Account Takeover Monitoring Agent

Account takeovers often unfold in minutes: a contact change, a password reset, then a new payee and a transfer. This agent watches logins and profile changes for these chains. When one appears, it pulls the recent events and the customer's history, checks whether the customer has done similar things before and whether each change came through a verified channel, and scores the chain. Events from known devices lower the risk. For high-risk chains it proposes a step-up check or temporary payment hold and drafts a verification message. Analysts approve holds and outreach. It then checks whether the customer verified through a trusted channel. If not within 24 hours, it escalates the case. Edge case: a customer replaces a phone and resets the password, a normal pattern, but no payee was added, so risk stays low.