TNG RiskOps Agent

Account takeover operations workspace

21 active investigationsSeeded environment
seed demo-core-v2Seeded demo. Analyst override stays available.

CASE-UTX-204 | S*** A****

High-volume wallet | Wallet MY-8890 | Johor Bahru

Score
71
Recommendation
Escalate
Prompt
Failed
Resolution
Escalated

What happened

Timeline first. Then what was attempted. Then what is still missing.

TimeEventResult
10:58
Login from new device
New Samsung device first seen
Completed
11:11
Beneficiary edited
Payout details changed before payment
Completed
11:14
Payment succeeded
Unauthorized transaction suspected
Completed
Suspicious actions
Payment succeeded | MYR 1,240
Requires escalation and case note handoff
Missing data
No confirmed customer statement yet.

Why this case is high-risk

Keep the proof tight. Facts first, interpretation second, network signals after that.

Facts
Beneficiary changed before payment.
Customer report is still pending callback.
Analyst assessment
Potential follow-on loss after takeover. Analyst review still needed.
Session changes
Account
Beneficiary change at 11:11
Device
New Samsung device at 10:58
IP signalGeo / ASNFlagsLinked cases
103.21.244.88
Anonymous proxy route
Same network cluster also appears in the severe ATO seed, suggesting shared infrastructure.
Johor Bahru, MY
AS135391 Secure Transit Cloud
CRITICALBlocked
CASE-UTX-204, CASE-ATO-001
219.95.44.201
Prior normal broadband
The customer's recent good sessions used this IP family, not the current proxy route.
Johor Bahru, MY
AS9534 Maxis Broadband
LOWAllowlisted
CASE-UTX-204

Evidence register

Move the bulky cards into a proper table so operators can scan source and policy coverage faster.

EvidenceKindSourcePolicy
New Samsung device
Device first seen today.
FACT
behavior_events
2026-04-25T10:58:00+08:00
POL-OPS-05
Linked prior case
Device fingerprint overlaps with prior case history.
FACT
entity_edges
2026-04-25T11:00:00+08:00
POL-OPS-05
Follow-on unauthorized transaction policy
Escalate when funds may already have left and customer contact is incomplete.
POLICY
policy_engine
2026-04-25T11:15:00+08:00
POL-OPS-05
Proxy-backed payment path
The payment came from a blocked proxy route instead of the customer's known-good IP family.
FACT
network_graph
2026-04-25T11:12:00+08:00
POL-OPS-05

Decision rail

Recommended action
Escalate
61%
Possible loss already occurred. Escalate with a complete evidence pack and keep override visible.
Customer prompt
Failed
We are reviewing unusual activity. Please contact support.
Latest audit
Analyst opened case for manual investigation.
Nora Lee | 2026-04-25T11:16:00+08:00
Human override