{
  "model": "grayson-1",
  "state": {
    "customer": {
      "customer_id": "C-0418827",
      "name": "Carol A. Brennan",
      "age": 64,
      "customer_since": "2011-05-23",
      "home": "Toledo, OH; owns the home, at this address since 1998",
      "occupation_on_file": "Retired (formerly medical billing specialist)",
      "income_on_file": "Social Security and a pension",
      "stated_annual_income_usd": 30500,
      "expected_activity": {
        "monthly_deposits_usd": 2600,
        "deposit_sources": "Social Security, pension",
        "p2p": "Occasional, family",
        "wires": "None expected",
        "virtual_currency": "No",
        "cash": "Small ATM withdrawals"
      },
      "identity_verification": "In branch 2011-05-23 with an Ohio driver's license; re-verified 2023-04-18 when the joint owner was removed",
      "last_kyc_refresh": "2024-03-11",
      "risk_rating": "Low",
      "prior_aml_alerts": [],
      "prior_sars_filed": 0,
      "contact_details": "Mobile phone on file since 2014 and email since 2017; no changes to phone, email or address in the last 24 months",
      "products": [
        "Personal checking x6604",
        "Savings x6611",
        "Debit card x4417"
      ]
    },
    "accounts": [
      {
        "account": "Personal checking x6604",
        "opened": "2011-05-23",
        "owners": "Carol A. Brennan (joint owner Richard J. Brennan removed 2023-04-18, deceased)",
        "status": "Open, no restrictions",
        "overdraft": "Not enrolled: card purchases decline and ACH debits return when funds are short",
        "limits": {
          "p2p_per_day_usd": 2500,
          "external_transfer_per_day_usd": 3000,
          "atm_per_day_usd": 500,
          "online_wires": "Not enabled; wires only in branch"
        },
        "limit_changes": [
          "2026-09-12: P2P daily limit raised from $1,000 to $2,500 at the customer's request in the app"
        ],
        "balance_now_usd": 6805.85,
        "average_daily_balance_2025_10_to_2026_08_usd": 3415.14
      },
      {
        "account": "Savings x6611",
        "opened": "2011-05-23",
        "balance_now_usd": 5168.43,
        "activity_since_2025_10": "Monthly interest only, and one transfer of $4,000.00 to checking on 2026-08-12"
      }
    ],
    "monthly_summary": {
      "columns": [
        "month",
        "credits_usd",
        "pay_benefits_and_settlements_usd",
        "from_others_usd",
        "from_others_count",
        "distinct_senders",
        "debits_usd",
        "cards_and_bills_usd",
        "p2p_out_usd",
        "transfers_and_wires_out_usd",
        "cash_out_usd",
        "ending_balance_usd"
      ],
      "rows": [
        [
          "2025-10",
          3119.8,
          3119.8,
          0,
          0,
          0,
          1863.16,
          1563.16,
          0,
          0,
          300,
          2171.27
        ],
        [
          "2025-11",
          1895,
          1895,
          0,
          0,
          0,
          2230.08,
          2000.08,
          50,
          0,
          180,
          1836.19
        ],
        [
          "2025-12",
          3169.8,
          3119.8,
          50,
          1,
          1,
          2043.92,
          1983.92,
          0,
          0,
          60,
          2962.07
        ],
        [
          "2026-01",
          2559.4,
          2559.4,
          0,
          0,
          0,
          3310.37,
          3150.37,
          100,
          0,
          60,
          2211.1
        ],
        [
          "2026-02",
          2559.4,
          2559.4,
          0,
          0,
          0,
          2288.74,
          1998.74,
          50,
          0,
          240,
          2481.76
        ],
        [
          "2026-03",
          2047,
          1947,
          100,
          1,
          1,
          2021.31,
          1796.31,
          25,
          0,
          200,
          2507.45
        ],
        [
          "2026-04",
          2971.4,
          2971.4,
          0,
          0,
          0,
          1949.3,
          1709.3,
          0,
          0,
          240,
          3529.55
        ],
        [
          "2026-05",
          2559.4,
          2559.4,
          0,
          0,
          0,
          1897.41,
          1837.41,
          0,
          0,
          60,
          4191.54
        ],
        [
          "2026-06",
          2559.4,
          2559.4,
          0,
          0,
          0,
          2138.8,
          1918.8,
          100,
          0,
          120,
          4612.14
        ],
        [
          "2026-07",
          3231.8,
          3171.8,
          60,
          1,
          1,
          3364.85,
          3124.85,
          100,
          0,
          140,
          4479.09
        ],
        [
          "2026-08",
          5947,
          1947,
          0,
          0,
          0,
          5491.72,
          1491.72,
          0,
          3900,
          100,
          4934.37
        ],
        [
          "2026-09",
          32744.4,
          2559.4,
          28235,
          9,
          9,
          30197.6,
          2277.6,
          6850,
          18960,
          160,
          7481.17
        ],
        [
          "2026-10 (to 10-06)",
          12802.4,
          612.4,
          12190,
          4,
          4,
          13477.72,
          547.72,
          4950,
          7980,
          0,
          6805.85
        ]
      ]
    },
    "devices_and_logins": {
      "devices": [
        {
          "device": "iPhone 12, our iOS app",
          "first_seen": "2021-11-03",
          "logins_last_90_days": 118,
          "other_customers_seen_on_device": 0
        },
        {
