TNG RiskOps Agent

Account takeover operations workspace

21 active investigationsSeeded environment
seed demo-core-v2Seeded demo. Analyst override stays available.

Live ATO cluster

This is an operator surface. Scan the signal, rank the queue, open the case.

21/5 expected30 min window
Cluster lift
4.2x
MY logins -> transfer-enabled wallets
18 new-device logins
Signal is visible in ranking only. Final action still follows evidence and policy.
9 PIN resets
Signal is visible in ranking only. Final action still follows evidence and policy.
6 high-value transfer attempts
Signal is visible in ranking only. Final action still follows evidence and policy.

Investigation queue

Dense rows, less chrome, stronger hierarchy.

3 visible
CaseUserSignalsStateScoreNext action
CASE-ATO-001
Account Takeover
A*** H****
PENDING USER
New devicePIN resetBeneficiary added
CRITICAL
Freeze Applied
92
PENDING USER
Freeze AccountOpen
CASE-ATO-008
Account Takeover
N*** R****
ACTION APPLIED
Dormant loginNew payeeFailed step-up
HIGH
Step Up Required
79
PENDING USER
Step Up VerificationOpen
CASE-UTX-204
Unauthorized Transaction
S*** A****
INVESTIGATING
New deviceLinked prior caseBeneficiary change
HIGH
Review Pending
71
ESCALATED
EscalateOpen

Queue summary

Keep the right rail useful, not decorative.

Open cases3
Auto-actions ready2
Pending user2
Transfers stopped2
Restores the seeded queue and clears stale Twilio/demo runtime state.

Action ladder

Users should understand the consequence of the score immediately.

BandOutcomeMeaning
0-69AllowNo hold
70-84Step Up VerificationPause and verify
85-100Freeze AccountStop movement