Account takeover recovery

How do we respond to an account takeover so the customer is re-verified, the credentials reset, the losses claimed and access restored in one case?

Run the response as one case from the alert or the report. Callvu locks what the policy says to lock, re-verifies the customer at a level that does not depend on the compromised channel, resets credentials and devices, finds the unauthorized activity across the account and starts the right claims (Reg E, card, wire, ACH), routes the fraud team's decisions, restores access when the checks pass, and records every step for the customer and the examiner.

In scopeComplex: multi-party handoffsCallvu moves: chase and verify, classify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 6, 2026.

The problem today

The customer is locked out, the fraud is still running, and three teams are working the same case without knowing it.

Today, without Callvu

A fraud alert fires, or a customer calls to say they cannot log in and money is gone. Digital banking support resets the password. The fraud team looks at the transactions. The disputes team opens a Reg E claim for some of them. The contact center changes the phone number back. Nobody owns the whole thing, and the customer tells the story four times.

The pieces have their own rules: identity verification that cannot rely on the channel the attacker controls; Reg E for the unauthorized electronic transfers, with its clocks; the card and wire processes for those losses; the Red Flags program for the address and credential changes the attacker made; and the bank's own policy on when access is restored and on what device.

Speed and order matter. Resetting a password before the attacker's device is removed, or restoring access before the contact details are verified, hands the account back to the attacker.

How it runs

From the requestto the system of record.

A fraud alert from the bank's monitoring, or a customer report in any channel, opens the case. Callvu locks what the policy says to lock and records the time.

Customer: Reports or is contacted, re-verifies on a secure channel, confirms what was and was not theirs, and receives access back.
Fraud team: Owns the case, decides the claims and the restoration in the Decision Desk.
Digital banking support: Executes credential and device resets from the case; does not decide.
Callvu: Locks, re-verifies, resets, finds the activity, starts the claims, routes decisions, restores and records.

Lock and classify
On the alert or report, Callvu applies the policy's immediate locks (online access, cards, outbound transfers, pending wires) and records the time. The case is classified by vector where known: credential phishing, SIM swap, malware, social engineering, or an insider.
Chase and verify the customer
The customer is re-verified at a level that does not depend on the compromised channel: not the phone number or email the attacker may have changed, but a verified document, a branch visit, or a previously registered secure channel under the bank's policy. The contact details changed during the attack window are shown and confirmed or reverted.
Reset and remove
Credentials are reset, all devices and sessions are removed, the attacker's registered devices and contact changes are reverted, and new credentials are issued only on the re-verified channel. Cards are reissued where the policy says.
Find the activity and start the claims
Callvu lists the activity in the attack window across the account (transfers, bill payments, card transactions, wires, new payees, address changes) and the customer marks what was not theirs. Each loss type starts its own claim from the case: the Reg E claim with the notice time, the card dispute, the wire recall, the ACH return, with their clocks.
Decide
The fraud team decides in the Decision Desk: liability on each claim under its rules, provisional credit, SAR filing, and when access is restored and on what device. Only the allowed outcomes are offered.
Restore and write back
Access is restored on the re-verified channel with new credentials, the customer is told what was done and what to expect, and the case with the vector, the locks, the resets, the claims and the decisions is written to the core and the fraud system.

Where it ends: The attacker is out, the customer is back in on a verified channel, every loss is in the right claim on its clock, and the case shows the order of events. The Decision Trace shows the classification and each decision; the Audit Trace shows every lock, reset and restoration with its time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

Reg E error resolution and liability (12 CFR 1005.11 and 1005.6): Unauthorized electronic fund transfers found in the attack window are errors under Reg E: the investigation clock runs from the customer's notice, provisional credit applies, and the consumer's liability is limited by the timing of the notice. A claim started from the takeover case carries that notice time.
FFIEC authentication and access guidance (Authentication and Access to Financial Institution Services and Systems, 2021): The bank's authentication is layered and risk-based, and recovery from a compromise re-verifies the customer through a channel the attacker does not control. The guidance expects controls on credential resets and on changes to contact information.
Identity Theft Red Flags rule (12 CFR 1022.90 and appendix J): Unusual access patterns, address and contact changes followed by transfers, and notifications of account takeover are red flags; the program's response includes monitoring, contacting the customer, changing credentials, closing or reopening accounts and notifying law enforcement.
BSA suspicious activity reporting (31 CFR 1020.320): An account takeover meeting the threshold is reported on a SAR within 30 days of detection; FinCEN's cyber-event advisory asks for the indicators the classification captures.

Company policies

The immediate locks on an alert or report are the bank's policy and run automatically.
Re-verification never relies on a contact detail changed in the attack window.
Devices and sessions are removed before new credentials are issued.
Each loss starts its own claim under its rules, from the case, with the notice time of the report.
Access is restored only by a fraud team decision, on the re-verified channel.
The fraud system is the system of record for the case; the core and the channel systems receive the resets and credits.

Controls

Immediate locks with time recorded.
Vector classification.
Out-of-band re-verification under policy.
Attack-window contact changes shown and reverted.
Device and session removal before reset.
Activity listing across the account with the customer's marks.
Claim starts with clocks per loss type.
Decision Desk control of restoration.

Clocks and deadlines

Locks: On the alert or report, immediately.
Reg E claims: From the notice time of the report: 10 business days, 45 days with provisional credit, 3 business days to report.
SAR filing: Within 30 calendar days of detection where the threshold is met.

Documents and checks

The alert or report with its time and the locks applied
The re-verification record and the channel used
The contact and device changes in the attack window, and their reversal
The activity list with the customer's marks
Each claim started, with its notice time and clock
The fraud team's decisions and the restoration record

In the Decision Trace

The vector classification and the locks it set.
The re-verification method and why it was independent of the compromised channel.
Each claim's liability decision.
The restoration decision and the device.

In the Audit Trace

Every lock, reset and removal with its time.
The customer contacts and verifications.
Each claim opened and its postings.
The restoration and the notice to the customer.

The handoff

Between the front doorand the back office.

The front door

A monitoring alert or the customer in any channel. Re-verification happens on a channel the attacker does not control, on process-controlled screens.

The back office

The fraud team owns one case; support executes resets from it; disputes run from it. The customer tells the story once.

The Decision Desk

The fraud team decides each claim, the SAR and the restoration in the Decision Desk with the case and only the allowed outcomes.
A restoration request before re-verification is blocked, not escalated.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Banca Transilvania automated more than 100 workflows with Callvu.

BNK-04

Bank Leumi digitized all loan application and servicing workflows within six months, and dozens more processes since.

BNK-01

Questions

What buyers ask next,answered plainly.

How is the customer re-verified?

Through a channel the attacker does not control, under the bank's policy: a verified document, a branch visit or a previously registered secure channel. Never the phone number or email changed in the attack window.

What happens to the money that was taken?

Each loss starts its own claim from the case: Reg E for electronic transfers, the card dispute, the wire recall, the ACH return, each with its clock from the report's notice time.

When does the customer get access back?

When the fraud team decides it in the Decision Desk, after re-verification and the device and credential resets, on the re-verified channel.

Related processes

Address and contact information change Debit card and EFT disputes Wire recall and fraud claims Try it in the sandbox All banking and credit unions processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.