# Runbook: User Account Block and Unblock

**Service:** WalletWeb Customer Portal
**Owner:** Operations Team
**Escalation:** Ops Supervisor → SRE → Platform Team

---

## Overview
Procedure for blocking or unblocking a customer account in response to security incidents, fraud alerts, or customer requests.

## Prerequisites
- Admin console access with `ops_supervisor` or `admin` role
- Incident ticket ID (for audit trail)
- Customer account ID or email

## Procedure

### Blocking an Account

1. **Access Admin Console**
   - Navigate to https://wallet.example.com/admin/login
   - Log in with ops_supervisor or admin credentials
   - MFA challenge will be presented

2. **Locate Customer Account**
   - Navigate to `/admin/users`
   - Search by account ID or email
   - Verify customer details match the incident report

3. **Initiate Block**
   - Click the customer record
   - Select "Block Account" action
   - System will prompt for:
     - **Reason** (required): Select from dropdown or enter custom reason
     - **Ticket ID** (required): Enter incident/fraud ticket ID
     - **Re-auth confirmation**: MFA challenge will be presented

4. **Confirm Block**
   - Review details in confirmation modal
   - Click "Confirm Block"
   - System will:
     - Set account status to `blocked`
     - Revoke all active sessions
     - Emit `AccountBlocked` domain event
     - Create audit log entry

5. **Verify Block**
   - Refresh user details page
   - Confirm status shows "Blocked"
   - Check audit log for `AccountBlocked` event with your admin ID

6. **Notify Stakeholders**
   - Update incident ticket with block confirmation
   - Notify Compliance team if block is fraud-related
   - Document reason and timestamp in incident notes

### Unblocking an Account

1. **Verify Unblock Authorization**
   - Confirm unblock request has Compliance approval if block was fraud-related
   - Verify customer identity verification completion (if applicable)
   - Obtain approval ticket ID

2. **Access Blocked Account**
   - Navigate to `/admin/users`
   - Filter by status: "Blocked"
   - Locate and select the customer account

3. **Initiate Unblock**
   - Click "Unblock Account" action
   - Enter:
     - **Reason**: Explain reason for unblock
     - **Approval Ticket ID**: Reference compliance/support ticket
   - MFA re-auth will be required

4. **Confirm Unblock**
   - Review confirmation modal
   - Click "Confirm Unblock"
   - System will:
     - Set account status to `active`
     - Emit `AccountUnblocked` domain event
     - Create audit log entry

5. **Verify Unblock**
   - Refresh user details to confirm status is "Active"
   - Test: customer should now be able to log in

6. **Notify Customer**
   - Send unblock confirmation email (via support system)
   - Update approval ticket with completion timestamp

---

## Troubleshooting

### Block Action Fails
- **Error**: "Policy denied: insufficient role"
  - **Fix**: Verify your account has `ops_supervisor` or `admin` role. Escalate to SRE if role assignment is incorrect.

- **Error**: "MFA verification failed"
  - **Fix**: Re-authenticate with fresh MFA token. Check time sync on authenticator device.

### Unblock Action Fails
- **Error**: "Account has active compliance hold"
  - **Fix**: Check `/admin/compliance/exceptions` for active holds. Compliance officer must clear hold before unblock.

### Customer Cannot Log In After Unblock
- **Check**: Account status in admin console (should be "Active")
- **Check**: Session revocation cache TTL (sessions may take 60s to expire)
- **Action**: Ask customer to clear browser cookies and retry login

---

## Audit and Compliance
- All block/unblock actions emit privileged audit events with:
  - Admin user ID
  - Customer account ID
  - Reason
  - Ticket ID
  - Timestamp
- Audit events are ingested by WalletObservability and forwarded to SIEM
- Compliance team reviews monthly for abuse patterns

---

## Rollback
Block and unblock are **reversible** operations. No rollback procedure needed beyond re-applying the previous state (block → unblock, unblock → block).

---

## Related Runbooks
- [Device Revocation](./device-revocation.md)
- [Session Termination](./session-termination.md)
- [Transaction Investigation](./transaction-investigation.md)