Right password. Whose withdrawal?
Review a sensitive sequence, not just a successful login.
A returning customer signs in successfully on an unfamiliar device, changes a recovery detail and requests a withdrawal. The fictional platform has an approved step-up verification process for sensitive changes. Decide how to use it.
Fictional scenario · Synthetic data · No real customer records- account history
- 18 months
- change to withdrawal
- 3 minutes
- device reference
- New
What would
you look at?
Open at least two files before making a decision. You can read every file.
0 of 3 files opened
A useful definition01 / Account timelineAccount continuity+
The account has eighteen months of ordinary activity. The new session changes a recovery email and then adds a new withdrawal destination. A successful password check confirms knowledge of a credential, not necessarily continuity of the person.
The sequence of sensitive actions deserves more attention than an unfamiliar device alone.
02 / Support historyCustomer context+
There is no prior notice of a destination change. The customer might still have a legitimate reason. Approximate location differs from recent sessions, but travel, mobile routing or a VPN could explain that difference.
A plausible benign explanation is not proof of safety; an unusual location is not proof of takeover.
03 / Approved runbookRecovery controls+
The runbook allows a temporary pause on the withdrawal and verification using a previously established trusted factor. It says not to rely solely on the recovery detail that was just changed. Failed verification escalates to the account-recovery team.
Use a trusted verification route rather than letting the potentially changed channel vouch for itself.
Make the call.
Leave your reasoning.
Choose what you would do under this scenario’s assumptions. Your notes stay in this browser. Do not enter real customer information.
The trade-off
Still unknown
Whether the real account holder initiated the session and whether their established verification factors remain secure.
A useful handoff
Record the sensitive sequence, the verification route, the hold owner and the recovery path. Never include credentials in the case notes.
Completion records participation, not competence or certification. You can change your answer and compare again.
Further reading
OWASP / Authentication Cheat SheetReference checked 5 November 2026. The scenario, runbook and debrief are original Antifrog teaching material; the source does not endorse them.