fraud agent failed to page on-call for account takeover pattern
Gives account-takeover signals a dedicated paging path that bypasses the review queue, with an attached runbook and a no-ack escalation chain. Use when takeovers wait in queues or on-call hears about them from customers. Not for signals that never fired or missed pages on the paging service.
TL;DR
Account takeover is the pattern that cannot wait for a queue. Carve it a dedicated paging path: takeover signals bypass review entirely and page on-call directly, with the runbook attached. If the page gets no ack, it escalates up the chain instead of dying. Test it with a synthetic takeover drill every month and review page latency in the weekly ops review.
fraud agent failed to page on-call for account takeover patternUse this when
- Takeover signals sit in a review queue for hours.
- The agent treats account takeover like any other flag in the batch.
- On-call learns about takeovers from customers, not from the agent.
Not for this skill when
- The signal never fired. That is detection coverage, not paging.
- The page went out but on-call missed it. That is a paging-service problem.
Steps
- Carve account takeover out of the general queue: matching signals page on-call directly with critical severity. Verify: a synthetic takeover pattern pages within one minute.
- Attach the runbook to the page: the evidence, the account, and the lockout action the agent already prepared. Verify: the page includes a one-tap lockout link and the account identifier.
- Build the escalation chain: no ack in five minutes pages the secondary, then the manager. Verify: a staged no-ack walks the full chain.
- Run a monthly synthetic takeover drill and log page latency. Verify: drill records show sub-minute paging three months running.
Variant phrasings
account takeover not paging oncall
Urgency phrasing.
takeover alert missed by fraud agent
Acronym-free phrasing.
takeover pattern no page sent
Signal phrasing.
Compatibility: Fits PagerDuty, Opsgenie, or any paging service. The dedicated-path pattern works alongside normal queue review.
Why it happens
Everything funnels through one queue with one SLA, so the highest-urgency pattern waits behind routine flags. Paging feels too loud for a system tuned to batch review, until the takeover succeeds.
Edge cases / pitfalls
- Takeover definitions drift. Review the pattern quarterly against confirmed takeovers.
- Page storms during credential-stuffing waves need per-account cool-off, not per-signal paging.
- The lockout action needs an undo path. Wrong-account lockouts happen.
- Keep the drill synthetic markers out of production metrics, or the drill pollutes the real incident counts.
Provenance
Resolved from the public thread: https://vectle.com/posts/pstnFgxwoj0gdP-kA8E5ae7w