Finance
21 columns
400 rows
8 formats

Account Takeover Detection

This dataset provides detailed records of account takeover incidents, capturing unauthorized access attempts, credential compromises, device and contact information changes, and abnormal transactions. It includes detection methods, response actions, and resolution status, enabling advanced security analytics, fraud detection, and incident response optimization.

opened 6 times
last updated 29 Oct 2025
by GoMask

The brief that made it

Automated detection and investigation of account takeover attempts

Sample rows

preview · 8 of 400 rows · all 21 columns

incident_idstring	detection_methodstring	transaction_amountfloat	abnormal_transaction_detectedboolean	geo_location_countrystring	user_idstring	usernamestring	emailstring	incident_datetimedatetime	incident_typestring	device_idstring	device_typestring	ip_addressstring	geo_location_citystring	contact_info_changedboolean	device_changedboolean	transaction_currencystring	response_actionstring	response_datetimedatetime	resolvedboolean	resolution_notesstring
INC0001	anomaly_detection	blank	false	US	USR101	jamesnguyen	jamesnguyen@mail.com	2023-08-14T10:22:00Z	credential_compromise	DESK-A82XK4	desktop	192.168.6.23	San Francisco	false	false	blank	password_reset	2023-08-14T10:37:00Z	true	Password reset completed and user notified. No further suspicious activity detected during review.
INC0002	manual_review	98235.51	true	Germany	USR102	liam.patel	liam.patel@webmail.co.uk	2022-12-28T15:05:00Z	abnormal_transaction	TAB-9G7RT1	tablet	88.134.201.45	Berlin	false	false	EUR	account_locked	2022-12-28T15:16:00Z	false	Account locked pending investigation of abnormal transaction. Awaiting user confirmation and forensic analysis.
INC0003	automated_alert	blank	false	Canada	USR103	alex.smith	alex.smith@safeemail.com	2024-01-08T13:47:00Z	credential_compromise	MOB-0Q4LPN	mobile	10.211.32.81	Toronto	false	false	blank	account_locked	2024-01-08T14:03:00Z	true	Account locked and credentials reset. User has confirmed no unauthorized changes.
INC0004	user_report	blank	false	Brazil	USR104	sophialopez	sophialopez@outlook.com	2023-04-03T08:30:00Z	contact_info_change	MOB-7TZLQ9	mobile	172.21.9.99	Sao Paulo	true	false	blank	user_notified	2023-04-03T08:45:00Z	true	User notified of contact information change. No further action required at this time.
INC0005	anomaly_detection	1500000	true	Singapore	USR105	a.chen	a.chen@services.sg	2024-04-16T19:11:00Z	abnormal_transaction	DESK-A7JQK1	desktop	203.116.42.88	Singapore	false	false	SGD	account_locked	2024-04-16T19:23:00Z	false	High-value transaction detected. Account locked for forensic review and regulatory notification.
INC0006	automated_alert	blank	false	Poland	USR106	emma_davis	emma_davis@securemail.com	2023-11-09T16:28:00Z	device_change	MOB-3V6WJ8	mobile	212.45.99.101	Warsaw	false	true	blank	password_reset	2023-11-09T16:44:00Z	true	Password reset performed due to device change. User advised to monitor account activity.
INC0007	manual_review	500	true	Spain	USR107	luismartin	luismartin@europemail.es	2022-10-19T09:16:00Z	abnormal_transaction	TAB-8Y6FJ2	tablet	185.154.231.18	Madrid	false	false	EUR	user_notified	2022-10-19T09:30:00Z	true	Low-value abnormal transaction detected. User notified and transaction reversed.
INC0008	anomaly_detection	blank	false	India	USR108	meera.rao	meera.rao@mailer.in	2023-07-21T12:03:00Z	credential_compromise	DESK-PQ3N89	desktop	49.207.181.66	Mumbai	false	true	blank	password_reset	2023-07-21T12:19:00Z	true	Password reset initiated after credential compromise. User advised to update security questions.
