{ "model": "grayson-1", "state": { "alert": { "id": "IR-ALR-21088", "source": "Employee access monitoring over CRM, core banking and card management access logs", "created": "2026-10-05T11:00:00Z", "window_start": "2026-09-28T00:00:00Z", "window_end": "2026-10-04T23:59:59Z", "priority": "P2", "rules_fired": [ "IR-04: 3 or more account lookups in 7 days with no call, chat, ticket or case linked within 30 minutes (60 in this window)", "IR-07: Session outside the scheduled shift (1 session, Saturday 2026-10-03)", "IR-09: Lookup of an account held by an employee (1 lookup of 1 account)", "IR-12: Lookup of an account with a balance over $250,000 that is outside the employee's queue (1 account)", "IR-19: Screen capture on a workstation with customer data open (1)" ] }, "employee": { "employee_id": "E-52310", "employment_type": "Employee", "role": "Contact center agent, consumer card services", "start_date": "2021-08-02", "queue": "Inbound card services calls and chats: card declines, lost and stolen cards, replacements, card disputes", "work_location": "Columbus contact center, site CC2", "scheduled_shift": "Monday to Friday, 13:00 to 21:30 UTC (09:00 to 17:30 Eastern)", "schedule_exceptions": "Overtime Saturday 2026-10-03, 13:00 to 15:00 UTC, for the reissue campaign; approved in workforce management by supervisor E-20447 on 2026-10-01", "entitlements": "View customer profiles, balances and transaction history; block, unblock and replace debit cards; open card disputes; change phone, email and mailing address after identity verification; reverse card fees up to $50", "identity_verification_policy": "Before any change, verify the caller with a one-time code to the phone on file or IVR card-and-PIN authentication. On outbound calls, send a one-time code to the phone on file before discussing the account.", "privacy_training": "Completed 2026-03-10. It states that employees must not open their own account, or a coworker's, relative's or household member's account, unless it comes to them through their queue or an assigned work item.", "employment_status": "Active", "conflict_of_interest_disclosures": "None on file", "quality_scores": "Call quality reviews in 2026: 11 reviews, all passed", "prior_alerts": [ { "id": "IR-ALR-14420", "created": "2025-11-03", "rule": "IR-04", "outcome": "Closed as legitimate: callback tickets logged after the 30-minute window" } ] }, "weekly_history": { "columns": [ "week_start", "lookups", "linked", "unlinked", "account_changes", "phone_or_email_changes", "sessions_outside_shift", "dlp_events" ], "rows": [ [ "2026-08-03", 251, 249, 2, 66, 3, 0, 0 ], [ "2026-08-10", 243, 242, 1, 61, 2, 0, 0 ], [ "2026-08-17", 262, 258, 4, 70, 4, 1, 0 ], [ "2026-08-24", 249, 247, 2, 63, 1, 0, 1 ], [ "2026-08-31", 201, 198, 3, 52, 2, 0, 0 ], [ "2026-09-07", 236, 235, 1, 59, 3, 0, 0 ], [ "2026-09-14", 268, 265, 3, 73, 5, 0, 0 ], [ "2026-09-21", 257, 255, 2, 68, 2, 0, 0 ] ] }, "peer_baseline": "Card services agents not on the campaign (118 agents), per agent per week over the last 8 weeks: lookups median 247 (95th percentile 298); unlinked lookups median 3 (95th percentile 9). The 6 agents assigned to the reissue campaign this week had 43, 51, 60, 64, 69, 73 unlinked lookups (E-52310 is the one with 60).", "monitoring_notes": "The link check reads inbound calls, chats, tickets and cases. It does not read outbound dialer calls (known gap, change request CR-6619), and it links a chat to the queue where the chat started, so chats transferred in from another queue are not linked to the receiving agent. No outages in this window.", "assigned_work": { "id": "WFM-OUT-2026-0917", "assigned": "2026-09-28T19:02:00Z by supervisor E-20447", "campaign": "Debit card reissue activation outreach after compromised-merchant notice CPP-2026-044. 1,240 debit cards were reissued on 2026-09-19; agents call customers whose replacement card is not yet activated, verify them by one-time code to the phone on file, and help them activate it.", "schedule": "2026-09-29 to 2026-10-02, 19:00 to 20:00 UTC each day, and the Saturday 2026-10-03 overtime shift, 13:00 to 15:00 UTC", "accounts_assigned_to_E-52310": [ "checking x0012", "savings x0499", "checking x0645", "savings x0696", "checking x0726", "savings x0752", "savings x0892", "checking x1012", "checking x1165", "savings x1503", "checking x1798", "savings x2025", "checking x2234", "savings x2402", "checking x2459", "checking x2555", "checking x2557", "checking x2774", "checking x2851", "checking x2890", "checking x2948", "checking x3036", "savings x3051", "checking x3055", "checking x3164", "checking x3230", "checking x3243", "savings x3295", "savings x3300", "savings x3319", "checking x3466", "savings x3467", "checking x3488", "savings x3612", "savings x3664", "savings x3752", "checking x3761", "checking x3816", "savings x3823", "checking x3835", "savings x4035", "checking x4047", "checking x4077", "checking x4209", "savings x4639", "savings x4646", "checking x4733", "savings x4794", "savings x4937", "checking x4969", "savings x5027", "savings x5040", "savings x5276", "checking x5278", "checking x5327", "checking x5530", "savings x5612", "checking x5682", "checking x5693", "checking x5780", "checking x5798", "savings x5869", "checking x5919", "checking x5975", "checking x6031", "savings x6139", "savings x6277", "checking x6279", "savings x6313", "checking x6449", "checking x6707", "checking x6782", "checking x6862", "savings x7049", "checking x7087", "checking x7460", "savings x7773", "premier checking x7781", "checking x7945", "checking x8051", "checking x8527", "checking x8572", "checking x8648", "checking x8808", "savings x8886", "savings x9039", "savings x9043", "checking x9050", "checking x9127", "checking x9151", "checking x9268", "checking x9414", "checking x9436", "checking x9668", "checking x9805", "checking x9928" ] }, "sessions": { "columns": [ "login", "logout", "client", "source_network", "phone_system" ], "rows": [ [ "2026-09-28T12:53:44Z", "2026-09-28T21:32:44Z", "WS-CC2-0233 (assigned desk)", "Columbus contact center LAN", "logged in for the shift" ], [ "2026-09-29T12:53:14Z", "2026-09-29T21:40:26Z", "WS-CC2-0233 (assigned desk)", "Columbus contact center LAN", "logged in for the shift" ], [ "2026-09-30T12:52:01Z", "2026-09-30T21:37:31Z", "WS-CC2-0233 (assigned desk)", "Columbus contact center LAN", "logged in for the shift" ], [ "2026-10-01T12:50:32Z", "2026-10-01T21:39:20Z", "WS-CC2-0233 (assigned desk)", "Columbus contact center LAN", "logged in for the shift" ], [ "2026-10-02T12:48:00Z", "2026-10-02T21:32:36Z", "WS-CC2-0233 (assigned desk)", "Columbus contact center LAN", "logged in for the shift" ], [ "2026-10-03T12:51:33Z", "2026-10-03T15:03:52Z", "WS-CC2-0233 (assigned desk)", "Columbus contact center LAN", "logged in, outbound campaign only" ] ] }, "access_log": { "columns": [ "ts", "account", "holder", "viewed", "seconds", "change", "linked_to" ], "rows": [ [ "2026-09-28T13:07:12Z", "credit card x2399", "customer", "profile, card status, card transactions", 362, "travel note added", "call CL-47220118" ], [ "2026-09-28T13:16:55Z", "credit