TNG RiskOps Agent

Account takeover operations workspace

21 active investigationsSeeded environment
seed demo-core-v2Seeded demo. Analyst override stays available.

CASE-ATO-008 | N*** R****

Dormant wallet | Wallet MY-2191 | Penang

Score
79
Recommendation
Step Up Verification
Prompt
Simulated
Resolution
Pending User

What happened

Timeline first. Then what was attempted. Then what is still missing.

TimeEventResult
15:18
Dormant wallet reactivated
First login in 63 days
Completed
15:22
New payee added
Same session as reactivation
Completed
15:24
Step-up required
Challenge failed twice
Blocked
Suspicious actions
Top-up attempt | MYR 1,900
Held pending verification
Missing data
Customer has not completed re-login yet.

Why this case is high-risk

Keep the proof tight. Facts first, interpretation second, network signals after that.

Facts
Wallet inactive for 63 days.
Step-up challenge failed twice.
Analyst assessment
Behavior is suspicious but not yet severe enough for auto-freeze.
Session changes
Account
New payee added at 15:22
Device
Login from new iPhone device
IP signalGeo / ASNFlagsLinked cases
45.126.112.7
Commercial VPN egress
First-seen wallet reactivation came through a VPN path not present in prior good logins.
Penang, MY
AS138997 EdgeNet Transit
HIGHWatch
CASE-ATO-008
118.101.92.15
Known-good historical broadband
Customer's last good session used this home broadband IP, not the current VPN route.
Penang, MY
AS4788 Telekom Malaysia
LOWAllowlisted
CASE-ATO-008

Evidence register

Move the bulky cards into a proper table so operators can scan source and policy coverage faster.

EvidenceKindSourcePolicy
Dormant wallet reactivated
No user activity for 63 days before this login.
FACT
wallet_activity
2026-04-25T15:18:00+08:00
POL-ATO-02
Step-up challenge failed
Two consecutive re-login challenges failed.
FACT
auth_events
2026-04-25T15:24:00+08:00
POL-ATO-02
New payee added
New payee created before attempted top-up.
FACT
beneficiary_events
2026-04-25T15:22:00+08:00
POL-OPS-02
VPN-backed login path
The reactivated session came from a VPN egress path rather than the user's known-good broadband IP.
FACT
network_graph
2026-04-25T15:19:00+08:00
POL-ATO-02

Decision rail

Recommended action
Step Up Verification
67%
Hold the wallet at step-up rather than freeze. Keep the human override visible.
Customer prompt
SimulatedAwaiting replySeeded demo prompt
This case is still carrying a seeded demo prompt. Twilio did not send that original message.
We noticed unusual account activity. Please complete relogin in Touch 'n Go.
Latest audit
WhatsApp re-verification prompt simulated in seeded demo mode.
PromptService | 2026-04-25T15:25:00+08:00
Step-up verification recommended.
PolicyEngine | 2026-04-25T15:24:30+08:00
Human override