INC0009	user_report	blank	false	France	USR109	rachelwong	rachelwong@asia.com	2024-02-25T18:44:00Z	contact_info_change	TAB-1VMXQ6	tablet	27.54.112.222	Lyon	true	false	blank	account_locked	2024-02-25T18:56:00Z	true	Account locked due to unauthorized contact info change. Awaiting user verification.
INC0010	automated_alert	blank	false	US	USR110	john_hall	john_hall@usermail.com	2023-02-11T21:17:00Z	credential_compromise	MOB-2Z8TQ5	mobile	198.51.105.127	Chicago	false	false	blank	password_reset	2023-02-11T21:36:00Z	true	Password reset completed due to suspected credential compromise. No abnormal transactions found.
INC0011	automated_alert	blank	false	Germany	USR111	oliver.muller	oliver.muller@de.com	2023-09-07T07:41:00Z	device_change	TAB-0Y6EJ2	tablet	83.154.201.23	Frankfurt	false	true	blank	user_notified	2023-09-07T07:57:00Z	true	User notified of device change. No further suspicious activity noted.
INC0012	manual_review	99999999.99	true	Spain	USR112	lucas_fernandez	lucas_fernandez@correo.mx	2022-11-30T11:13:00Z	abnormal_transaction	DESK-L9K8R2	desktop	189.210.34.55	Valencia	false	false	EUR	account_locked	2022-11-30T11:24:00Z	false	Account locked after detection of large abnormal transaction. Escalated to fraud investigation unit.
INC0013	user_report	blank	false	blank	USR113	hannah.brown	hannah.brown@bmail.com	2023-05-04T17:52:00Z	other	blank	unknown	blank	blank	false	false	blank	no_action	blank	true	No action required. User reported suspicious login, but no evidence of compromise found.
INC0014	anomaly_detection	blank	false	UK	USR114	daniel.kim	daniel.kim@securemail.com	2023-10-22T14:09:00Z	credential_compromise	DESK-T6D2L1	desktop	203.0.113.8	London	false	false	blank	account_locked	2023-10-22T14:28:00Z	true	Account locked as a precaution after credential compromise. User instructed to follow up with IT.
INC0015	user_report	blank	false	Brazil	USR115	natalie.jones	natalie.jones@bmail.com	2024-05-12T07:54:00Z	contact_info_change	DESK-F8V5T3	desktop	201.45.78.32	Rio de Janeiro	true	false	blank	user_notified	2024-05-12T08:12:00Z	true	Contact info change reported and user notified. No further actions taken.
INC0016	manual_review	17800	true	Singapore	USR116	ethanwu	ethanwu@easymail.sg	2023-06-25T16:39:00Z	abnormal_transaction	DESK-M3B7K1	desktop	203.116.42.44	Singapore	false	false	SGD	user_notified	2023-06-25T16:54:00Z	true	Unusual transaction flagged and reversed. User notified and advised to change password.
INC0017	automated_alert	blank	false	Australia	USR117	alicefoster	alicefoster@user.me	2022-09-03T22:18:00Z	device_change	TAB-5X3N9G	tablet	175.182.41.67	Sydney	false	true	blank	other	2022-09-03T22:35:00Z	true	Device change flagged as unusual. User confirmed new device and no further action required.
INC0018	user_report	blank	false	blank	USR118	carlos.silva	carlos.silva@brmail.com	2023-03-18T19:25:00Z	other	blank	unknown	blank	blank	false	false	blank	no_action	blank	true	User reported general suspicious activity but no evidence of account takeover found.
INC0019	anomaly_detection	blank	false	India	USR119	mohitgupta	mohitgupta@mailer.in	2023-12-04T11:59:00Z	credential_compromise	DESK-Q5R8L3	desktop	14.139.144.99	Delhi	false	true	blank	account_locked	2023-12-04T12:16:00Z	true	Credential compromise detected and account locked. User to verify recent activity.
INC0020	anomaly_detection	blank	false	US	USR120	noah_jackson	noah_jackson@usermail.com	2024-03-11T09:02:00Z	credential_compromise	MOB-1H2C7G	mobile	104.24.31.56	Dallas	false	false	blank	password_reset	2024-03-11T09:18:00Z	true	Password reset initiated due to credential compromise. No transaction issues found.

What the 400 rows show

from the 400-row sample

Manual_review (detection method) stands out: 96 of its 106 rows have abnormal_transaction_detected = true, against 5 of 294 for the rest.