card x5675", "customer", "profile, card status, travel notes", 335, "", "chat CH-548771" ], [ "2026-09-28T13:25:59Z", "credit card x8412", "customer", "profile, card status, replacement shipping", 708, "card limit restored after fraud block", "call CL-47220490" ], [ "2026-09-28T13:26:38Z", "checking x6789", "customer", "profile, card status, card transactions", 288, "", "call CL-47220490" ], [ "2026-09-28T13:42:24Z", "savings x9827", "customer", "profile, card status, replacement shipping", 207, "", "call CL-47220750" ], [ "2026-09-28T13:43:46Z", "checking x9645", "customer", "profile, card status, card transactions", 81, "", "call CL-47220750" ], [ "2026-09-28T13:58:45Z", "checking x5406", "customer", "profile, card status, card transactions", 211, "", "call CL-47221143" ], [ "2026-09-28T14:06:42Z", "checking x2886", "customer", "profile, card status, travel notes", 403, "", "chat CH-548778" ], [ "2026-09-28T14:26:43Z", "savings x0734", "customer", "profile, card status, card transactions", 573, "card unblocked", "call CL-47221515" ], [ "2026-09-28T14:44:02Z", "checking x0490", "customer", "profile, card status, travel notes", 516, "", "call CL-47221807" ], [ "2026-09-28T14:59:05Z", "checking x9513", "customer", "profile, card status, card transactions", 342, "card blocked and replaced", "call CL-47221960" ], [ "2026-09-28T15:17:31Z", "credit card x0842", "customer", "profile, card status, card transactions", 339, "fee reversal $5.00", "chat CH-548782" ], [ "2026-09-28T15:28:22Z", "checking x7675", "customer", "profile, card status, replacement shipping", 476, "", "chat CH-548799" ], [ "2026-09-28T15:43:46Z", "checking x9991", "customer", "profile, card status, replacement shipping", 328, "fee reversal $35.00", "chat CH-548821" ], [ "2026-09-28T15:52:29Z", "checking x8141", "customer", "profile, card status, travel notes", 303, "", "chat CH-548842" ], [ "2026-09-28T16:03:43Z", "checking x2008", "customer", "profile, card transactions, disputes", 571, "", "chat CH-548877" ], [ "2026-09-28T16:20:49Z", "credit card x9637", "customer", "profile, card status, travel notes", 519, "", "chat CH-548893" ], [ "2026-09-28T16:34:08Z", "checking x4726", "customer", "profile, card status", 160, "", "call CL-47222185" ], [ "2026-09-28T16:42:52Z", "checking x6543", "customer", "profile, card status, travel notes", 452, "card blocked and replaced", "call CL-47222455" ], [ "2026-09-28T16:43:55Z", "credit card x7124", "customer", "profile, card status", 183, "", "call CL-47222455" ], [ "2026-09-28T16:54:38Z", "checking x1856", "customer", "profile, card transactions, disputes", 515, "fee reversal $35.00", "call CL-47222719" ], [ "2026-09-28T17:34:00Z", "credit card x1640", "customer", "profile, card status, travel notes", 445, "", "call CL-47222884" ], [ "2026-09-28T17:52:25Z", "checking x6785", "customer", "profile, card transactions, history", 236, "card limit restored after fraud block", "call CL-47223138" ], [ "2026-09-28T18:01:44Z", "credit card x4465", "customer", "profile, balances, card transactions", 353, "", "chat CH-548909" ], [ "2026-09-28T18:12:07Z", "checking x9533", "customer", "profile, card transactions, disputes", 526, "", "call CL-47223420" ], [ "2026-09-28T18:28:56Z", "checking x2717", "customer", "profile, card status, replacement shipping", 407, "fee reversal $10.00", "call CL-47223763" ], [ "2026-09-28T18:41:53Z", "checking x6420", "customer", "profile, card status, replacement shipping", 326, "", "call CL-47223960" ], [ "2026-09-28T18:51:22Z", "checking x3827", "customer", "profile, card transactions, disputes", 317, "card unblocked", "call CL-47224349" ], [ "2026-09-28T19:02:17Z", "savings x6717", "customer", "profile, card transactions, disputes", 677, "", "call CL-47224669" ], [ "2026-09-28T19:19:57Z", "checking x7739", "customer", "profile, card status", 363, "card unblocked", "call CL-47224813" ], [ "2026-09-28T19:38:20Z", "savings x2076", "customer", "profile, card status, card transactions", 491, "travel note added", "call CL-47225110" ], [ "2026-09-28T19:39:23Z", "checking x4690", "customer", "profile, card status, card transactions", 202, "", "call CL-47225110" ], [ "2026-09-28T19:50:23Z", "checking x0620", "customer", "profile, card status, card transactions", 356, "", "call CL-47225443" ], [ "2026-09-28T20:02:19Z", "checking x0078", "customer", "profile, card status", 348, "card unblocked", "call CL-47225563" ], [ "2026-09-28T20:13:33Z", "savings x1030", "customer", "profile, card status, travel notes", 382, "card unblocked", "call CL-47225897" ], [ "2026-09-28T20:23:59Z", "checking x2469", "customer", "profile, card transactions, history", 583, "", "call CL-47226000" ], [ "2026-09-28T20:40:31Z", "checking x3233", "customer", "profile, card transactions, history", 260, "", "call CL-47226306" ], [ "2026-09-28T20:48:27Z", "checking x3104", "customer", "profile, card transactions, history", 306, "", "call CL-47226367" ], [ "2026-09-28T20:50:51Z", "checking x1276", "customer", "profile, card status", 132, "", "call CL-47226367" ], [ "2026-09-28T20:59:27Z", "credit card x2987", "customer", "profile, card transactions, history", 407, "card unblocked", "call CL-47226688" ], [ "2026-09-28T21:12:57Z", "checking x6225", "customer", "profile, card status, replacement shipping", 270, "card blocked and replaced", "call CL-47226868" ], [ "2026-09-28T21:22:19Z", "checking x7409", "customer", "profile, card status", 361, "card unblocked", "chat CH-548937" ], [ "2026-09-29T13:06:23Z", "checking x0073", "customer", "profile, card status", 189, "", "call CL-47227035" ], [ "2026-09-29T13:12:11Z", "checking x5359", "customer", "profile, card status", 206, "", "call CL-47227091" ], [ "2026-09-29T13:22:33Z", "checking x7025", "customer", "profile, card status, card transactions", 390, "fee reversal $5.00", "call CL-47227141" ], [ "2026-09-29T13:35:39Z", "credit card x7822", "customer", "profile, balances, card transactions", 272, "", "call CL-47227294" ], [ "2026-09-29T13:36:35Z", "savings x6923", "customer", "profile, card status", 110, "", "call CL-47227294" ], [ "2026-09-29T13:45:16Z", "checking x8352", "customer", "profile, card transactions, history", 346, "", "call CL-47227586" ], [ "2026-09-29T13:47:30Z", "savings x1732", "customer", "profile, card transactions, disputes", 151, "", "call CL-47227586" ], [ "2026-09-29T13:55:30Z", "checking x8360", "customer", "profile, card transactions, disputes", 313, "card blocked and replaced", "call CL-47227978" ], [ "2026-09-29T14:05:32Z", "checking x7322", "customer", "profile, card status", 245, "", "chat CH-548948" ], [ "2026-09-29T14:06:26Z", "checking x1084", "customer", "profile, card transactions, disputes", 122, "", "chat CH-548948" ], [ "2026-09-29T14:14:32Z", "credit card x6294", "customer", "profile, card status, replacement shipping", 390, "card unblocked", "call CL-47228373" ], [ "2026-09-29T14:27:05Z", "credit card x0154", "customer", "profile, card status, travel notes", 552, "PIN mailer requested", "call CL-47228692" ], [ "2026-09-29T14:40:33Z", "checking x1350", "customer", "profile, card status, card