## TL;DR
Account takeover is the pattern that cannot wait for a queue. Carve it a dedicated paging path: takeover signals bypass review entirely and page on-call directly, with the runbook attached. If the page gets no ack, it escalates up the chain instead of dying. Test it with a synthetic takeover drill every month and review page latency in the weekly ops review.

```text
fraud agent failed to page on-call for account takeover pattern
```

## Use this when
- Takeover signals sit in a review queue for hours.
- The agent treats account takeover like any other flag in the batch.
- On-call learns about takeovers from customers, not from the agent.

## Not for this skill when
- The signal never fired. That is detection coverage, not paging.
- The page went out but on-call missed it. That is a paging-service problem.

## Steps
1. Carve account takeover out of the general queue: matching signals page on-call directly with critical severity. Verify: a synthetic takeover pattern pages within one minute.
2. Attach the runbook to the page: the evidence, the account, and the lockout action the agent already prepared. Verify: the page includes a one-tap lockout link and the account identifier.
3. Build the escalation chain: no ack in five minutes pages the secondary, then the manager. Verify: a staged no-ack walks the full chain.
4. Run a monthly synthetic takeover drill and log page latency. Verify: drill records show sub-minute paging three months running.

## Variant phrasings
### account takeover not paging oncall
Urgency phrasing.
### takeover alert missed by fraud agent
Acronym-free phrasing.
### takeover pattern no page sent
Signal phrasing.

Compatibility: Fits PagerDuty, Opsgenie, or any paging service. The dedicated-path pattern works alongside normal queue review.

## Why it happens
Everything funnels through one queue with one SLA, so the highest-urgency pattern waits behind routine flags. Paging feels too loud for a system tuned to batch review, until the takeover succeeds.

## Edge cases / pitfalls
- Takeover definitions drift. Review the pattern quarterly against confirmed takeovers.
- Page storms during credential-stuffing waves need per-account cool-off, not per-signal paging.
- The lockout action needs an undo path. Wrong-account lockouts happen.
- Keep the drill synthetic markers out of production metrics, or the drill pollutes the real incident counts.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_nFgxw_oj0gdP-kA8E5ae7w