Account takeover report

How do we take an account takeover report once, lock the account, verify the true owner, and route recovery to the fraud team with every step on the record?

Lock first, verify second, recover third, and keep every step. When a customer reports a takeover (a SIM swap they did not ask for, a port they did not approve, a password or address changed, lines added), Callvu captures the report once from any channel, classifies the takeover type and the damage, locks the account at once against further SIM changes, ports, credential changes and orders, verifies the true owner with a secure method and the documents the policy requires (an identity document check, a selfie match, a callback to a contact predating the compromise), chases the evidence of the compromise from the systems (the change history, the channels, the devices, the employee identifiers), routes the recovery decisions to the fraud team in the Decision Desk, reverses the changes and restores the lines in the BSS, the system of record, and writes the case with every step and the required notifications. Live at AT&T.

Live at AT&TComplex: multi-party handoffsCallvu moves: classify, chase and verify, decide, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The victim called three times, was asked three times to prove who they were, and the fraudster added two lines while the second call was on hold.

Today, without Callvu

A takeover victim is in the worst position to prove their identity: their phone number is gone, their email may be compromised, and the account's contact details were changed by the fraudster. The carrier's process asks them the same questions the fraudster already passed. Meanwhile the account stays open to further changes, and each call creates a new ticket.

The CPNI rules require the carrier to notify the customer of account changes and to keep records of breaches; the SIM swap and port-out rules require locks, notifications and records; the carrier's fraud program defines the recovery steps and who decides them. The lock must come before the verification, because the verification takes time the fraudster uses. The record must show every step, because the victim's bank and the regulator will ask.

A takeover handled as one case with a lock on the first minute is a takeover that stops.

How it runs

From the requestto the system of record.

A customer reports a takeover in any channel (a call from another phone, the website, a store, an AI assistant), or the carrier's monitoring flags one. Callvu opens one case on the account.

Victim (the true account holder): Reports once, verifies identity through the secure path, and receives the recovery steps and the notifications.
Agent: Captures the report and sees the case, never the verification data.
Fraud team: Decides the recovery steps in the Decision Desk and owns the case.
Callvu: Captures, classifies, locks, verifies, chases evidence, routes, reverses in the BSS and records.

Classify and lock
The report is captured once (what happened, when the phone went dark, what changed, what the victim has noticed elsewhere) and classified by takeover type (a SIM swap, a port-out, a credential change, an address or contact change, lines or devices added, a store or online channel) and by damage; the account is locked at once against SIM changes, port-outs, credential changes, authorized user changes and orders, and a port in progress is held.
Chase and verify the true owner
The victim verifies identity through the secure path for a compromised account: an identity document captured and checked on a secure screen with a liveness and selfie match, a callback to a contact on file that predates the compromise, the account's historical details, or an in-store check; the evidence of the compromise is chased from the systems (the change history with the channel, the device and the employee identifier, the authentication records, the order history, the new SIM and device identifiers) and attached to the case.
Decide the recovery
The fraud team decides in the Decision Desk with the classification, the verification and the evidence, and only the allowed outcomes for each element: reverse the SIM change and reissue to the victim, reclaim the ported number with the other carrier, reset the credentials and the contacts to the verified owner, remove the added lines and devices with the charges credited, refer the employee channel where one was used, and keep or lift the lock.
Write back and notify
The reversals and the restorations are written to the BSS, the system of record, and to billing; the victim receives the recovery confirmation, the new credentials through the secure path, and the notifications the rules require; a breach notification to law enforcement and the customer follows the CPNI breach rules where the facts meet them; the case with every step, decision and person is retained, and the pattern is fed to the fraud controls.

