# data[].attributes.body
Global ATO - Earner Risk Support

# data[].attributes.body
Mock Scenario 1:

Earner claims his a/c is compromised. After initial investigation, new_device_login tag, and debit card was found to be added. Steps and SR sent would be _______

# data[].attributes.body
Mock Scenario 2:

A Delivery partner receives suspicious call (phishing call) and assumes to be hacked. Upon investigation, ATO wasn't confirmed. What steps and SR would be sent?

# data[].attributes.body
Global ATO Indicators

# data[].attributes.body
Mock Scenario 3:

Driver: My earnings have been stolen

Investigation:

New device added within 30 days

new_device_login tag present

vault is not compromised

What is the SR to be provided and steps taken for the same? (don't forget CTG)

# data[].attributes.body
1. Earner's verbatim

2. tag

3. debit card

# data[].attributes.body
Earners verbatim

new_device_login tag is present

debit card was added on the account

# data[].attributes.body
Scenario 1:

1. new_device_login tag

2. DP's claimed that his account was compromised

3. added debit card as one of the payment method

# data[].attributes.body
1. Follow Step 3 actions (if applicable).

2. Resolved the contact by following Step 4 actions.

SAVED REPLY: Vault Compromised - Confirmation Check

# data[].attributes.body
Scenario 3

1. Follow Step 3

2. Follow Step 4 (vault not modified)

3. Follow Step 5, then 6,

4. Follow Step 7 and use SR (CTG - [Driver/Delivery Partner] >  Risk Support - Fraud claim > Unauthorized login > No Stolen earnings)

# data[].attributes.body
1. new device log in tag

2. Earner claims that their acct was hacked

3. A new debit card was added

# data[].attributes.body
Scenario 1

1. Follow step 3

2. Resolve by following step 4 and SR

# data[].attributes.body
1. new device tag

2. claims about the account being hacked.

3. A new card was added

# data[].attributes.body
a/c is compromised

new_device _login tag

added debit card

# data[].attributes.body
Scenario1

Account compromised

New_device_login tag

debit card added

# data[].attributes.body
Scenario 1

ATO indicators:

New device added within 30 days of suspected ATO

Changes to the driver’s vault

Follow Step 3 actions

1. Resolved the contact by following Step 4 actions.

SAVED REPLY: Vault Compromised - Confirmation Check

# data[].attributes.body
1. Confirmed ATO

2. Follow step 3

3. Resolved the contact by following Step 4 SAVED REPLY Vault Compromised - Confirmation Check and Submit as AWAITING REPLY

# data[].attributes.body
Scenario 2:

1. Driver claimed that his account was hacked

# data[].attributes.body
Scenario 1:

Follow Step 3 and continue resolving in Step 4

# data[].attributes.body
Scenario 2

1. DP received a phishing call and assumes a/c to be hacked

2. No ATO indicators confirmed

# data[].attributes.body
Follow step 3

Resolve STATUS - Awaiting Reply for Step 4

SR - Vault Compromised - Confirmation Check

Scenario 1

# data[].attributes.body
SCENARIO 2:

1. Driver claiming that their account was hacked due to a suspicious call.

2. No Global ATO indicator was confirmed.

# data[].attributes.body
Scenario2:

Claims to receive phishing call

ATO wasn't confirmed

# data[].attributes.body
Scenario 1:

1. Follow Step 3 actions

2. Follow Step 4 actions and use the SR Vault Compromised - Confirmation Check

# data[].attributes.body
Scenario 2

1. Earner claimed that his account was hacked

2. No ATO indicators confirmed

# data[].attributes.body
SCENARIO 2:

1. Follow actions in Step 1 (if applicable)

2. Then go to Step 9 – Phishing Attempt Unsuccessful.

SAVED REPLY FAQ: No Phishing Attempt Found

# data[].attributes.body
SCENARIO 1:

1. New device login tag

2. Earner claims that their account was hacked.

3. A new debit card was added to the account.

# data[].attributes.body
Scenario 1

1. Follow Step 3

2. resolved contact by ff step 4 actions

# data[].attributes.body
Scenario 2

ATO wasn't confirmed since earner only assumed account was hacked due to a phishing call

# data[].attributes.body
Scenario 2:

1. only 1 global ATO indicator found

2. follow Step 1 actions

3. Continue to the Failed Unauthorized Access FAQ to solve

4. use the SR - (FAQ - No Phishing Attempt Found)

