Account takeover ticket triage console for support teams
Work "I think I was hacked" tickets in one place: see each customer's real breach exposure beside their conversation, then note, tag, and reply with confidence.
Have I Been Pwned
ZendeskCustomer SupportOperationsFeedback TriageResearch & MonitoringBuild me an account takeover triage console for our support team, using Zendesk and Have I Been Pwned. It should turn an "I think my account was hacked" ticket into a decision instead of a guessing game. This is a queue our agents work all day, not an alert they receive.
The main view is a queue of Zendesk tickets. A handler fetches them with Search Tickets using a saved query that covers our account security tags plus phrases like unauthorized login and suspicious charge, and the query should live in one place in the code so it is easy to edit. Each row resolves the requester with Show User to get their name and email address, then shows a live exposure summary for that email: how many known breaches it appears in, the date of the most recent one, whether it appears in any pastes, and whether its credentials show up in stealer logs. Let me sort or filter the queue so the tickets with the strongest exposure signal float to the top, and show ticket subject, requester, status, priority, and when it was last updated.
Opening a ticket gives me a two panel view. On the left, the full Zendesk conversation from List Ticket Comments, in order, with public replies and internal notes visually distinguished and each one attributed to its author. On the right, the requester's exposure history from Have I Been Pwned: every breach from Get Breaches for Account with the breach date and the exposed data classes, any appearances from Get Pastes for Account with source and date, and the website domains their credentials were captured against from Get Stealer Logs by Email. Call out the stealer log result prominently, because that is the signal that separates a plain credential stuffing victim from someone with an actively infected machine, and a password reset alone will not fix the second case. If I want more background on a specific breach, let me expand the row and pull the full record with Get a Single Breach.
From that same screen I need to act on the ticket. Using Update Ticket, let me write an internal note with the exposure summary already prefilled from what is on screen so I can edit rather than retype it, set the priority, and apply a tag. Show me clearly that the write succeeded and refresh the thread afterwards.
Add a "Draft the response" button that starts a background agent. The agent reads the whole ticket thread with List Ticket Comments, pulls the same exposure data for the requester with Get Breaches for Account, Get Pastes for Account, and Get Stealer Logs by Email, and writes a customer safe reply into the app for me to review. The draft lands in the app, not on the ticket. I read it, edit it, and then post it to the ticket myself as a public reply with Update Ticket. Show the agent's status while it runs and keep the last draft available per ticket.
Bake in the privacy rules, they are not optional. The app looks up the requester's own address only, taken from the Zendesk requester record, so there is no free-text box for checking arbitrary email addresses. The customer facing reply never repeats raw breach contents, passwords, or an itemised list of everything the person was exposed in. Instead it explains the reused password risk in plain language and gives the exact steps to take: change the password on our service to something unique, turn on two factor authentication, check for unfamiliar sessions or devices, and when there is a stealer log hit, run a malware scan and change passwords from a clean device because resetting from the infected one will just leak the new password too.
Some Have I Been Pwned specifics to get right. The breached account and paste account endpoints return HTTP 404 with an empty body when the account is clean, so render that as a verified clean result and never as a failure, and make that state visually distinct from a genuine lookup error so an agent can confidently tell a customer nothing turned up. URL encode email addresses in the path. Pass truncateResponse=false on the breach lookup so the detail panel gets DataClasses and BreachDate rather than just breach names. The stealer log endpoints need a Pro tier subscription, so read the entitlements at runtime from Get Subscription Status and hide the stealer log column and panel section entirely when the key does not include it, rather than showing a broken or empty section. Respect the rate limit on the key: the queue does one lookup per requester, caches the result for the session, and gives me a refresh control rather than re-querying every render.
What does this prompt do?
- Gives your support team a live queue of account security tickets, pulled from Zendesk using your own saved search of security tags and phrases like unauthorized login or suspicious charge
- Shows each customer's exposure history next to their conversation: which known breaches their email turned up in, when, what kind of data was exposed, and whether their sign-in details were ever captured by malware on their own device
- Lets an agent leave an internal note with the exposure summary, set the priority, and apply a tag without leaving the screen
- Includes a Draft the response button that reads the whole ticket thread and the exposure history, then writes a customer-safe reply for the agent to review and post
- Treats a customer with no exposure as verified clean rather than as an error, so your team can tell them nothing turned up and mean it
What do I need to use this?
- A Zendesk account with agent or admin access, plus an API token
- A paid Have I Been Pwned subscription key. The Pro tier adds the malware capture signal; on lower tiers that section simply hides itself
- The tags or wording your team already uses on account security tickets, so the queue picks up the right ones
- A support team that handles account takeover reports and wants one screen instead of three
How can I customize it?
- Change the saved search behind the queue to match your own security tags, ticket forms, or phrasing
- Set your own rules for what priority and tag get applied, for example anything with a malware capture goes to urgent
- Adjust the tone and the exact recovery steps the drafted reply gives customers, so it matches your brand voice and your product's security settings
FAQs
Can agents look up any email address they want in this app?
What does the customer actually see in the reply?
What happens when a customer has no exposure at all?
Do I need the Pro subscription tier?
Does it post replies to the customer automatically?
Related templates
Open one board each morning to see which Zendesk tickets are turning hostile, why, and who has been waiting longest.
See every company email caught in a data breach, who still works here, and what your team has already fixed, all on one board.
Turn the vendor spreadsheet you already keep into a live third party risk screen showing which vendors were breached and which of your staff were caught in it.
See which questions your customers keep asking, then record a short avatar explainer for the ones actually worth answering on video.
Reps work their live ticket queue on one screen, get a cited draft answer pulled straight from your documentation, and send it without leaving the app.
A console where reps open a tough ticket, see the three closest past resolutions, and send an approved reply drafted from them.
Stop guessing on hacked account tickets.
Give your support team one screen that turns a scared customer's report into a clear answer and a safe reply.