transactions", 566, "", "call CL-47228965" ], [ "2026-09-29T15:19:23Z", "savings x5763", "customer", "profile, card status, travel notes", 216, "", "call CL-47229306" ], [ "2026-09-29T15:26:47Z", "savings x6234", "customer", "profile, card transactions, disputes", 309, "", "call CL-47229468" ], [ "2026-09-29T15:27:53Z", "checking x9753", "customer", "profile, card status", 131, "", "call CL-47229468" ], [ "2026-09-29T15:35:22Z", "checking x6855", "customer", "profile, balances, card transactions", 302, "", "call CL-47229853" ], [ "2026-09-29T15:45:38Z", "checking x7082", "customer", "profile, card transactions, disputes", 303, "dispute opened", "call CL-47230113" ], [ "2026-09-29T15:56:42Z", "checking x7263", "customer", "profile, card transactions, history", 407, "", "call CL-47230366" ], [ "2026-09-29T16:10:20Z", "checking x0378", "customer", "profile, card transactions, history", 360, "", "call CL-47230502" ], [ "2026-09-29T16:12:09Z", "checking x3288", "customer", "profile, card status, card transactions", 179, "", "call CL-47230502" ], [ "2026-09-29T16:25:59Z", "checking x0431", "customer", "profile, card status, card transactions", 355, "", "call CL-47230631" ], [ "2026-09-29T16:37:26Z", "savings x6645", "customer", "profile, card status, card transactions", 393, "", "call CL-47230837" ], [ "2026-09-29T16:49:18Z", "checking x0675", "customer", "profile, card status, card transactions", 446, "fee reversal $35.00", "chat CH-548953" ], [ "2026-09-29T17:31:49Z", "checking x3352", "customer", "profile, balances, card transactions", 344, "", "chat CH-548976" ], [ "2026-09-29T17:43:50Z", "checking x6978", "customer", "profile, balances, card transactions", 364, "fee reversal $25.00", "chat CH-548998" ], [ "2026-09-29T17:53:20Z", "credit card x4005", "customer", "profile, card status, travel notes", 287, "card unblocked", "chat CH-549019" ], [ "2026-09-29T18:03:44Z", "credit card x6298", "customer", "profile, card transactions, disputes", 285, "", "chat CH-549030" ], [ "2026-09-29T18:17:45Z", "checking x6770", "customer", "profile, card status, replacement shipping", 361, "", "call CL-47230989" ], [ "2026-09-29T18:30:03Z", "savings x8077", "customer", "profile, balances, card transactions", 408, "", "chat CH-549034" ], [ "2026-09-29T18:43:56Z", "checking x2515", "customer", "profile, card status", 220, "", "chat CH-549057" ], [ "2026-09-29T18:53:58Z", "checking x5882", "customer", "profile, balances, card transactions", 329, "dispute opened", "call CL-47231131" ], [ "2026-09-29T18:55:36Z", "checking x5971", "customer", "profile, card status", 122, "", "call CL-47231131" ], [ "2026-09-29T19:02:26Z", "savings x4646", "customer", "profile, card status, replacement shipping, contact details", 394, "", "" ], [ "2026-09-29T19:10:54Z", "checking x2459", "customer", "profile, card status, replacement shipping, contact details", 383, "", "" ], [ "2026-09-29T19:18:19Z", "checking x1012", "customer", "profile, card status, replacement shipping", 110, "", "" ], [ "2026-09-29T19:22:31Z", "checking x3055", "customer", "profile, card status, replacement shipping, contact details", 483, "", "" ], [ "2026-09-29T19:32:10Z", "checking x6782", "customer", "profile, card status, replacement shipping, contact details", 317, "", "" ], [ "2026-09-29T19:38:56Z", "checking x2890", "customer", "profile, card status, replacement shipping, contact details", 515, "", "" ], [ "2026-09-29T19:48:34Z", "savings x4639", "customer", "profile, card status, replacement shipping, contact details", 425, "", "" ], [ "2026-09-29T20:13:31Z", "savings x0102", "customer", "profile, balances, card transactions", 388, "", "chat CH-549066" ], [ "2026-09-29T20:29:22Z", "checking x3904", "customer", "profile, card status, travel notes", 261, "", "chat CH-549071" ], [ "2026-09-29T20:37:59Z", "credit card x5574", "customer", "profile, card status", 96, "", "call CL-47231474" ], [ "2026-09-29T20:49:34Z", "checking x2915", "customer", "profile, card status", 333, "card limit restored after fraud block", "call CL-47231531" ], [ "2026-09-29T20:59:01Z", "checking x3445", "customer", "profile, card transactions, disputes", 441, "card unblocked", "call CL-47231729" ], [ "2026-09-29T21:01:23Z", "savings x3831", "customer", "profile, card status", 175, "", "call CL-47231729" ], [ "2026-09-29T21:20:41Z", "savings x1029", "customer", "profile, card status, replacement shipping", 329, "", "call CL-47232095" ], [ "2026-09-30T13:04:07Z", "checking x0421", "customer", "profile, card status, card transactions", 438, "", "call CL-47232381" ], [ "2026-09-30T13:16:11Z", "checking x0491", "customer", "profile, card status, replacement shipping", 597, "", "call CL-47232563" ], [ "2026-09-30T13:17:37Z", "checking x3103", "customer", "profile, card transactions, disputes", 199, "", "call CL-47232563" ], [ "2026-09-30T13:30:39Z", "checking x7037", "customer", "profile, card status, travel notes", 464, "", "chat CH-549091" ], [ "2026-09-30T13:44:04Z", "credit card x8280", "customer", "profile, card status, travel notes", 515, "", "call CL-47232903" ], [ "2026-09-30T13:59:25Z", "checking x4023", "customer", "profile, card status, card transactions", 480, "PIN mailer requested", "call CL-47232963" ], [ "2026-09-30T14:00:05Z", "checking x5720", "customer", "profile, card status", 208, "", "call CL-47232963" ], [ "2026-09-30T14:11:54Z", "checking x1394", "customer", "profile, card transactions, history", 488, "card blocked and replaced", "chat CH-549118" ], [ "2026-09-30T14:26:36Z", "checking x3822", "customer", "profile, card status, travel notes", 641, "", "call CL-47233140" ], [ "2026-09-30T14:43:23Z", "checking x7478", "customer", "profile, card status", 221, "", "chat CH-549154" ], [ "2026-09-30T14:49:15Z", "credit card x2033", "customer", "profile, card transactions, history", 209, "", "chat CH-549194" ], [ "2026-09-30T14:56:53Z", "checking x9275", "customer", "profile, card status, card transactions", 434, "", "call CL-47233300" ], [ "2026-09-30T15:17:05Z", "checking x7074", "customer", "profile, card status, card transactions", 244, "card blocked and replaced", "call CL-47233388" ], [ "2026-09-30T15:26:51Z", "checking x9921", "customer", "profile, card status, card transactions", 263, "", "call CL-47233606" ], [ "2026-09-30T15:37:47Z", "checking x1016", "customer", "profile, card transactions, disputes", 247, "", "call CL-47233703" ], [ "2026-09-30T15:39:41Z", "credit card x2507", "customer", "profile, card status", 98, "", "call CL-47233703" ], [ "2026-09-30T15:48:32Z", "checking x3117", "customer", "profile, card transactions, disputes", 481, "card blocked and replaced", "call CL-47233810" ], [ "2026-09-30T16:03:14Z", "credit card x9756", "customer", "profile, card status", 382, "card blocked and replaced", "call CL-47234132" ], [ "2026-09-30T16:15:39Z", "credit card x8811", "customer", "profile, balances, card transactions", 347, "", "call CL-47234441" ], [ "2026-09-30T16:24:44Z", "checking x2060", "customer", "profile, card status, travel notes", 176, "", "call CL-47234512" ], [ "2026-09-30T16:31:24Z", "credit card x1769", "customer", "profile, card