5. CTG - Driver/Delivery Partner > Risk Support - Fraud claim > Failed unauthorized access

# data[].attributes.body
Scenario 2

1. Follow Step 1

2. Follow Step 9 (phishing attempt) and use recommended SR.

# data[].attributes.body
Scenario 2

driver claimeda/c was hacked - received phishing call

No GATO inidcator

# data[].attributes.body
Scenario2:

Complete actions from Step1

Send SR and resolved from Step 9

# data[].attributes.body
Scenario 2

1. Are there signs of an unauthorized login? - No - Go to Step 1

2. Step 1 – Non-ATO - follow instructions

3. Go to Step 9 – Phishing Attempt Unsuccessful

# data[].attributes.body
SCENARIO 3:

1. Global ATO Indicators:

New device added w/in 30 days

New device login tag

Driver verbatim: earnings has been stolen

# data[].attributes.body
Scenario 2

Follow Step 1

Follow Step 9 – Phishing Attempt Unsuccessful

Send SR - Submit as Solved

# data[].attributes.body
Scenario 3:

ATO indicator

1. A new device added within 30 days

2. new_device_log in tag present

3. Earners Verbatim " earnings has been stolen"

# data[].attributes.body
Scenario3:

earnings stolen

new device added

new_device_login tag

# data[].attributes.body
Scenario 2

1. Follow Step 1 Non-ATO (no ATO indicators found on earner account)

1.  CONTACT TYPE Driver/Delivery Partner > Risk Support - Fraud claim > Failed unauthorized access

2. Follow step 9-– Phishing Attempt Unsuccessful

FIRST TOUCH

SAVED REPLY FAQ - No Phishing Attempt Found

STATUS Submit as SOLVED

# data[].attributes.body
SCENARIO 2:

1. Driver claiming that their account was hacked due to a suspicious call.

2. No Global ATO indicator was confirmed.

# data[].attributes.body
Scenario 2

1. Follow Step 1

2. Follow Step 9 (phishing attempt) and use recommended SR.

# data[].attributes.body
Scenario3:

[Driver/Delivery Partner] >  Risk Support - Fraud claim > Unauthorized login > No Stolen earnings

Follow Step 3 then complete with step 6

# data[].attributes.body
Scenario 3

1. Confirmed ATO indicators :

New device added within 30 days

New device tag

Earnings stolen

# data[].attributes.body
Scenario 3

new device added w/n 30 days

new_device_login tag

# data[].attributes.body
Scenario 3:

1. new device added within 30 days

2. new device tag

3. earnings stolen

ATO confirmed

# data[].attributes.body
Scenario 3

1. New device added within 30 days

2. new_device_login tag is present

3. Earners verbatim - earnings has been stolen

# data[].attributes.body
Scenario 3

Follow Step 3

Follow Step 4a – Vault not confirmed (First Touch)

CTG: [Driver/Delivery Partner] >  Risk Support - Fraud claim > Unauthorized login

SR - Vault not confirmed

Submit as AWAITING REPLY

# data[].attributes.body
SCENARIO 3:

1. Follow Step 3 actions (if applicable)

2. Step 4 – Have there been attempts to modify the Vault? > No (Continue to Step 5)

3. Step 5 – Did falsified trips occur? > No, not mentioned. (Next, continue to Step 6)

4. Step 6 – Were any earnings lost? > No. Follow applicable actions.

# data[].attributes.body
Scenario 3

1. Follow Step 3

2. Follow Step 4 (vault not compromised

3. Follow Step 5

4. Follow Step 6 (No stolen earnings) and use SR (CTG - [Driver/Delivery Partner] >  Risk Support - Fraud claim > Unauthorized login > No Stolen earnings)

# data[].attributes.body
Scenario 3:

Confirmed ATO:

1. Follow Step 3 – What to do when an ATO is confirmed

CONTACT TYPE [Driver/Delivery Partner] >  Risk Support - Fraud claim > Unauthorized login

2. Follow Step 4 – Have there been attempts to modify the Vault? No

3. Step 5 – Did falsified trips occur? No

4. Step 6 – Were any earnings lost?

5. SAVED REPLY ATO Confirmed - No Stolen Earnings

# data[].attributes.body
Scenario 3

ATO Confirmed - SR > No Stolen Earnings

Submit as SOLVED

[Driver/Delivery Partner] >  Risk Support - Fraud claim > Unauthorized login > No Stolen earnings

# data[].attributes.body
Scenario 3:

1. follow Step 3

2. follow Step 6

3. use the SR - ATO Confirmed - No Stolen Earnings

4. CTG - [Driver/Delivery Partner] > Risk Support - Fraud claim > Unauthorized login > No Stolen earnings

# data[].attributes.body
Scenario 3

1. Follow Step 3

2. Step 4 – Have there been attempts to modify the Vault? No

3. Step 4a – Vault not confirmed (First Touch)

4. Step 5 – Did falsified trips occur?

5. Step 6 – Were any earnings lost?

6. If earnings were NOT lost, follow the below steps:

CONTACT TYPE [Driver/Delivery Partner] >  Risk Support - Fraud claim > Unauthorized login > No Stolen earnings

ACTION

1. Remove the following tags:

lock_account_update

fraud_base_payment_ineligible

vault_edit_denied

vault_debit_locked_indef

delay_vault_payout_suspicious_edit

delay_vault_payout_suspicious_cashout

Risk_suspected_phishing_old_device

phishing_vault_edit_denied

phishing_linked_device_login

new_device_login

2. Apply the following tag:

risk_confirm_payout_card_confirmed

tp_ato

3. Check for the following tags for potential UPC ATO:

potential_ato_payout

UPC creation within 15 days of suspected ATO (note date of add)

New device added within 30 days of UPC add

If 2 of 3 above checks are true, continue to the Uber Pro Card US (UPC) ATO table

If earnings were stolen via UPC, proceed to the next step

SAVED REPLY ATO Confirmed - No Stolen Earnings

STATUS Submit as SOLVED