          "device": "iPad (9th generation), Safari",
          "first_seen": "2019-12-27",
          "logins_last_90_days": 31,
          "other_customers_seen_on_device": 0
        }
      ],
      "login_locations_last_90_days": "All from one residential broadband connection in Toledo, OH and the customer's mobile carrier; no VPN, proxy or hosting-provider addresses",
      "remote_access_software_detected": false,
      "session_events": [
        {
          "ts": "2026-07-28T13:02:00Z",
          "event": "Password reset with a one-time code sent to the phone on file"
        },
        {
          "ts": "2026-08-12T01:14:00Z",
          "event": "External account added: crypto exchange account x7720, instant verification, owner name matches"
        },
        {
          "ts": "2026-09-12T12:03:00Z",
          "event": "P2P daily limit increase requested in the app and approved automatically ($1,000 to $2,500)"
        },
        {
          "ts": "2026-09-19T14:05:00Z",
          "event": "P2P payee added: Cameron Rowe (phone token); scam warning shown; customer chose 'Paying a business' and continued"
        },
        {
          "ts": "2026-09-30T12:14:00Z",
          "event": "P2P payee added: Marcus Teague (email token); scam warning shown; customer chose 'Paying a business' and continued"
        }
      ]
    },
    "links_to_other_customers": {
      "shared_devices": 0,
      "shared_phone_numbers": 0,
      "shared_emails": 0,
      "shared_addresses": 0,
      "shared_login_ip_addresses_last_90_days": 0,
      "shared_counterparties": [
        "P2P payee Cameron Rowe was also paid by 2 other customers of ours since 2026-09-01; both accounts have open mule alerts",
        "Wire beneficiary Varnell Ridge Supply LLC also received a wire from 1 other customer of ours on 2026-09-24; that account is restricted pending review"
      ]
    },
    "counterparties": {
      "note": "Everyone the account received money from or sent money to by P2P, ACH, wire, check or external transfer since 2026-08-01; first_activity is the first item with this counterparty in our records",
      "columns": [
        "id",
        "name",
        "kind",
        "institution",
        "first_activity",
        "credits",
        "credits_usd",
        "payments",
        "payments_usd",
        "notes"
      ],
      "rows": [
        [
          "C01",
          "Crypto exchange account x7720",
          "Own account at another institution",
          "Large US crypto exchange",
          "2026-08-12",
          0,
          0,
          8,
          15760,
          "Linked 2026-08-11 by instant verification; owner name matches the customer; no other customer of ours has linked it"
        ],
        [
          "C02",
          "Emily Brennan",
          "Individual",
          "Large national bank",
          "2019-06-14",
          0,
          0,
          1,
          50,
          "Customer's granddaughter (per 2022 call notes)"
        ],
        [
          "C03",
          "Sarah Whitcomb",
          "Individual",
          "Regional bank, TX",
          "2026-09-15",
          1,
          1200,
          0,
          0,
          null
        ],
        [
          "C04",
          "Dana Larkin",
          "Individual",
          "Credit union, MI",
          "2026-09-17",
          1,
          850,
          0,
          0,
          null
        ],
        [
          "C05",
          "Travis Brandt",
          "Individual",
          "Large national bank",
          "2026-09-18",
          1,
          2000,
          0,
          0,
          "Scam claim from sending institution 2026-10-06"
        ],
        [
          "C06",
          "Cameron Rowe",
          "Individual",
          "Online bank",
          "2026-09-19",
          0,
          0,
          3,
          6800,
          "P2P payee added 2026-09-19 (phone token); also paid by 2 other customers of ours since 2026-09-01, both now under mule alerts"
        ],
        [
          "C07",
          "Tollmere Pallet & Crate Co.",
          "Business",
          "Regional bank, GA",
          "2026-09-22",
          1,
          1950,
          1,
          1950,
          "Drawer of mobile-deposited check 10427"
        ],
        [
          "C08",
          "Rafael Valdez",
          "Individual",
          "Large national bank",
          "2026-09-22",
          1,
          1500,
          0,
          0,
          "Scam claim from sending institution 2026-10-02"
        ],
        [
          "C09",
          "Kevin Mercer",
          "Individual",
          "Online bank",
          "2026-09-24",
          1,
          2300,
          0,
          0,
          null
        ],
        [
          "C10",
          "Calloway Bend Orthodontics PLLC",
          "Business",
          "Community bank, KS",
          "2026-09-25",
          1,
          9460,
          0,
          0,
          "ODFI request for return (R06) 2026-10-05"
        ],
        [
          "C11",
          "Varnell Ridge Supply LLC",
          "Business",
          "Regional bank, TX",
          "2026-09-25",
          0,
          0,
          2,
          15080,
          "Wire beneficiary, account x8830, Houston TX; also received a wire from 1 other customer of ours on 2026-09-24 (that account is restricted pending review)"
        ],
        [
          "C12",
          "Lauren Fenwick",
          "Individual",
          "Credit union, GA",
          "2026-09-26",
          1,
          975,
          0,
          0,
          "Scam claim from sending institution 2026-10-05"
        ],
        [
          "C13",
          "Margaret E. Sorensen",
          "Individual",
          "Regional bank, AZ",
          "2026-09-29",
          1,