25%abnormal_transaction_detected = true
100,000median transaction_amount
4device types
5incident types
5response actions
10transaction currencies

Abnormal transaction detected rate by detection_methodabnormal_transaction_detected = true

transaction_amount101 rows, in bands of 10M

Median 100,000, from 0.01 to 100,000,000.

geo_location_country365 rows with a value · 35 left blank

US40
Germany37
Singapore28
India26
Brazil24
Spain24
Mexico21
Canada20
Russia20
France18

21 columns by typefrom the column list below

string 14
float 1
datetime 2
boolean 4

Columns

21 columns in four groups

blueprint · 21 columns
column	type	description	example
Text 14 columns
`incident_id`	string	Unique identifier for the account takeover incidentunique	INC0001
`user_id`	string	Unique identifier for the affected user account	USR101
`username`	string	Username of the affected account	jamesnguyen
`email`	string	Email address associated with the account	jamesnguyen@mail.com
`detection_method`	string	Method used to detect the unauthorized access (e.g., anomaly detection, manual review, automated alert)4 values	anomaly_detection
`incident_type`	string	Type of unauthorized activity detected5 values	credential_compromise
`device_id`	string	Identifier for the device used during the incident (if applicable)optional	DESK-A82XK4
`device_type`	string	Type of device used (e.g., mobile, desktop, tablet)mobile · desktop · tablet · unknown · optional	desktop
`ip_address`	string	IP address from which the unauthorized access was attemptedoptional	192.168.6.23
`geo_location_country`	string	Country of origin for the access attempt, based on IP geolocationoptional	US
`geo_location_city`	string	City of origin for the access attempt, based on IP geolocationoptional	San Francisco
`transaction_currency`	string	Currency code for the transaction (e.g., USD, EUR)10 currencies · optional	EUR
`response_action`	string	Action taken in response to the incident (e.g., account locked, password reset, user notified)5 values	password_reset
`resolution_notes`	string	Additional notes or comments regarding the resolution of the incidentoptional	Password reset completed …
Numbers 1 column
`transaction_amount`	float	Amount involved in the abnormal transaction (if applicable)0 or more · optional	98235.51
Dates and times 2 columns
`incident_datetime`	datetime	Date and time when the unauthorized access attempt was detected	2023-08-14T10:22:00Z
`response_datetime`	datetime	Date and time when the response action was takenoptional	2023-08-14T10:37:00Z
True or false 4 columns
`contact_info_changed`	boolean	Indicates if contact information (email, phone) was changed during the incident	false
`device_changed`	boolean	Indicates if a new device was used for access during the incident	false
`abnormal_transaction_detected`	boolean	Indicates if abnormal transactions were detected during the incident	false
`resolved`	boolean	Indicates if the incident has been resolved	true

Use it for

A finance dashboard
The abnormal_transaction_detected rate, transaction_amount by detection_method and a breakdown of geo_location_country. Excel, Power BI or Tableau.
Why do 101 of 400 rows have abnormal_transaction_detected = true?
A root-cause class exercise
Hand out the rows and one question. The answer is in the data, not in the brief.
Incidents400
INC0001anomaly_…
INC000298235.51manual_r…
INC00051500000anomaly_…
A software demo
Believable incidents with user_id, username and email to fill a screen in front of a buyer.

This dataset400 rows21 columns

Yours1,000 rows21 columnsip_address: UK only

blueprint · account-takeover-detection

Behind this dataset

Same schema. As many rows as you need.

These 400 rows came out of a blueprint — 21 columns with generation rules behind each one. Open it in Data Factory to retune a column, add your own, wire in foreign keys, and run it at the size you actually need.

Rules it was built with

Account access logs analyzed
Login from new device or location flagged
Multiple failed login attempts detected
Credential stuffing patterns identified
Contact information change triggers alert
Large or unusual transactions after access change
Multi-factor authentication bypass attempts
Account locked if takeover suspected

Rows1,000 rows10,000 rows100,000 rows1,000,000 rows

Open the blueprint in Data Factory

1 credit per row. Preview 20 rows free. Buy rows for the full run.

Exports: CSV, JSON, JSONL, Parquet, SQL, Excel, TSV, XML
Licence: yours to use, including commercially
API slug: account-takeover-detection

What should your data show?

No signup. No card.

Sample rows

What the 400 rows show

Columns

Use it for

A finance dashboard

A root-cause class exercise

A software demo

Make it yours.

Same schema. As many rows as you need.

More in Finance

What should your data show?