prompts.chatprompts.chat
Login
All classifiers
NoulSecurity signals

Account takeover signal

Flag messages describing signs that someone else accessed or used a customer's account.

F@f

Limits to keep in mind

Not a fraud detection system. Use it to route messages, alongside your security tooling.

Problem

Reports of account takeover arrive as billing questions ("what is this charge?") or login problems, and sit in ordinary queues while an attacker still has access.

Goal

Send possible takeovers to a security-trained person quickly, without exposing account details in the reply.

Input / state

The customer's message and recent account security events.

message
The customer's message.
security_events
Recent password, email, MFA and login-location changes from your logs.

Decision question

NoulQuestion key takeover_signal

Does this message, with these account events, describe signs that someone other than the customer accessed or used the account?

What counts as yes and no

  • trueDescribes unrecognized logins, changes, purchases or messages, or being locked out after a change they didn't make.
  • falseDescribes the customer's own actions, ordinary questions, or problems with no sign of someone else.

Allowed outcomes

Decided in your code from the answer and its confidence. Thresholds are yours to set and test.

  • Security teamProbability of yes is above your upper threshold.
  • Possible signalProbability falls between your two thresholds.
  • Continue normal flowProbability of yes is below your lower threshold.

Example scenarios

Predefined demonstrations. No model is called; the outcome shown is an illustrative judgment.

Example state

{
  "message": "I can't log in and I just got an email saying my address was changed. I didn't do that.",
  "security_events": [
    "email changed 2h ago",
    "new login from unfamiliar country"
  ]
}

Outcome

Illustrative
Security team

Probability of yes is above your upper threshold.

Why

An account change the customer didn't make.

Using it well

  • Set a low upper threshold: a false alarm costs a security review; a missed takeover costs much more.
  • Never confirm account details or recent activity in an automated reply; the person writing may be the attacker.
  • This is a triage signal. Locking accounts and verifying identity belong to your security process.

Request definition

POST https://api.typesafe.ai/v1/systemone
{
  "model": "jev-latest",
  "state": {
    "message": "<message>",
    "security_events": "<security_events>"
  },
  "questions": {
    "takeover_signal": {
      "type": "noul",
      "instructions": "Does this message, with these account events, describe signs that someone other than the customer accessed or used the account?",
      "criteria": {
        "true": "Describes unrecognized logins, changes, purchases or messages, or being locked out after a change they didn't make.",
        "false": "Describes the customer's own actions, ordinary questions, or problems with no sign of someone else."
      }
    }
  }
}

Request shape from the System One API reference; a Kev server accepts the same body. Replace the placeholder state with your data. Requests need your own API key or server.

Version History

v1Current Versionabout 8 hours ago@f

Initial version

Comments (0)