          7500,
          0,
          0,
          "Wire recall request 2026-10-06"
        ],
        [
          "C14",
          "Marcus Teague",
          "Individual",
          "Large national bank",
          "2026-09-30",
          0,
          0,
          2,
          4950,
          "P2P payee added 2026-09-30 (email token)"
        ],
        [
          "C15",
          "Angela Holloway",
          "Individual",
          "Regional bank, NC",
          "2026-09-30",
          1,
          2450,
          0,
          0,
          null
        ],
        [
          "C16",
          "Fenmoor Millwork LLC",
          "Business",
          "Regional bank, WI",
          "2026-10-01",
          1,
          6240,
          0,
          0,
          null
        ],
        [
          "C17",
          "Jorge Pacheco",
          "Individual",
          "Large national bank",
          "2026-10-03",
          1,
          1800,
          0,
          0,
          null
        ],
        [
          "C18",
          "Brian Yates",
          "Individual",
          "Credit union, WA",
          "2026-10-05",
          1,
          2500,
          0,
          0,
          null
        ],
        [
          "C19",
          "Grace Osei",
          "Individual",
          "Online bank",
          "2026-10-06",
          1,
          1650,
          0,
          0,
          null
        ]
      ]
    },
    "transactions": {
      "note": "Every posted item from 2026-08-01 to the alert; amounts signed (debits negative); balance is the ledger balance after the item; counterparty refers to the counterparties table",
      "columns": [
        "ts",
        "type",
        "amount_usd",
        "balance_usd",
        "description",
        "counterparty",
        "detail"
      ],
      "rows": [
        [
          "2026-08-02T18:05:18Z",
          "card_purchase",
          -45.09,
          4434,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-08-03T11:00:00Z",
          "ach_debit",
          -162.35,
          4271.65,
          "UHC MEDSUPP PREMIUM",
          null,
          "SEC PPD"
        ],
        [
          "2026-08-04T12:35:28Z",
          "card_purchase",
          -19.73,
          4251.92,
          "TIM HORTONS #2219 TOLEDO OH",
          null,
          "mcc 5814, contactless"
        ],
        [
          "2026-08-04T17:56:52Z",
          "card_purchase",
          -28.68,
          4223.24,
          "MARCO'S PIZZA #1043 TOLEDO OH",
          null,
          "mcc 5814, card not present"
        ],
        [
          "2026-08-05T13:00:22Z",
          "card_purchase",
          -50,
          4173.24,
          "HOLY ROSARY PARISH GIVING",
          null,
          "mcc 8661, card on file, recurring"
        ],
        [
          "2026-08-05T23:46:52Z",
          "card_purchase",
          -57.67,
          4115.57,
          "AMAZON MKTPL*NKQI8ZHMI Amzn.com/bill WA",
          null,
          "mcc 5942, card not present"
        ],
        [
          "2026-08-06T15:03:12Z",
          "card_purchase",
          -27.24,
          4088.33,
          "CVS/PHARMACY #04512 TOLEDO OH",
          null,
          "mcc 5912, chip"
        ],
        [
          "2026-08-06T21:49:16Z",
          "card_purchase",
          -8.46,
          4079.87,
          "MARCO'S PIZZA #1043 TOLEDO OH",
          null,
          "mcc 5814, card not present"
        ],
        [
          "2026-08-06T21:49:35Z",
          "card_purchase",
          -35.63,
          4044.24,
          "TARGET 00012345 TOLEDO OH",
          null,
          "mcc 5310, chip"
        ],
        [
          "2026-08-07T21:49:08Z",
          "card_purchase",
          -35.23,
          4009.01,
          "PANERA BREAD #601244 TOLEDO OH",
          null,
          "mcc 5814, contactless"
        ],
        [
          "2026-08-09T09:02:55Z",
          "card_purchase",
          -15.49,
          3993.52,
          "NETFLIX.COM",
          null,
          "mcc 4899, card on file, recurring"
        ],
        [
          "2026-08-10T14:08:40Z",
          "card_purchase",
          -27.22,
          3966.3,
          "MEIJER EXPRESS #214 TOLEDO OH",
          null,
          "mcc 5542, chip"
        ],
        [
          "2026-08-12T08:10:05Z",
          "card_purchase",
          -62.18,
          3904.12,
          "VERIZON WIRELESS PAYMENTS",
          null,
          "mcc 4814, card on file, recurring"
        ],
        [
          "2026-08-12T10:00:00Z",
          "ach_credit",
          1947,
          5851.12,
          "SSA TREAS 310 XXSOC SEC",
          null,
          "SEC PPD"
        ],
        [
          "2026-08-12T13:51:49Z",
          "card_purchase",
          -15.33,
          5835.79,
          "CVS/PHARMACY #04512 TOLEDO OH",
          null,
          "mcc 5912, chip"
        ],
        [
          "2026-08-12T14:02:54Z",
          "transfer_in",
          4000,
          9835.79,
          "TRANSFER FROM SAVINGS x6611",
          null,
          "online banking"
        ],
        [
          "2026-08-12T14:11:53Z",
          "transfer_out",
          -3900,
          5935.79,
          "RTP TO CRYPTO EXCHANGE x7720",
          "C01",
          "instant payment to linked account in customer's name"
        ],
        [
          "2026-08-13T21:56:24Z",
          "card_purchase",
          -51.69,
          5884.1,
          "AMAZON MKTPL*4J0EV6QIF Amzn.com/bill WA",
          null,
          "mcc 5942, card not present"
        ],
        [
          "2026-08-14T16:01:36Z",
          "card_purchase",
          -60.13,
          5823.97,
          "MEIJER #214 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-08-14T21:55:09Z",
          "atm_withdrawal",
