case_ref,account_ref,device_ref,event_type,known_outcome,is_new_device,emulator_detected,hooking_detected,remote_control_app,datacenter_asn,proxy_vpn,impossible_travel,recent_password_reset,mfa_or_recovery_changed,after_credential_event,recent_payout_change,seconds_since_login,rushed_sensitive_action,scripted_navigation,velocity_spike,time_to_cashout_seconds,shared_payout_cluster,device_account_count,notes
CASE-01,ACC-A,DEV-1,login,fraud,yes,no,no,no,no,yes,yes,yes,no,yes,no,,no,no,no,,no,3,Login from new device after reset; customer later reported ATO
CASE-02,ACC-B,DEV-2,withdrawal,clean,no,no,no,no,no,no,no,no,no,no,no,1800,no,no,no,,no,1,Regular monthly withdrawal by long-standing customer
CASE-03,ACC-C,DEV-3,withdrawal,disputed,no,no,no,no,yes,no,no,no,no,no,yes,90,yes,no,yes,240,yes,2,Payout changed then rapid cashout; team split on verdict