status, card transactions", 554, "", "call CL-47234679" ], [ "2026-09-30T16:51:31Z", "checking x2331", "customer", "profile, card transactions, history", 438, "", "call CL-47234796" ], [ "2026-09-30T17:32:57Z", "checking x4678", "customer", "profile, card status, card transactions", 257, "fee reversal $10.00", "call CL-47235055" ], [ "2026-09-30T17:41:09Z", "checking x1629", "customer", "profile, card transactions, history", 400, "", "call CL-47235207" ], [ "2026-09-30T17:51:51Z", "checking x6780", "customer", "profile, card transactions, disputes", 318, "", "call CL-47235360" ], [ "2026-09-30T18:05:24Z", "savings x7844", "customer", "profile, card transactions, history", 363, "", "call CL-47235461" ], [ "2026-09-30T18:21:44Z", "checking x6604", "customer", "profile, card status, card transactions", 488, "card unblocked", "" ], [ "2026-09-30T18:22:10Z", "checking x8148", "customer", "profile, card status, card transactions", 560, "", "call CL-47235696" ], [ "2026-09-30T18:35:31Z", "checking x4168", "customer", "profile, balances, card transactions", 255, "", "call CL-47235913" ], [ "2026-09-30T18:48:00Z", "checking x1667", "customer", "profile, card status, replacement shipping", 618, "card unblocked", "chat CH-549208" ], [ "2026-09-30T19:03:12Z", "checking x2948", "customer", "profile, card status, replacement shipping", 136, "", "" ], [ "2026-09-30T19:06:42Z", "checking x4733", "customer", "profile, card status, replacement shipping", 113, "", "" ], [ "2026-09-30T19:10:14Z", "checking x5975", "customer", "profile, card status, replacement shipping", 137, "", "" ], [ "2026-09-30T19:13:57Z", "checking x2851", "customer", "profile, card status, replacement shipping, contact details", 376, "", "" ], [ "2026-09-30T19:22:30Z", "checking x7087", "customer", "profile, card status, replacement shipping", 175, "", "" ], [ "2026-09-30T19:27:32Z", "checking x0726", "customer", "profile, card status, replacement shipping", 136, "", "" ], [ "2026-09-30T19:31:49Z", "savings x6313", "customer", "profile, card status, replacement shipping", 168, "", "" ], [ "2026-09-30T19:35:50Z", "savings x3752", "customer", "profile, card status, replacement shipping", 133, "", "" ], [ "2026-09-30T19:39:12Z", "checking x6449", "customer", "profile, card status, replacement shipping", 126, "", "" ], [ "2026-09-30T19:43:23Z", "checking x5530", "employee", "profile, card status, replacement shipping", 131, "", "" ], [ "2026-09-30T19:47:44Z", "checking x6279", "customer", "profile, card status, replacement shipping, contact details", 431, "", "" ], [ "2026-09-30T20:13:18Z", "checking x9951", "customer", "profile, card transactions, disputes", 583, "", "call CL-47236034" ], [ "2026-09-30T20:28:30Z", "savings x2813", "customer", "profile, balances, card transactions", 287, "", "call CL-47236425" ], [ "2026-09-30T20:41:23Z", "checking x3169", "customer", "profile, balances, card transactions", 379, "", "call CL-47236618" ], [ "2026-09-30T20:53:50Z", "checking x0029", "customer", "profile, card status", 432, "dispute opened", "call CL-47236735" ], [ "2026-09-30T20:55:51Z", "checking x6990", "customer", "profile, card transactions, disputes", 188, "", "call CL-47236735" ], [ "2026-09-30T21:05:57Z", "checking x4594", "customer", "profile, card transactions, history", 530, "", "call CL-47236917" ], [ "2026-09-30T21:22:09Z", "savings x7458", "customer", "profile, card status, card transactions", 407, "", "chat CH-549244" ], [ "2026-10-01T13:06:11Z", "checking x0737", "customer", "profile, card status, replacement shipping", 211, "travel note added", "chat CH-549253" ], [ "2026-10-01T13:14:24Z", "credit card x0670", "customer", "profile, card status, replacement shipping", 380, "", "chat CH-549281" ], [ "2026-10-01T13:25:19Z", "checking x5331", "customer", "profile, card status, travel notes", 404, "travel note added", "chat CH-549289" ], [ "2026-10-01T13:43:39Z", "checking x9235", "customer", "profile, card status, replacement shipping", 467, "", "call CL-47236965" ], [ "2026-10-01T13:54:57Z", "checking x8092", "customer", "profile, balances, card transactions", 331, "", "call CL-47237026" ], [ "2026-10-01T14:03:53Z", "checking x6999", "customer", "profile, card status, replacement shipping", 415, "", "call CL-47237295" ], [ "2026-10-01T14:30:02Z", "credit card x5710", "customer", "profile, balances, card transactions", 355, "", "chat CH-549309" ], [ "2026-10-01T14:40:21Z", "checking x5177", "customer", "profile, balances, card transactions", 247, "fee reversal $10.00", "call CL-47237350" ], [ "2026-10-01T14:49:45Z", "checking x4117", "customer", "profile, card status, card transactions", 336, "card unblocked", "call CL-47237556" ], [ "2026-10-01T15:19:27Z", "savings x1087", "customer", "profile, card status, travel notes", 388, "", "call CL-47237750" ], [ "2026-10-01T15:29:35Z", "savings x3321", "customer", "profile, card status, replacement shipping", 368, "", "chat CH-549313" ], [ "2026-10-01T15:40:43Z", "credit card x0608", "customer", "profile, card status, replacement shipping", 348, "travel note added", "call CL-47237946" ], [ "2026-10-01T15:42:42Z", "checking x5223", "customer", "profile, card status", 131, "", "call CL-47237946" ], [ "2026-10-01T15:56:41Z", "checking x9847", "customer", "profile, card transactions, history", 330, "", "call CL-47238040" ], [ "2026-10-01T16:08:50Z", "checking x9255", "customer", "profile, card transactions, disputes", 456, "", "call CL-47238097" ], [ "2026-10-01T16:25:41Z", "checking x7090", "customer", "profile, card status, card transactions", 171, "", "call CL-47238269" ], [ "2026-10-01T16:33:45Z", "savings x6618", "customer", "profile, balances, card transactions", 307, "PIN mailer requested", "call CL-47238659" ], [ "2026-10-01T16:46:08Z", "credit card x0556", "customer", "profile, card status", 405, "card unblocked", "call CL-47238824" ], [ "2026-10-01T16:56:40Z", "credit card x6417", "customer", "profile, card transactions, disputes", 203, "", "call CL-47238977" ], [ "2026-10-01T17:32:30Z", "checking x3327", "customer", "profile, balances, card transactions", 442, "", "call CL-47239072" ], [ "2026-10-01T17:49:16Z", "checking x9866", "customer", "profile, card status, replacement shipping", 481, "card unblocked", "call CL-47239363" ], [ "2026-10-01T17:50:39Z", "checking x8293", "customer", "profile, card transactions, disputes", 183, "", "call CL-47239363" ], [ "2026-10-01T18:02:06Z", "checking x3043", "customer", "profile, balances, card transactions", 217, "", "chat CH-549345" ], [ "2026-10-01T18:09:23Z", "checking x3739", "customer", "profile, card status", 231, "travel note added", "call CL-47239509" ], [ "2026-10-01T18:17:32Z", "checking x3557", "customer", "profile, card status, travel notes", 135, "fee reversal $5.00", "chat CH-549350" ], [ "2026-10-01T18:23:11Z", "checking x5048", "customer", "profile, card status, travel notes", 148, "", "call CL-47239665" ], [ "2026-10-01T18:35:59Z", "checking x5734", "customer", "profile, card status, replacement shipping", 353, "", "call CL-47239871" ], [ "2026-10-01T18:49:49Z", "savings x5824", "customer", "profile, card