          -100,
          5723.97,
          "ATM WITHDRAWAL #0217 TOLEDO OH",
          null,
          "our ATM"
        ],
        [
          "2026-08-15T19:47:46Z",
          "card_purchase",
          -37.41,
          5686.56,
          "SPEEDWAY 03917 TOLEDO OH",
          null,
          "mcc 5542, chip"
        ],
        [
          "2026-08-15T22:36:31Z",
          "card_purchase",
          -15.41,
          5671.15,
          "PANERA BREAD #601244 TOLEDO OH",
          null,
          "mcc 5814, contactless"
        ],
        [
          "2026-08-16T23:12:32Z",
          "card_purchase",
          -15.99,
          5655.16,
          "TIM HORTONS #2219 TOLEDO OH",
          null,
          "mcc 5814, contactless"
        ],
        [
          "2026-08-17T11:00:00Z",
          "ach_debit",
          -125.41,
          5529.75,
          "TOLEDO EDISON AUTOPAY",
          null,
          "SEC PPD"
        ],
        [
          "2026-08-17T17:41:25Z",
          "card_purchase",
          -15.6,
          5514.15,
          "WALGREENS #3412 TOLEDO OH",
          null,
          "mcc 5912, chip"
        ],
        [
          "2026-08-18T08:30:11Z",
          "card_purchase",
          -109.99,
          5404.16,
          "SPECTRUM",
          null,
          "mcc 4899, card on file, recurring"
        ],
        [
          "2026-08-20T13:02:08Z",
          "card_purchase",
          -27.89,
          5376.27,
          "TIM HORTONS #2219 TOLEDO OH",
          null,
          "mcc 5814, contactless"
        ],
        [
          "2026-08-20T16:51:29Z",
          "card_purchase",
          -18.51,
          5357.76,
          "TIM HORTONS #2219 TOLEDO OH",
          null,
          "mcc 5814, contactless"
        ],
        [
          "2026-08-21T11:00:00Z",
          "ach_debit",
          -30.73,
          5327.03,
          "COLUMBIA GAS OH AUTOPAY",
          null,
          "SEC PPD"
        ],
        [
          "2026-08-23T19:30:12Z",
          "card_purchase",
          -57.45,
          5269.58,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-08-23T19:53:34Z",
          "card_purchase",
          -41.08,
          5228.5,
          "AMAZON MKTPL*W8F8G8EDU Amzn.com/bill WA",
          null,
          "mcc 5942, card not present"
        ],
        [
          "2026-08-24T11:00:00Z",
          "ach_debit",
          -148.2,
          5080.3,
          "STATE FARM INSURANCE",
          null,
          "SEC PPD"
        ],
        [
          "2026-08-24T21:32:12Z",
          "card_purchase",
          -13.16,
          5067.14,
          "TIM HORTONS #2219 TOLEDO OH",
          null,
          "mcc 5814, contactless"
        ],
        [
          "2026-08-25T11:00:00Z",
          "ach_debit",
          -55.32,
          5011.82,
          "CITY OF TOLEDO DPU WATER",
          null,
          "SEC WEB"
        ],
        [
          "2026-08-27T12:23:59Z",
          "card_purchase",
          -15.12,
          4996.7,
          "MARCO'S PIZZA #1043 TOLEDO OH",
          null,
          "mcc 5814, card not present"
        ],
        [
          "2026-08-30T19:08:42Z",
          "card_purchase",
          -62.33,
          4934.37,
          "DOLLAR GENERAL #14873 TOLEDO OH",
          null,
          "mcc 5331, chip"
        ],
        [
          "2026-09-01T10:00:00Z",
          "ach_credit",
          612.4,
          5546.77,
          "LAKESHORE MED RET PLAN PENSION",
          null,
          "SEC PPD"
        ],
        [
          "2026-09-03T11:00:00Z",
          "ach_debit",
          -162.35,
          5384.42,
          "UHC MEDSUPP PREMIUM",
          null,
          "SEC PPD"
        ],
        [
          "2026-09-04T21:35:47Z",
          "card_purchase",
          -89.66,
          5294.76,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-05T13:00:39Z",
          "card_purchase",
          -50,
          5244.76,
          "HOLY ROSARY PARISH GIVING",
          null,
          "mcc 8661, card on file, recurring"
        ],
        [
          "2026-09-05T13:33:19Z",
          "card_purchase",
          -24.12,
          5220.64,
          "CVS/PHARMACY #04512 TOLEDO OH",
          null,
          "mcc 5912, chip"
        ],
        [
          "2026-09-05T19:09:54Z",
          "card_purchase",
          -32.79,
          5187.85,
          "SHELL OIL 57444012 SYLVANIA OH",
          null,
          "mcc 5542, chip"
        ],
        [
          "2026-09-06T13:09:22Z",
          "card_purchase",
          -21.06,
          5166.79,
          "BOB EVANS #0123 TOLEDO OH",
          null,
          "mcc 5812, chip"
        ],
        [
          "2026-09-07T18:27:02Z",
          "p2p_out",
          -50,
          5116.79,
          "P2P TO EMILY BRENNAN",
          "C02",
          "memo \"love you\""
        ],
        [
          "2026-09-07T20:21:49Z",
          "card_purchase",
          -23.47,
          5093.32,
          "TARGET 00012345 TOLEDO OH",
          null,
          "mcc 5310, chip"
        ],
        [
          "2026-09-08T14:33:19Z",
          "card_purchase",
          -62.01,
          5031.31,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-09T09:02:40Z",
          "card_purchase",
          -15.49,
          5015.82,
          "NETFLIX.COM",
          null,
          "mcc 4899, card on file, recurring"
        ],
        [
          "2026-09-09T10:00:00Z",
          "ach_credit",
          1947,
          6962.82,
          "SSA TREAS 310 XXSOC SEC",
          null,
          "SEC PPD"
        ],
        [
          "2026-09-09T14:41:44Z",
          "atm_withdrawal",
          -60,
          6902.82,
          "ATM WITHDRAWAL #0217 TOLEDO OH",
          null,
          "our ATM"
        ],
        [
