All notes
Cyber / 2025-06-16
What an exchange wants in an account takeover
A support-chat screenshot is not a chronology. The venue wants a court-ready event tape.
IP, device, 2FA change, outbound transfers, mail from the new email. In that order.
The faster the file reaches the compliance channel, the higher the chance of a hold. ‘We will send the rest later’ usually means refusal.
After a partial return the account still has to be re-segmented. Otherwise the story repeats.