status, replacement shipping", 503, "card unblocked", "chat CH-549365" ], [ "2026-10-01T19:02:27Z", "checking x5780", "customer", "profile, card status, replacement shipping", 130, "", "" ], [ "2026-10-01T19:05:39Z", "checking x6707", "customer", "profile, card status, replacement shipping", 129, "", "" ], [ "2026-10-01T19:09:57Z", "checking x3164", "customer", "profile, card status, replacement shipping, contact details", 297, "", "" ], [ "2026-10-01T19:16:15Z", "premier checking x7781", "customer", "profile, card status, replacement shipping, contact details", 444, "", "" ], [ "2026-10-01T19:25:29Z", "checking x1165", "customer", "profile, card status, replacement shipping", 101, "", "" ], [ "2026-10-01T19:28:49Z", "checking x3488", "customer", "profile, card status, replacement shipping", 116, "", "" ], [ "2026-10-01T19:32:08Z", "savings x4035", "customer", "profile, card status, replacement shipping", 172, "", "" ], [ "2026-10-01T19:36:02Z", "checking x9127", "customer", "profile, card status, replacement shipping, contact details", 226, "", "" ], [ "2026-10-01T19:41:36Z", "checking x5682", "customer", "profile, card status, replacement shipping, contact details", 211, "", "" ], [ "2026-10-01T19:46:32Z", "checking x5919", "customer", "profile, card status, replacement shipping, contact details", 472, "replacement card re-sent to address on file", "" ], [ "2026-10-01T19:55:47Z", "savings x3295", "customer", "profile, card status, replacement shipping", 126, "", "" ], [ "2026-10-01T20:11:45Z", "checking x6876", "customer", "profile, card transactions, history", 172, "", "call CL-47240049" ], [ "2026-10-01T20:20:45Z", "checking x1278", "customer", "profile, card transactions, history", 430, "", "call CL-47240402" ], [ "2026-10-01T20:33:49Z", "checking x3762", "customer", "profile, card status", 452, "travel note added", "chat CH-549379" ], [ "2026-10-01T20:45:54Z", "credit card x6052", "customer", "profile, card status, replacement shipping", 191, "", "call CL-47240536" ], [ "2026-10-01T20:52:53Z", "savings x9015", "customer", "profile, card status, replacement shipping", 359, "dispute opened", "call CL-47240659" ], [ "2026-10-01T21:06:18Z", "checking x6333", "customer", "profile, card status, travel notes", 152, "", "call CL-47240919" ], [ "2026-10-01T21:15:26Z", "checking x2215", "customer", "profile, card status", 294, "", "call CL-47241030" ], [ "2026-10-01T21:24:19Z", "checking x2519", "customer", "profile, card status, replacement shipping", 333, "card blocked and replaced", "call CL-47241138" ], [ "2026-10-02T13:03:12Z", "checking x8428", "customer", "profile, card status, travel notes", 409, "", "call CL-47241485" ], [ "2026-10-02T13:13:40Z", "checking x0393", "customer", "profile, card transactions, disputes", 265, "", "chat CH-549397" ], [ "2026-10-02T13:15:32Z", "savings x8823", "customer", "profile, card status", 94, "", "chat CH-549397" ], [ "2026-10-02T13:26:40Z", "checking x1292", "customer", "profile, card status, replacement shipping", 320, "", "call CL-47241846" ], [ "2026-10-02T13:35:58Z", "checking x2480", "customer", "profile, card transactions, history", 302, "", "chat CH-549427" ], [ "2026-10-02T13:50:50Z", "checking x8875", "customer", "profile, card status, card transactions", 276, "", "call CL-47242246" ], [ "2026-10-02T13:59:58Z", "checking x1873", "customer", "profile, card status, travel notes", 328, "card limit restored after fraud block", "call CL-47242385" ], [ "2026-10-02T14:10:49Z", "checking x8533", "customer", "profile, card status, card transactions", 150, "card unblocked", "call CL-47242750" ], [ "2026-10-02T14:16:39Z", "credit card x9165", "customer", "profile, card transactions, disputes", 452, "", "call CL-47243021" ], [ "2026-10-02T14:28:58Z", "savings x5152", "customer", "profile, card transactions, history", 238, "", "chat CH-549456" ], [ "2026-10-02T14:45:51Z", "credit card x8069", "customer", "profile, card transactions, history", 268, "", "call CL-47243231" ], [ "2026-10-02T14:56:29Z", "savings x0254", "customer", "profile, balances, card transactions", 468, "", "call CL-47243348" ], [ "2026-10-02T15:17:19Z", "checking x3225", "customer", "profile, card status", 384, "card limit restored after fraud block", "call CL-47243473" ], [ "2026-10-02T15:29:41Z", "credit card x7069", "customer", "profile, card transactions, disputes", 617, "", "call CL-47243814" ], [ "2026-10-02T15:47:30Z", "credit card x9980", "customer", "profile, card status", 66, "fee reversal $35.00", "call CL-47244090" ], [ "2026-10-02T15:49:37Z", "checking x6074", "customer", "profile, card status", 455, "", "call CL-47244188" ], [ "2026-10-02T16:05:03Z", "checking x9072", "customer", "profile, card transactions, history", 364, "", "call CL-47244535" ], [ "2026-10-02T16:07:15Z", "checking x2736", "customer", "profile, card status", 177, "", "call CL-47244535" ], [ "2026-10-02T16:16:28Z", "savings x1034", "customer", "profile, balances, card transactions", 474, "", "call CL-47244650" ], [ "2026-10-02T16:29:48Z", "savings x5236", "customer", "profile, balances, card transactions", 414, "card limit restored after fraud block", "chat CH-549474" ], [ "2026-10-02T16:40:42Z", "checking x8521", "customer", "profile, card status", 343, "card limit restored after fraud block", "call CL-47244754" ], [ "2026-10-02T16:51:11Z", "credit card x7811", "customer", "profile, card status, travel notes", 128, "", "call CL-47245097" ], [ "2026-10-02T16:55:54Z", "checking x4979", "customer", "profile, card status, replacement shipping", 261, "", "call CL-47245205" ], [ "2026-10-02T17:31:10Z", "checking x4614", "customer", "profile, card status", 205, "", "call CL-47245423" ], [ "2026-10-02T17:40:07Z", "checking x3048", "customer", "profile, card status, travel notes", 447, "", "call CL-47245770" ], [ "2026-10-02T17:53:29Z", "checking x2388", "customer", "profile, card status, replacement shipping", 372, "", "chat CH-549498" ], [ "2026-10-02T18:10:57Z", "savings x3511", "customer", "profile, card transactions, history", 566, "card blocked and replaced", "call CL-47246138" ], [ "2026-10-02T18:28:24Z", "checking x6720", "customer", "profile, card status, card transactions", 449, "dispute opened", "chat CH-549537" ], [ "2026-10-02T18:29:58Z", "checking x2713", "customer", "profile, card status", 136, "", "chat CH-549537" ], [ "2026-10-02T18:41:23Z", "credit card x9341", "customer", "profile, card status", 270, "", "call CL-47246228" ], [ "2026-10-02T18:51:42Z", "checking x8934", "customer", "profile, card transactions, disputes", 361, "card unblocked", "call CL-47246333" ], [ "2026-10-02T19:01:29Z", "checking x4969", "customer", "profile, card status, replacement shipping", 151, "", "" ], [ "2026-10-02T19:06:25Z", "checking x8808", "customer", "profile, card status, replacement shipping", 115, "", "" ], [ "2026-10-02T19:09:32Z", "checking x5278", "customer", "profile, card status, replacement shipping", 141, "", "" ], [ "2026-10-02T19:13:59Z", "checking x4077", "customer", "profile, card status, replacement shipping, contact details", 299, "", "" ], [ "2026-10-02T19:20:50Z", "savings