          "2026-09-09T14:47:19Z",
          "card_purchase",
          -40.07,
          6862.75,
          "SPEEDWAY 03917 TOLEDO OH",
          null,
          "mcc 5542, chip"
        ],
        [
          "2026-09-09T20:02:32Z",
          "card_purchase",
          -53.52,
          6809.23,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-09T22:00:42Z",
          "card_purchase",
          -40.17,
          6769.06,
          "TIM HORTONS #2219 TOLEDO OH",
          null,
          "mcc 5814, contactless"
        ],
        [
          "2026-09-10T23:39:39Z",
          "card_purchase",
          -53.58,
          6715.48,
          "QVC*5521904417 WEST CHESTER PA",
          null,
          "mcc 5964, card not present"
        ],
        [
          "2026-09-11T12:48:22Z",
          "card_purchase",
          -16.3,
          6699.18,
          "TIM HORTONS #2219 TOLEDO OH",
          null,
          "mcc 5814, contactless"
        ],
        [
          "2026-09-12T08:10:45Z",
          "card_purchase",
          -62.18,
          6637,
          "VERIZON WIRELESS PAYMENTS",
          null,
          "mcc 4814, card on file, recurring"
        ],
        [
          "2026-09-12T13:32:28Z",
          "card_purchase",
          -87.14,
          6549.86,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-13T16:17:42Z",
          "card_purchase",
          -43.08,
          6506.78,
          "SPEEDWAY 03917 TOLEDO OH",
          null,
          "mcc 5542, chip"
        ],
        [
          "2026-09-13T18:28:10Z",
          "card_purchase",
          -20.08,
          6486.7,
          "DOLLAR GENERAL #14873 TOLEDO OH",
          null,
          "mcc 5331, chip"
        ],
        [
          "2026-09-14T17:59:58Z",
          "card_purchase",
          -34.5,
          6452.2,
          "ALDI 72031 TOLEDO OH",
          null,
          "mcc 5411, contactless"
        ],
        [
          "2026-09-15T14:22:34Z",
          "p2p_in",
          1200,
          7652.2,
          "P2P FROM SARAH WHITCOMB",
          "C03",
          "memo \"deposit + 1st month 3br\""
        ],
        [
          "2026-09-15T17:47:05Z",
          "transfer_out",
          -1200,
          6452.2,
          "RTP TO CRYPTO EXCHANGE x7720",
          "C01",
          "instant payment to linked account in customer's name"
        ],
        [
          "2026-09-16T11:00:00Z",
          "ach_debit",
          -126.93,
          6325.27,
          "TOLEDO EDISON AUTOPAY",
          null,
          "SEC PPD"
        ],
        [
          "2026-09-16T13:16:02Z",
          "card_purchase",
          -48.8,
          6276.47,
          "MEIJER #214 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-17T13:58:48Z",
          "p2p_in",
          850,
          7126.47,
          "P2P FROM DANA LARKIN",
          "C04",
          "memo \"apartment deposit\""
        ],
        [
          "2026-09-17T16:31:47Z",
          "transfer_out",
          -850,
          6276.47,
          "RTP TO CRYPTO EXCHANGE x7720",
          "C01",
          "instant payment to linked account in customer's name"
        ],
        [
          "2026-09-18T08:30:34Z",
          "card_purchase",
          -109.99,
          6166.48,
          "SPECTRUM",
          null,
          "mcc 4899, card on file, recurring"
        ],
        [
          "2026-09-18T21:12:26Z",
          "p2p_in",
          2000,
          8166.48,
          "P2P FROM TRAVIS BRANDT",
          "C05",
          "memo \"for the truck\""
        ],
        [
          "2026-09-18T22:51:40Z",
          "card_purchase",
          -74.71,
          8091.77,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-19T14:08:10Z",
          "p2p_out",
          -2000,
          6091.77,
          "P2P TO CAMERON ROWE",
          "C06",
          "memo \"DR 0919\"; first payment to this payee; scam warning shown, purpose chosen: paying a business"
        ],
        [
          "2026-09-19T20:34:22Z",
          "card_purchase",
          -74.11,
          6017.66,
          "MEIJER #214 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-21T11:00:00Z",
          "ach_debit",
          -33.27,
          5984.39,
          "COLUMBIA GAS OH AUTOPAY",
          null,
          "SEC PPD"
        ],
        [
          "2026-09-21T20:32:21Z",
          "card_purchase",
          -19.83,
          5964.56,
          "BOB EVANS #0123 TOLEDO OH",
          null,
          "mcc 5812, chip"
        ],
        [
          "2026-09-22T11:00:00Z",
          "ach_debit",
          -148.2,
          5816.36,
          "STATE FARM INSURANCE",
          null,
          "SEC PPD"
        ],
        [
          "2026-09-22T15:40:58Z",
          "mobile_deposit",
          1950,
          7766.36,
          "MOBILE DEPOSIT CHECK 10427",
          "C07",
          "business check drawn on Tollmere Pallet & Crate Co. at a bank in Atlanta GA; Reg CC exception hold (reasonable cause to doubt collectibility), funds held to 2026-09-30"
        ],
        [
          "2026-09-22T17:21:25Z",
          "card_purchase",
          -101.52,
          7664.84,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-22T19:20:16Z",
          "atm_withdrawal",
          -100,
          7564.84,
          "ATM WITHDRAWAL #0217 TOLEDO OH",
          null,
          "our ATM"
        ],
        [
          "2026-09-22T19:26:26Z",
          "p2p_in",
          1500,
          9064.84,
          "P2P FROM RAFAEL VALDEZ",
          "C08",
          "memo \"rent deposit 2br\""
        ],
        [
          "2026-09-22T20:02:05Z",
          "transfer_out",
          -1500,
          7564.84,
          "RTP TO CRYPTO EXCHANGE x7720",
          "C01",
          "instant payment to linked account in customer's name"