Where it ends: The account was locked in the first minute, the true owner verified through a path the fraudster cannot pass, the compromise evidenced, the recovery decided by the fraud team and written to the BSS, and the case shows every step. The Decision Trace shows the classification, the verification and each decision; the Audit Trace shows the report, the lock, the evidence and the reversals with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

FCC CPNI rules (47 CFR 64.2010 and 64.2011): A carrier must authenticate before account access and notify the customer of account changes; on a breach of customer proprietary network information the carrier must notify the United States Secret Service and the FBI within seven business days of a reasonable determination of the breach (and the FCC, under the 2024 rule), and the customer after the law enforcement period, keeping a record of the breach and the notifications for two years; the takeover case supplies the facts and the dates.
FCC SIM swap and port-out rules (47 CFR 64.2010(h) and 64.1120(e)): Carriers must offer account locks, notify customers of SIM change and port-out requests, keep records of the requests and the authentications, and must have procedures to respond to failed authentication attempts and to customer reports of fraudulent SIM changes and ports; the recovery includes reclaiming a fraudulently ported number through the inter-carrier process.
Carrier fraud program and the identity verification standards (the NIST SP 800-63 identity proofing levels; the carrier's policy): The program sets the compromised-account verification path (document and liveness checks, historical data, in-store verification), the recovery authorities, the credits, the employee referral rules and the retention; the verification path meets an assurance level that does not rely on the data the fraudster holds.

Company policies

One case per takeover; the account is locked before anything else is asked.
The victim is verified through a path that does not rely on the data the fraudster holds, never re-asked the questions that were passed.
Recovery steps are decided by the fraud team with the evidence, and each is written to the BSS.
The case with every step, decision and person is retained; the BSS is the system of record for the account.

Controls

Single case capture from any channel.
Takeover classification and immediate lock.
Compromised-account verification path.
Evidence pull from change and authentication records.
Decision Desk recovery decisions per element.
BSS and billing reversals, notifications, breach handling and retention.

Clocks and deadlines

Lock: At the report, before verification.
Law enforcement breach notification: Within seven business days of the determination where the CPNI breach rules apply.
Number reclaim: The inter-carrier process's timing from the fraud team's decision, tracked on the case.

Documents and checks

The report and the classification
The lock record
The verification evidence
The compromise evidence from the systems
The recovery decisions, the BSS reversals and the notifications

In the Decision Trace

The classification and the lock.
The verification path and its result.
Each recovery decision and the person.

In the Audit Trace

The report with channel and time.
The lock with time.
Each reversal, notification and breach step with time.

The handoff

Between the front doorand the back office.

The front door

Any channel, including a call from another phone or a store visit; the verification on a secure screen the agent never sees.

The back office

The fraud team owns the case from the lock and decides each recovery step; agents capture once.

The Decision Desk

Every recovery element (reverse the SIM, reclaim the number, reset credentials, remove lines, refer the channel, lift the lock) goes to the fraud team in the Decision Desk with the evidence and only the allowed outcomes.

Proof

Live at AT&T.Published results only.

Each result is a published claim, with its code on agents.callvu.com, where its status, source and last verified date are kept.

AT&T runs close to 100 processes on Callvu, including transfers of billing responsibility, port-outs, line separations, SIM changes, activations, payment arrangements, billing, prepaid and top-ups, collections, account takeover reports, authorized user changes, device financing agreements and business account onboarding.

TEL-02 · Self-asserted · verified 2026-11-05

At AT&T Business, Callvu worked inside the existing contact center platform with no changes to internal processes.

ATT-03 · Customer-attested · verified 2026-11-02

Every run produces a Decision Trace (why each AI action was allowed) and every workflow execution an Audit Trace (the chronological governance record).

ENF-03 · Self-asserted · verified 2026-11-02

Callvu classifies each request into a unit of work (work type, skill, effort, due date) the moment it lands.

HND-02 · Self-asserted · verified 2026-11-02

Questions

What buyers ask next,answered plainly.

What happens first?

The account is locked against SIM changes, ports, credential changes and orders the moment the report is captured, before the victim is asked to prove anything.

How does the victim prove who they are?

Through a path the fraudster cannot pass: an identity document with a liveness check on a secure screen, a callback to a contact that predates the compromise, historical account details, or an in-store check.

Who decides the recovery?

The fraud team in the Decision Desk, element by element, with the evidence; each reversal is written to the BSS and the case keeps every step.

Related processes

SIM change and eSIM transfer Port-out request and PIN reset Identity theft and fraudulent account claim Law enforcement and subpoena requests Try it in the sandbox All telecom processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.