Back to decisions
REVIEWdec_84287 · 167ms

Ethan Brooks

Card change · Payment method update · Visa •••• 7742

Confidence

88%

Risk score

82 / 100

Decision explanation

The card change follows a classic account-takeover sequence.

A new session changed recovery credentials before adding a high-risk payment instrument.

Positive signals

Account age: 2.1 years
No prior chargebacks
Email address unchanged

Risk signals

Impossible travel in 46 minutes
Recovery phone changed
New device + new IP
Card linked to disputed accounts
Correlation insightThe sequence matches 23 historical takeover cases; the linked card is the strongest risk contributor.

Policy evaluation

Account Takeover Prevention

Version v5.1 · Published by Identity & Access

policy.rule

IF recovery.changed_minutes < 10

AND payment.linked_disputes > 0

AND risk.score > 80

THEN require_review

$8,000

amount

0.2 hrs

device age

87

risk score

Events timeline

What happened before this decision

Unified from first-party events and connected vendors

Login succeeded

New Windows device · Warsaw

Recovery phone changed

Trusted number removed

New card added

Linked to 2 disputed accounts

Card change requested

Set as default payment method

Trust decision generated

Review · 88% confidence · 167ms