        ],
        [
          "2026-09-23T20:36:20Z",
          "card_purchase",
          -20.51,
          7544.33,
          "AMAZON MKTPL*7LHC826ZU Amzn.com/bill WA",
          null,
          "mcc 5942, card not present"
        ],
        [
          "2026-09-24T16:14:36Z",
          "p2p_in",
          2300,
          9844.33,
          "P2P FROM KEVIN MERCER",
          "C09",
          "memo \"invoice 2291\""
        ],
        [
          "2026-09-24T17:30:40Z",
          "p2p_out",
          -2300,
          7544.33,
          "P2P TO CAMERON ROWE",
          "C06",
          "memo \"DR 0924\""
        ],
        [
          "2026-09-25T10:00:00Z",
          "ach_credit",
          9460,
          17004.33,
          "CALLOWAY BEND OR VENDOR PMT",
          "C10",
          "SEC CCD; company entry description VENDOR PMT; addenda \"INV 20931 EQUIP\"; first ACH from this originator"
        ],
        [
          "2026-09-25T11:00:00Z",
          "ach_debit",
          -55.24,
          16949.09,
          "CITY OF TOLEDO DPU WATER",
          null,
          "SEC WEB"
        ],
        [
          "2026-09-25T14:30:49Z",
          "card_purchase",
          -63,
          16886.09,
          "AMAZON MKTPL*E84LL2R5D Amzn.com/bill WA",
          null,
          "mcc 5942, card not present"
        ],
        [
          "2026-09-25T18:18:37Z",
          "wire_out",
          -8900,
          7986.09,
          "OUTGOING WIRE FEDWIRE",
          "C11",
          "branch-initiated; beneficiary Varnell Ridge Supply LLC, account x8830 at a bank in Houston TX; OBI \"INV 3317 EQUIPMENT\""
        ],
        [
          "2026-09-25T18:18:54Z",
          "fee",
          -25,
          7961.09,
          "OUTGOING WIRE FEE",
          null,
          null
        ],
        [
          "2026-09-25T22:40:34Z",
          "card_purchase",
          -16.78,
          7944.31,
          "BOB EVANS #0123 TOLEDO OH",
          null,
          "mcc 5812, chip"
        ],
        [
          "2026-09-26T23:44:51Z",
          "p2p_in",
          975,
          8919.31,
          "P2P FROM LAUREN FENWICK",
          "C12",
          "memo \"frenchie deposit\""
        ],
        [
          "2026-09-27T19:25:04Z",
          "card_purchase",
          -107.27,
          8812.04,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-27T20:07:11Z",
          "card_purchase",
          -49.29,
          8762.75,
          "WAL-MART #2273 TOLEDO OH",
          null,
          "mcc 5310, chip"
        ],
        [
          "2026-09-27T22:19:51Z",
          "card_purchase",
          -72.56,
          8690.19,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-28T13:12:49Z",
          "transfer_out",
          -1510,
          7180.19,
          "RTP TO CRYPTO EXCHANGE x7720",
          "C01",
          "instant payment to linked account in customer's name"
        ],
        [
          "2026-09-28T13:19:09Z",
          "card_purchase",
          -41.13,
          7139.06,
          "MEIJER EXPRESS #214 TOLEDO OH",
          null,
          "mcc 5542, chip"
        ],
        [
          "2026-09-28T14:27:05Z",
          "card_purchase",
          -91.76,
          7047.3,
          "MEIJER #214 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-09-28T17:15:34Z",
          "card_purchase",
          -51.13,
          6996.17,
          "KOHL'S #0621 TOLEDO OH",
          null,
          "mcc 5651, chip"
        ],
        [
          "2026-09-29T10:30:00Z",
          "deposited_item_returned",
          -1950,
          5046.17,
          "RETURNED DEPOSIT ITEM CHECK 10427",
          "C07",
          "returned unpaid by the paying bank: reason N, altered/fictitious item"
        ],
        [
          "2026-09-29T10:30:00Z",
          "fee",
          -15,
          5031.17,
          "RETURNED DEPOSIT ITEM FEE",
          null,
          null
        ],
        [
          "2026-09-29T14:51:02Z",
          "wire_in",
          7500,
          12531.17,
          "INCOMING WIRE FEDWIRE",
          "C13",
          "Fedwire; originator Margaret E. Sorensen, Scottsdale AZ; OBI \"SHIPMENT CUSTOMS RELEASE\""
        ],
        [
          "2026-09-29T17:05:27Z",
          "transfer_out",
          -3000,
          9531.17,
          "RTP TO CRYPTO EXCHANGE x7720",
          "C01",
          "instant payment to linked account in customer's name"
        ],
        [
          "2026-09-30T12:16:11Z",
          "p2p_out",
          -2500,
          7031.17,
          "P2P TO MARCUS TEAGUE",
          "C14",
          "memo \"DR 0930\"; first payment to this payee; scam warning shown, purpose chosen: paying a business"
        ],
        [
          "2026-09-30T19:40:11Z",
          "p2p_in",
          2450,
          9481.17,
          "P2P FROM ANGELA HOLLOWAY",
          "C15",
          "memo \"deposit\""
        ],
        [
          "2026-09-30T20:10:51Z",
          "transfer_out",
          -2000,
          7481.17,
          "RTP TO CRYPTO EXCHANGE x7720",
          "C01",
          "instant payment to linked account in customer's name"
        ],
        [
          "2026-10-01T10:00:00Z",
          "ach_credit",
          612.4,
          8093.57,
          "LAKESHORE MED RET PLAN PENSION",
          null,
          "SEC PPD"
        ],
        [
          "2026-10-01T10:00:00Z",
          "ach_credit",
          6240,
          14333.57,
          "FENMOOR MILLWORK PAYMENT",
          "C16",
          "SEC CCD; company entry description PAYMENT; addenda \"PMT INV 7781\"; first ACH from this originator"
        ],
        [
          "2026-10-01T13:30:03Z",
          "p2p_out",
          -2450,
          11883.57,
          "P2P TO MARCUS TEAGUE",
          "C14",
