fraud operations 13:25:30Z; customer not yet reached; fraud claim FC-2026-118302 opened"
        ],
        [
          "2026-10-05T10:00:00Z",
          "the other 9 accounts in this alert",
          "No contact-detail change, password reset, new device, new payee or fraud claim since the lookups"
        ]
      ]
    }
  },
  "questions": {
    "access_without_business_reason": {
      "type": "noul",
      "instructions": "Did the employee open or change any customer account in this alert without a business reason, meaning that no customer contact, ticket, assigned case or other work item explains it?"
    },
    "enabling_fraud_likelihood": {
      "type": "score",
      "instructions": "How likely is it that the employee is helping people outside the institution commit fraud against customer accounts, for example by passing on account details or changing accounts so that others can take them over?",
      "criteria": [
        "Very unlikely (under 10%)",
        "Unlikely (10-40%)",
        "Uncertain (40-60%)",
        "Likely (60-90%)",
        "Very likely (over 90%)"
      ]
    },
    "explanation": {
      "type": "choice",
      "instructions": "What is the most likely explanation for the employee's activity flagged in this alert?",
      "criteria": {
        "legitimate_work": "Legitimate work: customer contacts, tickets, assigned cases, training or supervisory review explain the activity",
        "snooping": "Curiosity or snooping: the employee viewed accounts with no business reason, without changing them or using what they saw for gain",
        "self_dealing": "Self-dealing: the employee used their access to benefit themselves or someone linked to them, for example by reversing fees or raising limits on their own or a household member's account",
        "enabling_fraud": "Enabling outside fraud: the employee looked up or changed accounts so that people outside the institution could take them over or take money from them",
        "policy_mistake": "Policy mistake: the employee was handling a real customer's real request but skipped a required step, such as logging the contact or verifying identity"
      }
    },
    "action": {
      "type": "choice",
      "instructions": "What should happen with this alert now?",
      "criteria": {
        "no_action": "Close the alert as legitimate activity, with no action against the employee",
        "refer": "Refer the employee to the insider risk team for investigation, leaving their system access in place for now",
        "suspend": "Suspend the employee's system access now and escalate to the insider risk team and HR"
      }
    }
  }
}