Tracingasuspectedaccounttakeover.
From unusual access to a documented fraud-review escalation.
Example · Based on Erik’s documented responsibilities. The scenario, transactions, timeline, evidence and outcome are illustrative—not an actual case or employer result.
01 / In my own words
“Investigated unusual ACH/P2P activity and potential account takeover patterns; reconciled conflicting details, documented supporting facts, and escalated matters requiring further review.”
Guidehouse · BSA/AML Analyst, Global Investigations & Compliance · Sep 2024 — Sep 2025
02 / Example scenario
A synthetic account shows credential changes and two outbound P2P payments from a new device. Inspired by the account-takeover review duties described in Erik’s Green Dot résumé entry—not a case he actually handled.
The focus is the review process: reconcile the money, compare access and payment records, verify the customer through a trusted channel, and document the next step.
- Incoming
- $3,000
- Outgoing
- $2,850
- Remaining
- $150
03 / Money-flow map
Illustrated opening balance: $0. Payroll adds $3,000; two transfers remove $2,850; $150 remains. Access changes are shown for context, not as money movements.
04 / Timeline
Day 1 · 09:00
$3,000 payroll credit; illustrated opening balance is zero.
Day 2 · 01:52
Password reset from an unrecognized device.
01:55
Contact phone number changed.
02:03–02:09
Two newly added payees receive $1,500 and $1,350.
08:40
Verified cardholder reports loss of access and denies both payments.
05 / Evidence reviewed
Device & access history
Synthetic logs show a first-seen device immediately before contact changes and transfers. A new device alone would not establish fraud.
Payment reconciliation
$3,000 credited; $2,850 transferred to two new payees; $150 remains. No recovered amount is assumed.
Customer verification
In this example, the cardholder is verified through a trusted channel and denies the activity. The changed phone number is not used as the verification channel.
Review record
A Unit21-style record preserves timestamps, payment references and the verified statement. Receiving accounts require separate review; their holders are not assumed guilty.
06 / Analyst reasoning
- 01Evaluate the sequence of access, contact changes and payments rather than relying on one device indicator.
- 02A verified denial supports suspected unauthorized access; record the facts and any remaining uncertainty.
- 03Preserve evidence and route the fraud claim and receiving-account concerns under policy.
07 / Example outcome
Escalate to fraud review
Illustrative outcome: escalate for fraud review, recommend access protection under procedure and preserve payment records for a claim and possible recovery. No actual customer loss, reimbursement or employer outcome is claimed.
The reviewer documents a suspected pattern—not a determination of criminal conduct. Any claim, recovery or account action requires the authorized team’s decision.