          "memo \"DR 1001\""
        ],
        [
          "2026-10-01T13:51:30Z",
          "card_purchase",
          -13.17,
          11870.4,
          "MARCO'S PIZZA #1043 TOLEDO OH",
          null,
          "mcc 5814, card not present"
        ],
        [
          "2026-10-01T13:58:39Z",
          "card_purchase",
          -43.66,
          11826.74,
          "ALDI 72031 TOLEDO OH",
          null,
          "mcc 5411, contactless"
        ],
        [
          "2026-10-02T13:37:37Z",
          "card_purchase",
          -43.43,
          11783.31,
          "SHELL OIL 57444012 SYLVANIA OH",
          null,
          "mcc 5542, chip"
        ],
        [
          "2026-10-02T20:05:06Z",
          "fee",
          -25,
          11758.31,
          "OUTGOING WIRE FEE",
          null,
          null
        ],
        [
          "2026-10-02T20:05:10Z",
          "wire_out",
          -6180,
          5578.31,
          "OUTGOING WIRE FEDWIRE",
          "C11",
          "branch-initiated 13:52 local, held for callback, released 16:05; beneficiary Varnell Ridge Supply LLC, account x8830; OBI \"INV 3342\""
        ],
        [
          "2026-10-02T20:20:15Z",
          "card_purchase",
          -46.71,
          5531.6,
          "DOLLAR GENERAL #14873 TOLEDO OH",
          null,
          "mcc 5331, chip"
        ],
        [
          "2026-10-03T14:40:21Z",
          "card_purchase",
          -78.05,
          5453.55,
          "KROGER #0547 TOLEDO OH",
          null,
          "mcc 5411, chip"
        ],
        [
          "2026-10-03T15:20:39Z",
          "p2p_in",
          1800,
          7253.55,
          "P2P FROM JORGE PACHECO",
          "C17",
          "memo \"1st month + deposit\""
        ],
        [
          "2026-10-03T16:02:15Z",
          "transfer_out",
          -1800,
          5453.55,
          "RTP TO CRYPTO EXCHANGE x7720",
          "C01",
          "instant payment to linked account in customer's name"
        ],
        [
          "2026-10-04T13:56:53Z",
          "card_purchase",
          -29.87,
          5423.68,
          "AMAZON MKTPL*BKXNCMVF2 Amzn.com/bill WA",
          null,
          "mcc 5942, card not present"
        ],
        [
          "2026-10-05T11:00:00Z",
          "ach_debit",
          -162.35,
          5261.33,
          "UHC MEDSUPP PREMIUM",
          null,
          "SEC PPD"
        ],
        [
          "2026-10-05T13:00:58Z",
          "card_purchase",
          -50,
          5211.33,
          "HOLY ROSARY PARISH GIVING",
          null,
          "mcc 8661, card on file, recurring"
        ],
        [
          "2026-10-05T15:10:34Z",
          "card_purchase",
          -55.48,
          5155.85,
          "KOHL'S #0621 TOLEDO OH",
          null,
          "mcc 5651, chip"
        ],
        [
          "2026-10-05T18:36:53Z",
          "p2p_in",
          2500,
          7655.85,
          "P2P FROM BRIAN YATES",
          "C18",
          "memo \"for the car\""
        ],
        [
          "2026-10-05T19:10:04Z",
          "p2p_out",
          -2500,
          5155.85,
          "P2P TO CAMERON ROWE",
          "C06",
          "memo \"DR 1005\"; payee risk signal from the P2P network at send: elevated"
        ],
        [
          "2026-10-06T12:40:36Z",
          "p2p_in",
          1650,
          6805.85,
          "P2P FROM GRACE OSEI",
          "C19",
          "memo \"deposit\""
        ]
      ]
    },
    "reports_from_other_institutions": [
      {
        "received": "2026-10-02T21:40:00Z",
        "type": "P2P network scam claim",
        "from": "Rafael Valdez's bank (large national bank)",
        "about": "P2P credit of $1,500.00 on 2026-09-22 (C08)",
        "detail": "Sender says he paid a deposit on a 2-bedroom rental listed online; after he paid, the 'landlord' stopped answering and the house turned out to be occupied by its owner."
      },
      {
        "received": "2026-10-05T13:10:00Z",
        "type": "314(b) information request",
        "from": "Beneficiary bank for the 2026-09-25 and 2026-10-02 wires (Houston, TX)",
        "detail": "Varnell Ridge Supply LLC opened its account on 2026-08-27 and has since received $186,400 in wires from 9 institutions, most of it wired on to an account overseas within a day. The beneficiary bank has restricted the account and asks what we know about our customer's wires."
      },
      {
        "received": "2026-10-05T15:55:00Z",
        "type": "ACH request for return (R06) with letter of indemnity",
        "from": "ODFI for Calloway Bend Orthodontics PLLC (community bank, KS)",
        "about": "CCD credit of $9,460.00 on 2026-09-25 (C10)",
        "detail": "The originator paid an equipment vendor's invoice using new bank details received by email. The vendor never changed its details; the email came from a look-alike domain. Requests return of the funds."
      },
      {
        "received": "2026-10-05T19:20:00Z",
        "type": "P2P network scam claim",
        "from": "Lauren Fenwick's bank (credit union, GA)",
        "about": "P2P credit of $975.00 on 2026-09-26 (C12)",
        "detail": "Sender paid a deposit on a French bulldog puppy advertised online; the seller stopped responding and asked for more money for 'shipping insurance'."
      },
      {
        "received": "2026-10-06T12:15:00Z",
        "type": "Wire recall request",
        "from": "Originating bank (regional bank, Scottsdale, AZ)",
        "about": "Incoming Fedwire of $7,500.00 on 2026-09-29 from Margaret E. Sorensen (C13)",
        "detail": "The originator, 79, says a man she met online asked her to wire the money to release a shipment held at customs, and has since asked for more. Requests return of any funds remaining."
