LogsF-2321

Nexo Bank MX entitlements suspended in bulk with no payment trigger

Ack SLA remaining14m 00sof 15m 00s

Unexplained suspensions

1,842

from ≤ 15 per hour · +122×

Affected users

1,842

Nexo Bank MX · ACTIVE → SUSPENDED

Cancels at risk

1,180

Modelled over 30 days

Detected

1m ago

28 Aug 14:19 UTC

Attributable to

AWG

Commercial integrity. Entitlement, payment, subscription lifecycle, invoicing.

Response

Detected

Detected
Acknowledged
Investigating
Routed
Resolved

14 minutes left on the acknowledgement clock.

Discussion

0 messages

Not routed yet. Nobody outside this tool knows about this finding.

Description

1,842 Nexo Bank MX users moved from ACTIVE to SUSPENDED inside four minutes. No payment failure, refund or cancellation precedes any of them, and the affected users are still opening the app and being refused. A bulk state change with no commercial cause is either a batch job that should not have run or a partner-side feed error, and until it is reversed those users are paying for a service that will not let them in.

Suggested action

Ask AWG to identify the job or feed that issued the state change and to reverse it. Hold the period-close summary until the reversal is confirmed.

Related logs

1 signals · expand a row for the event data

2026-08-28T14:19:00.000ZS-9110 THRESHOLD RULE Subscription state changes — observed 1,842, expected ≤ 15+122×

Detected: 28 Aug 14:19 UTC1m ago
Detector: Threshold rule
Slice: Nexo Bank MX · ACTIVE → SUSPENDED
Confidence: 99%
Affected users: 1,842
Observed: 1,842
Expected: ≤ 15
Deviation: +122×

Event dataREDSHFTPOST /redshift-data/v1/statement200201mss-9110-06091

{
  "timestamp": "2026-08-28T14:19:00.000Z",
  "endpoint": "POST /redshift-data/v1/statement",
  "requestId": "s-9110-06091",
  "status": 200,
  "latencyMs": 201,
  "request": {
    "metric": "Subscription state changes",
    "slice": "Nexo Bank MX · ACTIVE → SUSPENDED",
    "detector": "rule",
    "window": "6h"
  },
  "response": {
    "observed": "1,842",
    "expected": "≤ 15",
    "deviation": "+122×",
    "confidence": 0.99,
    "affected_users": 1842,
    "columns": [
      "to_state",
      "users"
    ],
    "rows": [
      [
        "SUSPENDED",
        "1,842"
      ]
    ]
  }
}

Query

SELECT to_state, count(*) AS users
FROM fact_subscription_state_change c
WHERE c.vendor_id = 'nexo-mx' AND c.occurred_at >= now() - interval '10 minutes'
  AND NOT EXISTS (SELECT 1 FROM fact_payment p WHERE p.aums_uuid = c.aums_uuid
                  AND p.occurred_at >= now() - interval '24 hours')
GROUP BY to_state

Clustered support tickets

1 matched

I paid and it says my access is suspended
ZD-88501 · Nexo Bank MX
1m ago

Sample affected users

d2b90c14