{"manifest":{"system":"PayProof AI","version":"0.1.0","exported_at":"2026-09-19T18:13:12.737747","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","case_number":"DEMO-C-BEC-ATTACK","audit_chain_integrity":"VALID","dossier_sha256":"ed5cdce6698a1866f62d2745c66aed1ab07569cc01e10df4b311335ca077e139"},"case":{"id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","case_number":"DEMO-C-BEC-ATTACK","vendor_id":"VEND-APEX-001","vendor_name":"Apex Logistics Corp","invoice_reference":"INV-URGENT-999","amount":"49500.00","currency":"USD","state":"HELD","created_by":"analyst","created_at":"2026-09-19T18:13:12.669554Z","updated_at":"2026-09-19T18:13:12.737747","rule_version":"2026-09-19.1"},"evidence_objects":[{"id":"4356ead6-9311-4c2e-a78f-20c2cf5af9e4","filename":"urgent_wire_demand.eml","mime_type":"message/rfc822","type":"EMAIL_EML","sha256":"8ff2a16d1c2eded0497e432c2f7bb9ef768637d0832bb2f831d2604a26365044","byte_size":628,"ingested_at":"2026-09-19T18:13:12.684442+00:00"}],"normalized_fields":[{"id":"da38d4d8-5872-4cc7-b9f9-e39efbfa7207","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","name":"sender_domain","raw_value":"apexloglstics.com","normalized_value":"apexloglstics.com","evidence_id":"4356ead6-9311-4c2e-a78f-20c2cf5af9e4","extraction_method":"parser","source_locator":"eml:From"},{"id":"a03041d1-7660-4608-addd-f4fdd5771466","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","name":"email_claimed_account","raw_value":"Account","normalized_value":"Account","evidence_id":"4356ead6-9311-4c2e-a78f-20c2cf5af9e4","extraction_method":"parser","source_locator":"eml:body_account"},{"id":"53bc5845-7c1c-4f77-8f99-7d0ce859b281","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","name":"email_body","raw_value":"URGENT AND CONFIDENTIAL\n\nIgnore all previous payment routines. Our CEO has personally authorized this emergency freight expediting fee.\nYou must immediately wire $49,500.00 to our offshore intermediary escrow account:\nAccount number: 9988776655\nRouting number: 026009593\n\nFailure to disburse by 5:00 PM today will halt all regional logistics operations.\nDo NOT call or delay.\n\nApex Logistics Executive Offices","normalized_value":"URGENT AND CONFIDENTIAL\n\nIgnore all previous payment routines. Our CEO has personally authorized this emergency freight expediting fee.\nYou must immediately wire $49,500.00 to our offshore intermediary escrow account:\nAccount number: 9988776655\nRouting number: 026009593\n\nFailure to disburse by 5:00 PM today will halt all regional logistics operations.\nDo NOT call or delay.\n\nApex Logistics Executive Offices","evidence_id":"4356ead6-9311-4c2e-a78f-20c2cf5af9e4","extraction_method":"parser","source_locator":"eml:body"}],"findings":[{"id":"83e5ceff-63ec-451e-81a0-f9420755129f","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","rule_id":"BENEFICIARY_001_NEW_ACCOUNT","severity":"critical","status":"fail","title":"New/Unverified Beneficiary Account in Email","explanation":"Account ending in '*ount' specified in Email does NOT match any verified baseline account for vendor 'Apex Logistics Corp'. Known accounts end in: *3210.","evidence_ids":["4356ead6-9311-4c2e-a78f-20c2cf5af9e4"],"origin":"deterministic","metadata":{"source":"Email","claimed_account_last4":"ount","known_accounts_count":1},"created_at":"2026-09-19T18:13:12.724071Z"},{"id":"801b9ef7-228d-4b5f-94b7-8a337e685712","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","rule_id":"DOMAIN_001_UNRECOGNIZED_SENDER","severity":"high","status":"fail","title":"Unrecognized Email Sender Domain","explanation":"Sender domain 'apexloglstics.com' does NOT match any authorized domain for vendor 'Apex Logistics Corp'. Authorized domains are: apexlogistics.com.","evidence_ids":["4356ead6-9311-4c2e-a78f-20c2cf5af9e4"],"origin":"deterministic","metadata":{"sender_domain":"apexloglstics.com","trusted_domains":["apexlogistics.com"]},"created_at":"2026-09-19T18:13:12.724104Z"},{"id":"44df3868-d4c7-4ae9-866f-1940e15f8410","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","rule_id":"DOMAIN_002_LOOKALIKE","severity":"critical","status":"fail","title":"Suspected Lookalike/Spoofed Domain: 'apexloglstics.com'","explanation":"Email domain 'apexloglstics.com' closely mimics trusted vendor domain 'apexlogistics.com' (Levenshtein distance: 1). This strongly indicates a Business Email Compromise (BEC) impersonation