      },
      {
        "received": "2026-10-06T13:02:00Z",
        "type": "P2P network scam claim",
        "from": "Travis Brandt's bank (large national bank)",
        "about": "P2P credit of $2,000.00 on 2026-09-18 (C05)",
        "detail": "Sender paid a deposit on a pickup truck listed on an online marketplace; the seller stopped responding and the listing was removed."
      }
    ],
    "customer_contact": [
      {
        "ts": "2026-09-25T18:18:00Z",
        "channel": "Branch, wire desk (Sylvania Ave branch)",
        "note": "Customer requested an $8,900.00 domestic wire to Varnell Ridge Supply LLC. Purpose given: paying an equipment supplier for her fiancé's company; she showed an invoice on her phone. Asked how long she had known the company: 'about a month'. Standard scam-awareness questions read; customer said nobody was pressuring her. Wire sent after supervisor approval."
      },
      {
        "ts": "2026-09-29T15:20:00Z",
        "channel": "Phone, contact center",
        "note": "Customer asked why a $1,950.00 check was returned and a $15.00 fee charged. Said the check came from a client of her fiancé's business. Agent explained the paying bank returned it as an altered or fictitious item and that the amount and fee were taken back. Customer said she would let her fiancé know."
      },
      {
        "ts": "2026-10-02T17:52:00Z",
        "channel": "Branch, wire desk (Sylvania Ave branch)",
        "note": "Customer requested a $6,180.00 wire to the same beneficiary. She was on a phone call during the visit and read the beneficiary details from her phone. Held for wire operations review and callback; released 16:05 local after a callback to the phone on file."
      },
      {
        "ts": "2026-10-02T19:10:00Z",
        "channel": "Secure message from customer",
        "text": "Why is my wire being held? It is for my fiance Daniel's business. He is an engineer working on an offshore platform and his bank account is frozen until he gets back, so his clients pay him through my account and I send it to his suppliers. I met him in June on a dating site and we talk every day. He is a good man and his supplier is waiting. Please release it today."
      },
      {
        "ts": "2026-10-02T19:35:00Z",
        "channel": "Secure message from bank",
        "text": "Thank you for your message. Your wire was released at 4:05 PM after we verified it with you by phone. Please call us if you have any other questions."
      },
      {
        "ts": "2026-10-05T19:22:00Z",
        "channel": "Secure message from customer",
        "text": "Daniel says a client sent $2,500 today and his supplier needs it before Friday. Can you raise my P2P limit to $5,000 so I don't have to keep going to the branch for wires? Thank you, Carol"
      }
    ],
    "case_notes": [
      {
        "ts": "2026-10-06T14:20:00Z",
        "note": "Alert assigned. Account not restricted. No outreach to the customer yet; the 2026-10-05 secure message is unanswered."
      }
    ],
    "alert": {
      "alert_id": "AML-PT-2026-100611",
      "created": "2026-10-06T14:05:00Z",
      "scenario": "Pass-through activity / possible money mule",
      "status": "New",
      "rules_fired": [
        "PT-01 credits from others in 30 days at least 3x expected monthly deposits ($40,425.00 against $2,600)",
        "PT-02 all credits in 30 days at least 2.5x expected monthly deposits ($44,934.40 against $2,600)",
        "PT-04 8 or more first-time senders in 30 days (13)",
        "PT-05 80% or more of credits from others moved out within 48 hours (94%)",
        "PT-09 a sending institution reported an incoming credit as fraud or a scam (5)"
      ],
      "monitoring_model_score": 0.97,
      "last_30_days": {
        "window": "2026-09-06T14:05:00Z to 2026-10-06T14:05:00Z",
        "all_credits_usd": 44934.4,
        "pay_benefits_and_settlements_usd": 2559.4,
        "credits_from_others_usd": 40425,
        "credits_from_others_count": 13,
        "distinct_senders": 13,
        "first_time_senders": 13,
        "expected_monthly_deposits_usd": 2600,
        "credits_from_others_moved_out_within_48h_pct": 94,
        "out_by_p2p_usd": 11800,
        "out_by_external_transfer_usd": 11860,
        "out_by_wire_usd": 15080,
        "out_as_cash_usd": 160,
        "balance_at_end_usd": 6805.85
      }
    }
  },
  "questions": {
    "is_mule": {
      "type": "noul",
      "instructions": "Is this account being used as a money mule account, receiving money from other people and passing it on to someone else?"
    },
    "holder_role": {
      "type": "choice",
      "instructions": "Which best describes the account holder's part in the money moving through this account?",
      "criteria": {
        "complicit": "The account holder knowingly moves money for others, for example for a cut of each payment or by selling or renting out the account",
        "unwitting": "The account holder moves money for someone else without knowing it is criminal proceeds, for example after being recruited through a fake job offer or an online relationship",
        "not_in_control": "Someone other than the account holder controls the account, for example after an account takeover or because it was opened with a stolen identity",
        "no_mule_activity": "The account is not being used to move other people's money"
      }
    },
    "fraud_proceeds": {
      "type": "score",
      "instructions": "How likely is it that most of the money other people sent to this account came from victims of fraud or scams?",
      "criteria": [
        "Very unlikely (under 10%)",
        "Unlikely (10-40%)",
        "Uncertain (40-60%)",
        "Likely (60-90%)",
        "Very likely (over 90%)"
      ]
    },
    "action": {
      "type": "choice",
      "instructions": "What should the institution do with this account now?",
      "criteria": {
        "monitor": "Keep the account open without restrictions and continue normal monitoring",
        "restrict": "Restrict outbound transfers and cash withdrawals, and contact the customer about the activity",
        "close_and_refer": "Close the account and refer it to the BSA/AML team for a suspicious activity report"
      }
    }
  }
}