x3300", "customer", "profile, card status, replacement shipping, contact details", 197, "", "" ], [ "2026-10-02T19:25:27Z", "checking x0012", "customer", "profile, card status, replacement shipping", 129, "", "" ], [ "2026-10-02T19:29:55Z", "checking x6031", "customer", "profile, card status, replacement shipping, contact details", 454, "", "" ], [ "2026-10-02T19:38:45Z", "checking x5798", "customer", "profile, card status, replacement shipping, contact details", 431, "replacement card re-sent to address on file", "" ], [ "2026-10-02T19:47:48Z", "checking x9050", "customer", "profile, card status, replacement shipping, contact details", 449, "", "" ], [ "2026-10-02T20:13:47Z", "checking x0567", "customer", "profile, card status, travel notes", 504, "", "chat CH-549576" ], [ "2026-10-02T20:14:27Z", "savings x0520", "customer", "profile, card status", 234, "", "chat CH-549576" ], [ "2026-10-02T20:27:11Z", "checking x3611", "customer", "profile, card transactions, disputes", 255, "", "call CL-47246537" ], [ "2026-10-02T20:29:04Z", "checking x8444", "customer", "profile, card status, card transactions", 99, "", "call CL-47246537" ], [ "2026-10-02T20:36:46Z", "checking x4093", "customer", "profile, card transactions, history", 383, "", "chat CH-549601" ], [ "2026-10-02T20:44:19Z", "checking x2195", "customer", "profile, card status, replacement shipping", 151, "", "" ], [ "2026-10-02T20:51:38Z", "checking x7693", "customer", "profile, card transactions, history", 428, "", "call CL-47246696" ], [ "2026-10-02T21:02:38Z", "checking x8983", "customer", "profile, card status, replacement shipping", 377, "", "call CL-47246913" ], [ "2026-10-02T21:14:54Z", "credit card x2456", "customer", "profile, card status, card transactions", 431, "", "call CL-47247101" ], [ "2026-10-02T21:26:42Z", "checking x1194", "customer", "profile, card status", 285, "", "call CL-47247232" ], [ "2026-10-03T13:02:14Z", "savings x6139", "customer", "profile, card status, replacement shipping, contact details", 278, "", "" ], [ "2026-10-03T13:09:14Z", "savings x2402", "customer", "profile, card status, replacement shipping", 153, "", "" ], [ "2026-10-03T13:13:14Z", "checking x5693", "customer", "profile, card status, replacement shipping", 190, "", "" ], [ "2026-10-03T13:17:44Z", "checking x4209", "customer", "profile, card status, replacement shipping", 91, "", "" ], [ "2026-10-03T13:20:55Z", "savings x7773", "customer", "profile, card status, replacement shipping", 190, "", "" ], [ "2026-10-03T13:26:03Z", "checking x9268", "customer", "profile, card status, replacement shipping, contact details", 368, "", "" ], [ "2026-10-03T13:34:16Z", "checking x7945", "customer", "profile, card status, replacement shipping, contact details", 482, "", "" ], [ "2026-10-03T13:44:17Z", "checking x6862", "customer", "profile, card status, replacement shipping, contact details", 342, "", "" ], [ "2026-10-03T13:51:08Z", "checking x9151", "customer", "profile, card status, replacement shipping, contact details", 385, "", "" ], [ "2026-10-03T13:59:49Z", "checking x3816", "customer", "profile, card status, replacement shipping", 162, "", "" ], [ "2026-10-03T14:04:16Z", "checking x2234", "customer", "profile, card status, replacement shipping", 115, "", "" ], [ "2026-10-03T14:07:26Z", "savings x3051", "customer", "profile, card status, replacement shipping", 154, "", "" ], [ "2026-10-03T14:12:26Z", "checking x9414", "customer", "profile, card status, replacement shipping", 176, "", "" ], [ "2026-10-03T14:17:25Z", "savings x0892", "customer", "profile, card status, replacement shipping", 143, "", "" ], [ "2026-10-03T14:22:13Z", "checking x2555", "customer", "profile, card status, replacement shipping", 153, "", "" ], [ "2026-10-03T14:26:02Z", "checking x8527", "customer", "profile, card status, replacement shipping", 124, "", "" ], [ "2026-10-03T14:29:26Z", "savings x5869", "customer", "profile, card status, replacement shipping", 143, "", "" ], [ "2026-10-03T14:33:23Z", "checking x3036", "customer", "profile, card status, replacement shipping, contact details", 464, "", "" ], [ "2026-10-03T14:43:33Z", "savings x1503", "customer", "profile, card status, replacement shipping, contact details", 552, "replacement card re-sent to address on file", "" ], [ "2026-10-03T14:55:02Z", "savings x9043", "customer", "profile, card status, replacement shipping", 143, "", "" ] ] }, "contact_and_security_changes": { "columns": [ "ts", "account", "change", "verification_recorded", "linked_to" ], "rows": [ [ "2026-09-28T15:01:10Z", "checking x9513", "card blocked and replaced", "OTP to phone on file", "call CL-47221960" ], [ "2026-09-28T16:49:33Z", "checking x6543", "card blocked and replaced", "OTP to phone on file", "call CL-47222455" ], [ "2026-09-28T21:16:44Z", "checking x6225", "card blocked and replaced", "OTP to phone on file", "call CL-47226868" ], [ "2026-09-29T13:57:38Z", "checking x8360", "card blocked and replaced", "OTP to phone on file", "call CL-47227978" ], [ "2026-09-29T14:30:51Z", "credit card x0154", "PIN mailer requested", "caller authenticated in IVR (card and PIN)", "call CL-47228692" ], [ "2026-09-30T14:00:23Z", "checking x4023", "PIN mailer requested", "OTP to phone on file", "call CL-47232963" ], [ "2026-09-30T14:17:00Z", "checking x1394", "card blocked and replaced", "customer signed in to the mobile app chat", "chat CH-549118" ], [ "2026-09-30T15:19:14Z", "checking x7074", "card blocked and replaced", "OTP to phone on file", "call CL-47233388" ], [ "2026-09-30T15:49:46Z", "checking x3117", "card blocked and replaced", "OTP to phone on file", "call CL-47233810" ], [ "2026-09-30T16:09:11Z", "credit card x9756", "card blocked and replaced", "OTP to phone on file", "call CL-47234132" ], [ "2026-10-01T16:37:20Z", "savings x6618", "PIN mailer requested", "OTP to phone on file", "call CL-47238659" ], [ "2026-10-01T19:52:59Z", "checking x5919", "replacement card re-sent to address on file", "OTP to phone on file", "outbound dialer call" ], [ "2026-10-01T21:29:24Z", "checking x2519", "card blocked and replaced", "OTP to phone on file", "call CL-47241138" ], [ "2026-10-02T18:13:25Z", "savings x3511", "card blocked and replaced", "OTP to phone on file", "call CL-47246138" ], [ "2026-10-02T19:44:32Z", "checking x5798", "replacement card re-sent to address on file", "OTP to phone on file", "outbound dialer call" ], [ "2026-10-03T14:51:05Z", "savings x1503", "replacement card re-sent to address on file", "OTP to phone on file", "outbound dialer call" ] ] }, "endpoint_events": { "columns": [ "ts", "event", "detail" ], "rows": [ [ "2026-09-30T16:03:40Z", "screen capture (Snipping Tool) saved to the desktop", "window: Card management - Card status (error CS-500)" ], [ "2026-09-30T16:05:12Z", "file attached to IT incident", "INC-448812 opened by E-52310: 'Card status screen shows CS-500 for reissued cards, cannot see activation status.' 