Security Settings Change Event

The security_settings_change event type is used when a user modifies security-related account settings: enabling or disabling two-factor authentication, adding or removing trusted devices, changing recovery options, or adjusting notification/alert preferences. Disabling 2FA or wiping trusted devices is a common attacker move right after a takeover.

Category: Non-monetary Relevant feedback outcomes: success, fail, fraud, rejected

note

Dispute, chargeback, and refund outcomes do not apply to security settings change events.

Request Example

POST /api/v1/generic/validate HTTP/1.1
Host: api.sa.mubeen.ai
X-API-Key: ***
Content-Type: application/json

{
  "event_type": "security_settings_change",
  "timestamp": "2025-03-15T19:55:00Z",
  "attempt_id": "att_sechg_8851",
  "external_id": "change_998880",
  "device_id": "fp_acctchg_mno34567",
  "user_id": "usr_890123",
  "user_email": "[email protected]",
  "full_name": "Layla Mahmoud",
  "ip_address": "178.22.91.55",
  "ip_country": "SA",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0",
  "channel": "web",
  "platform": "web",
  "account_created_at": "2022-08-01T00:00:00Z"
}

Response Example

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234570",
  "decision": "review",
  "risk_score": 55,
  "risk_level": "high"
}

Feedback Examples

Successful Security Settings Change

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234570",
  "outcome": "success",
  "external_id": "change_998880"
}

Fraudulent Security Settings Change (2FA Disabled)

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234570",
  "outcome": "fraud",
  "outcome_details": {
    "fraud_type": "account_takeover",
    "detection_method": "user_reported"
  },
  "external_id": "change_998880"
}

Rejected Security Settings Change

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234570",
  "outcome": "rejected",
  "outcome_details": {
    "rejection_reason": "suspicious_device",
    "rule_triggered": "new_device_sensitive_change"
  },
  "external_id": "change_998880"
}

Key Fields for Security Settings Change Events

Field	Importance	Notes
user_id	Required	Identifies the account being modified
device_id	Recommended	Disabling 2FA from a new device is a top-risk signal
ip_address	Recommended	Changes from an unusual IP indicate potential compromise