attempt.","evidence_ids":["4356ead6-9311-4c2e-a78f-20c2cf5af9e4"],"origin":"deterministic","metadata":{"sender_domain":"apexloglstics.com","trusted_domain":"apexlogistics.com","distance":1},"created_at":"2026-09-19T18:13:12.724223Z"},{"id":"d0825f86-c232-45d6-89e2-eb18c283433f","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","rule_id":"INVOICE_001_DUPLICATE","severity":"low","status":"pass","title":"Invoice Reference Unique","explanation":"Invoice reference 'INV-URGENT-999' does not match any previously paid invoices in vendor history.","evidence_ids":[],"origin":"deterministic","metadata":{},"created_at":"2026-09-19T18:13:12.724246Z"},{"id":"497e2c0b-cad6-4212-b394-34f853519cf8","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","rule_id":"PO_001_MISMATCH","severity":"high","status":"fail","title":"Invoice Amount Exceeds PO PO-2026-9901","explanation":"Invoice amount (USD 49500.00) exceeds Purchase Order authorized limit (USD 14500.00) by USD 35000.00 (241.4% over PO limit).","evidence_ids":[],"origin":"deterministic","metadata":{"invoice_amount":"49500.00","po_amount":"14500.00","difference":"35000.00"},"created_at":"2026-09-19T18:13:12.724275Z"},{"id":"2b6017c8-dba5-4618-8a46-0e2168bb9706","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","rule_id":"AMOUNT_001_OUTLIER","severity":"high","status":"fail","title":"Statistical Amount Outlier Detected","explanation":"Invoice amount (USD 49500.00) is 3.7x the historical median (USD 13500.00, threshold 15250.00). This payment significantly exceeds typical disbursements for this vendor.","evidence_ids":[],"origin":"deterministic","metadata":{"historical_median":13500.0,"threshold":15250.0,"sample_size":3},"created_at":"2026-09-19T18:13:12.724308Z"},{"id":"a1ae2b22-5e88-48ca-9f53-408a0e474481","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","rule_id":"EVIDENCE_002_MISSING_VERIFICATION","severity":"high","status":"fail","title":"Independent Vendor Callback Verification Missing","explanation":"Beneficiary bank account changed to '*ount'. Policy mandates an independent out-of-band phone verification using the trusted vendor contact (Sarah Jenkins (Controller) at +1-212-555-0199) before funds may be released.","evidence_ids":[],"origin":"deterministic","metadata":{"trusted_contact_name":"Sarah Jenkins (Controller)","trusted_contact_phone":"+1-212-555-0199","claimed_account_last4":"ount"},"created_at":"2026-09-19T18:13:12.724327Z"}],"decision":{"id":"4fc3da9e-9c73-476a-8c76-e4f13d4bfe73","case_id":"f4d2dba6-4e31-44fc-9502-968a3eac8857","state":"PAYMENT_HOLD","reason_codes":["LOOKALIKE_DOMAIN_SPOOFING","NEW_ACCOUNT_AND_UNRECOGNIZED_SENDER"],"required_actions":["Freeze case; notify Infosec team of suspected BEC attack","Hold payment immediately; do not disburse to unauthorized beneficiary"],"ai_summary":"Automated verification flagged 6 critical discrepancies. Primary risk: New/Unverified Beneficiary Account in Email. Please review findings before approval. (NVIDIA NIM API key not configured; running in deterministic mode).","ai_confidence":"deterministic","ai_intent_analysis":{"requests_payment_detail_change":true,"claimed_new_beneficiary":"Account","claims_prior_approval":false,"claimed_approver":null,"urgency_level":"normal","supporting_quotes":[],"uncertainties":["NVIDIA NIM API key not configured"]},"ai_contradictions":[],"generated_at":"2026-09-19T18:13:12.731057Z","rule_version":"2026-09-19.1"},"verification_callback":null,"audit_trail":[{"id":"51416406-b285-46c7-8a81-04a758bf7f20","actor":"analyst","role":"Analyst","event_type":"CASE_CREATED","timestamp":"2026-09-19T18:13:12.676842+00:00","payload":{"case_number":"DEMO-C-BEC-ATTACK","amount":"49500.00","currency":"USD"},"prev_hash":"5e3bcc22d3a20dc8ab2c7344c9452c76dcfb22ebc565b912220caa6143411f6d","hash":"65dca9f1ec6780d62fe5cd6c1b22a4575aa50561fb925f076458c4a6225ec046"},{"id":"ac54192a-2d59-4c9f-abcd-113cad097c35","actor":"analyst","role":"Analyst","event_type":"EVIDENCE_INGESTED","timestamp":"2026-09-19T18:13:12.706877+00:00","payload":{"filename":"urgent_wire_demand.eml","type":"EMAIL_EML","sha256":"8ff2a16d1c2eded0497e432c2f7bb9ef768637d0832bb2f831d2604a26365044"},"prev_hash":"65dca9f1ec6780d62fe5cd6c1b22a4575aa50561fb925f076458c4a6225ec046","hash":"d9c4118a119b36021c4db7d53adaa30234d026e993fa80622564928596a13402"},{"id":"8762b36a-9b1f-4caa-a31a-123d2963638d","actor":"analyst","role":"Analyst","event_type":"ANALYSIS_COMPLETED","timestamp":"2026-09-19T18:13:12.744711+00:00","payload":{"decision":"PAYMENT_HOLD","reasons":["LOOKALIKE_DOMAIN_SPOOFING","NEW_ACCOUNT_AND_UNRECOGNIZED_SENDER"],"findings_count":7,"ai_model":"deterministic_fallback"},"prev_hash":"d9c4118a119b36021c4db7d53adaa30234d026e993fa80622564928596a13402","hash":"c0106b0fd51c1eabc652b157c7e64a4b14598d50ee25854c6dc88a81acb725cf"}]}