4 other agents reported the same error that afternoon; fixed 17:40Z. The saved file was deleted at 16:06Z." ] ] }, "endpoint_summary": "No prints, USB use, file uploads or external email in the window.", "accounts_in_the_alert": { "columns": [ "account", "holder", "balance_usd", "customer_since", "online_banking", "phone_on_file", "notes" ], "rows": [ [ "premier checking x7781", "customer", 388120.64, "2003-04", "enrolled, last login 2026-10-01", "mobile", "IR-12: balance over $250,000, outside the inbound queue. On the campaign list; replacement debit card reissued 2026-09-19." ], [ "checking x5530", "Employee E-61822, mortgage processing (different department and site)", 4127.39, "2019-06", "enrolled, last login 2026-10-02", "mobile", "IR-09: account held by an employee. On the campaign list; replacement debit card reissued 2026-09-19." ] ] }, "unlinked_lookups_with_other_records": { "columns": [ "lookup_ts", "account", "holder", "on_campaign_list", "other_records" ], "rows": [ [ "2026-09-29T19:02:26Z", "savings x4646", "customer", "yes", "Outbound dialer call at 19:03:38Z to the phone on file, 287 s: reached: card activated during the call" ], [ "2026-09-29T19:10:54Z", "checking x2459", "customer", "yes", "Outbound dialer call at 19:11:35Z to the phone on file, 296 s: reached: card activated during the call" ], [ "2026-09-29T19:18:19Z", "checking x1012", "customer", "yes", "Outbound dialer call at 19:19:08Z to the phone on file, 31 s: voicemail left" ], [ "2026-09-29T19:22:31Z", "checking x3055", "customer", "yes", "Outbound dialer call at 19:23:20Z to the phone on file, 365 s: reached: card activated during the call. Agent note: 'Customer says she already reported charges on the old card to the fraud line'" ], [ "2026-09-29T19:32:10Z", "checking x6782", "customer", "yes", "Outbound dialer call at 19:32:48Z to the phone on file, 237 s: reached: card activated during the call" ], [ "2026-09-29T19:38:56Z", "checking x2890", "customer", "yes", "Outbound dialer call at 19:40:30Z to the phone on file, 380 s: reached: card activated during the call" ], [ "2026-09-29T19:48:34Z", "savings x4639", "customer", "yes", "Outbound dialer call at 19:49:29Z to the phone on file, 334 s: reached: card activated during the call" ], [ "2026-09-30T18:21:44Z", "checking x6604", "customer", "no", "Chat CH-549902 started 18:13:10Z in the digital banking queue about a declined card at a fuel pump, transferred to E-52310 at 18:21:20Z, ended 18:30:05Z; card unblocked after the customer confirmed the charges" ], [ "2026-09-30T19:03:12Z", "checking x2948", "customer", "yes", "Outbound dialer call at 19:04:18Z to the phone on file, 25 s: voicemail left" ], [ "2026-09-30T19:06:42Z", "checking x4733", "customer", "yes", "Outbound dialer call at 19:07:28Z to the phone on file, 35 s: voicemail left" ], [ "2026-09-30T19:10:14Z", "checking x5975", "customer", "yes", "Outbound dialer call at 19:11:09Z to the phone on file, 32 s: voicemail left" ], [ "2026-09-30T19:13:57Z", "checking x2851", "customer", "yes", "Outbound dialer call at 19:14:53Z to the phone on file, 298 s: reached: card activated during the call" ], [ "2026-09-30T19:22:30Z", "checking x7087", "customer", "yes", "Outbound dialer call at 19:23:58Z to the phone on file, 26 s: voicemail left" ], [ "2026-09-30T19:27:32Z", "checking x0726", "customer", "yes", "Outbound dialer call at 19:28:08Z to the phone on file, 34 s: voicemail left" ], [ "2026-09-30T19:31:49Z", "savings x6313", "customer", "yes", "Outbound dialer call at 19:33:21Z to the phone on file, 45 s: voicemail left" ], [ "2026-09-30T19:35:50Z", "savings x3752", "customer", "yes", "Outbound dialer call at 19:37:12Z to the phone on file, 28 s: voicemail left" ], [ "2026-09-30T19:39:12Z", "checking x6449", "customer", "yes", "Outbound dialer call at 19:40:01Z to the phone on file, 27 s: voicemail left" ], [ "2026-09-30T19:43:23Z", "checking x5530", "employee", "yes", "Outbound dialer call at 19:44:21Z to the phone on file, 25 s: voicemail left" ], [ "2026-09-30T19:47:44Z", "checking x6279", "customer", "yes", "Outbound dialer call at 19:49:18Z to the phone on file, 298 s: reached: card activated during the call" ], [ "2026-10-01T19:02:27Z", "checking x5780", "customer", "yes", "Outbound dialer call at 19:03:06Z to the phone on file, 41 s: voicemail left" ], [ "2026-10-01T19:05:39Z", "checking x6707", "customer", "yes", "Outbound dialer call at 19:06:56Z to the phone on file, 30 s: voicemail left" ], [ "2026-10-01T19:09:57Z", "checking x3164", "customer", "yes", "Outbound dialer call at 19:10:37Z to the phone on file, 225 s: reached: card activated during the call" ], [ "2026-10-01T19:16:15Z", "premier checking x7781", "customer", "yes", "Outbound dialer call at 19:17:20Z to the phone on file, 345 s: reached: card activated during the call" ], [ "2026-10-01T19:25:29Z", "checking x1165", "customer", "yes", "Outbound dialer call at 19:26:00Z to the phone on file, 36 s: voicemail left" ], [ "2026-10-01T19:28:49Z", "checking x3488", "customer", "yes", "Outbound dialer call at 19:29:24Z to the phone on file, 38 s: voicemail left" ], [ "2026-10-01T19:32:08Z", "savings x4035", "customer", "yes", "Outbound dialer call at 19:33:41Z to the phone on file, 13 s: number disconnected" ], [ "2026-10-01T19:36:02Z", "checking x9127", "customer", "yes", "Outbound dialer call at 19:37:29Z to the phone on file, 119 s: reached: customer will activate in the app. Agent note: 'Customer has a new phone and will reset the app login'" ], [ "2026-10-01T19:41:36Z", "checking x5682", "customer", "yes", "Outbound dialer call at 19:42:03Z to the phone on file, 124 s: reached: customer will activate in the app" ], [ "2026-10-01T19:46:32Z", "checking x5919", "customer", "yes", "Outbound dialer call at 19:47:12Z to the phone on file, 377 s: reached: card not received, replacement re-sent to address on file after OTP to phone on file" ], [ "2026-10-01T19:55:47Z", "savings x3295", "customer", "yes", "Outbound dialer call at 19:57:01Z to the phone on file, 30 s: voicemail left" ], [ "2026-10-02T19:01:29Z", "checking x4969", "customer", "yes", "Outbound dialer call at 19:02:50Z to the phone on file, 44 s: voicemail left" ], [ "2026-10-02T19:06:25Z", "checking x8808", "customer", "yes", "Outbound dialer call at 19:07:25Z to the phone on file, 25 s: voicemail left" ], [ "2026-10-02T19:09:32Z", "checking x5278", "customer", "yes", "Outbound dialer call at 19:10:26Z to the phone on file, 36 s: voicemail left" ], [ "2026-10-02T19:13:59Z", "checking x4077", "customer", "yes", "Outbound dialer call at 19:14:32Z to the phone on file, 232 s: reached: card activated during the call" ], [ "2026-10-02T19:20:50Z", "savings x3300", "customer", "yes", "Outbound dialer call at 19:21:29Z to the phone on file, 123 s: reached: customer will activate in the app" ], [ "2026-10-02T19:25:27Z", "checking x0012", "customer", "yes", "Outbound dialer call at 19:26:45Z to the phone on file, 29 s: no answer" ], [ "2026-10-02T19:29:55Z", "checking x6031", "customer", "yes", "Outbound dialer call at 19:30:46Z to the phone on file, 377 s: reached: card activated during the call" ], [ "2026-10-02T19:38:45Z", "checking x5798", "customer", "yes", "Outbound dialer call at 19:39:27Z to the phone on file, 335 s: reached: card not received, replacement re-sent to address on file after OTP to phone on file" ], [ "2026-10-02T19:47:48Z", "checking x9050", "customer", "yes", "Outbound dialer call at 19:48:31Z to the phone on file, 341 s: reached: card activated during the call" ], [ "2026-10-02T20:44:19Z", "checking x2195", "customer", "no", "Inbound call CL-47392240 from the phone on file 20:39:02Z to 20:43:51Z, answered by E-52310, dropped before a CRM contact record was created. Ticket TK-603871 created by E-52310 at 21:25:30Z: 'Cust asked where replacement card is, call dropped. Card mailed 9/19, delivered 9/24 per tracking. Called back 21:24, left VM.' Dialer shows the 21:24:02Z callback to the phone on file." ], [ "2026-10-03T13:02:14Z", "savings x6139", "customer", "yes", "Outbound dialer call at 13:03:47Z to the phone on file, 126 s: reached: customer will activate in the app" ], [ "2026-10-03T13:09:14Z", "savings x2402", "customer", "yes", "Outbound dialer call at 13:10:41Z to the phone on file, 27 s: voicemail left" ], [ "2026-10-03T13:13:14Z", "checking x5693", "customer", "yes", "Outbound dialer call at 13:14:39Z to the phone on file, 43 s: voicemail left" ], [ "2026-10-03T13:17:44Z", "checking x4209", "customer", "yes", "Outbound dialer call at 13:18:28Z to the phone on file, 26 s: voicemail left" ], [ "2026-10-03T13:20:55Z", "savings x7773", "customer", "yes", "Outbound dialer call at 13:22:15Z to the phone on file, 42 s: voicemail left" ], [ "2026-10-03T13:26:03Z", "checking x9268", "customer", "yes", "Outbound dialer call at 13:26:41Z to the phone on file, 271 s: reached: card activated during the call" ], [ "2026-10-03T13:34:16Z", "checking x7945", "customer", "yes", "Outbound dialer call at 13:35:34Z to the phone on file, 361 s: reached: card activated during the call" ], [ "2026-10-03T13:44:17Z", "checking x6862", "customer", "yes", "Outbound dialer call at 13:44:54Z to the phone on file, 261 s: reached: card activated during the call" ], [ "2026-10-03T13:51:08Z", "checking x9151", "customer", "yes", "Outbound dialer call at 13:51:38Z to the phone on file, 289 s: reached: card activated during the call" ], [ "2026-10-03T13:59:49Z", "checking x3816", "customer", "yes", "Outbound dialer call at 14:00:51Z to the phone on file, 45 s: voicemail left" ], [ "2026-10-03T14:04:16Z", "checking x2234", "customer", "yes", "Outbound dialer call at 14:04:46Z to the phone on file, 36 s: voicemail left" ], [ "2026-10-03T14:07:26Z", "savings x3051", "customer", "yes", "Outbound dialer call at 14:08:48Z to the phone on file, 41 s: voicemail left" ], [ "2026-10-03T14:12:26Z", "checking x9414", "customer", "yes", "Outbound dialer call at 14:14:01Z to the phone on file, 27 s: voicemail left" ], [ "2026-10-03T14:17:25Z", "savings x0892", "customer", "yes", "Outbound dialer call at 14:18:06Z to the phone on file, 43 s: voicemail left" ], [ "2026-10-03T14:22:13Z", "checking x2555", "customer", "yes", "Outbound dialer call at 14:23:12Z to the phone on file, 35 s: voicemail left" ], [ "2026-10-03T14:26:02Z", "checking x8527", "customer", "yes", "Outbound dialer call at 14:26:37Z to the phone on file, 30 s: no answer" ], [ "2026-10-03T14:29:26Z", "savings x5869", "customer", "yes", "Outbound dialer call at 14:30:42Z to the phone on file, 30 s: no answer" ], [ "2026-10-03T14:33:23Z", "checking x3036", "customer", "yes", "Outbound dialer call at 14:34:10Z to the phone on file, 362 s: reached: card activated during the call" ], [ "2026-10-03T14:43:33Z", "savings x1503", "customer", "yes", "Outbound dialer call at 14:44:39Z to the phone on file, 416 s: reached: card not received, replacement re-sent to address on file after OTP to phone on file" ], [ "2026-10-03T14:55:02Z", "savings x9043", "customer", "yes", "Outbound dialer call at 14:55:35Z to the phone on file, 43 s: voicemail left" ] ] }, "activity_after_access": { "columns": [ "ts", "account", "event" ], "rows": [ [ "2026-10-01T19:22:15Z", "premier checking x7781", "Replacement debit card activated during the outbound call; card purchases since at the customer's usual merchants" ], [ "2026-10-02T00:41:27Z", "checking x9127", "Mobile app login password reset by one-time code to the phone on file, then login from a new iPhone; IP from the same residential ISP in Columbus, OH as the customer's logins for the last 14 months; replacement card activated in the app 00:44:09Z" ], [ "2026-10-02T15:06:51Z", "checking x5530", "Replacement debit card activated by IVR from the phone on file" ], [ "2026-10-03T14:27:35Z", "checking x3055", "Fraud claim FC-2026-117962 completed with the fraud team for 3 online charges of $64.12, $119.80 and $212.45 made 2026-09-14 to 09-18 on the old card number, which was closed at the reissue on 2026-09-19. The customer first reported the charges to the fraud line on 2026-09-21." ], [ "2026-10-05T10:00:00Z", "all accounts in the access log", "Since the lookups: 32 replacement cards from the campaign list activated; no other fraud claims; no phone, email or address changes other than those in contact_and_security_changes" ] ] } }, "questions": { "access_without_business_reason": { "type": "noul", "instructions": "Did the employee open or change any customer account in this alert without a business reason, meaning that no customer contact, ticket, assigned case or other work item explains it?" }, "enabling_fraud_likelihood": { "type": "score", "instructions": "How likely is it that the employee is helping people outside the institution commit fraud against customer accounts, for example by passing on account details or changing accounts so that others can take them over?", "criteria": [ "Very unlikely (under 10%)", "Unlikely (10-40%)", "Uncertain (40-60%)", "Likely (60-90%)", "Very likely (over 90%)" ] }, "explanation": { "type": "choice", "instructions": "What is the most likely explanation for the employee's activity flagged in this alert?", "criteria": { "legitimate_work": "Legitimate work: customer contacts, tickets, assigned cases, training or supervisory review explain the activity", "snooping": "Curiosity or snooping: the employee viewed accounts with no business reason, without changing them or using what they saw for gain", "self_dealing": "Self-dealing: the employee used their access to benefit themselves or someone linked to them, for example by reversing fees or raising limits on their own or a household member's account", "enabling_fraud": "Enabling outside fraud: the employee looked up or changed accounts so that people outside the institution could take them over or take money from them", "policy_mistake": "Policy mistake: the employee was handling a real customer's real request but skipped a required step, such as logging the contact or verifying identity" } }, "action": { "type": "choice", "instructions": "What should happen with this alert now?", "criteria": { "no_action": "Close the alert as legitimate activity, with no action against the employee", "refer": "Refer the employee to the insider risk team for investigation, leaving their system access in place for now", "suspend": "Suspend the employee's system access now and escalate to the insider risk team and HR" } } } }