diff --git a/app/admin/repositories/risk_monitor.py b/app/admin/repositories/risk_monitor.py
index 8ae482d..dbb986f 100644
--- a/app/admin/repositories/risk_monitor.py
+++ b/app/admin/repositories/risk_monitor.py
@@ -255,17 +255,25 @@ def list_incidents(
             "status": incident.status,
         }
         if incident.subject_type == "device":
-            item["device_model"] = _latest_device_model(db, incident.subject_id)
-            item["first_used_at"] = _first_used_at(db, incident.subject_id)
-            item["restricted"] = risk_repo.is_restricted(
+            restriction = risk_repo.get_active_restriction(
                 db,
                 subject_type="device",
                 subject_id=incident.subject_id,
                 scope=risk_repo.SCOPE_AUTH_DEVICE,
             )
+            item["device_model"] = _latest_device_model(db, incident.subject_id)
+            item["first_used_at"] = _first_used_at(db, incident.subject_id)
+            item["restricted"] = restriction is not None
+            item["restriction_id"] = restriction.id if restriction else None
         else:
             uid = int(incident.subject_id)
             user = users.get(uid)
+            restriction = risk_repo.get_active_restriction(
+                db,
+                subject_type="user",
+                subject_id=incident.subject_id,
+                scope=risk_repo.SCOPE_ECONOMIC_ACCOUNT,
+            )
             item.update(
                 {
                     "user_id": uid,
@@ -274,12 +282,8 @@ def list_incidents(
                     "common_device_id": _common_device(
                         db, uid, incident.window_start, incident.window_end
                     ),
-                    "restricted": risk_repo.is_restricted(
-                        db,
-                        subject_type="user",
-                        subject_id=incident.subject_id,
-                        scope=risk_repo.SCOPE_ECONOMIC_ACCOUNT,
-                    ),
+                    "restricted": restriction is not None,
+                    "restriction_id": restriction.id if restriction else None,
                 }
             )
         items.append(item)
diff --git a/app/admin/schemas/risk_monitor.py b/app/admin/schemas/risk_monitor.py
index 5a921ee..826393e 100644
--- a/app/admin/schemas/risk_monitor.py
+++ b/app/admin/schemas/risk_monitor.py
@@ -45,6 +45,7 @@ class RiskIncidentItem(BaseModel):
     event_count: int
     status: str
     restricted: bool = False
+    restriction_id: int | None = None
 
 
 class RiskIncidentPage(BaseModel):
diff --git a/tests/test_risk_monitor.py b/tests/test_risk_monitor.py
index 18923b0..b358cd3 100644
--- a/tests/test_risk_monitor.py
+++ b/tests/test_risk_monitor.py
@@ -265,6 +265,22 @@ def test_risk_monitor_ignore_and_block_are_enforced(client: TestClient) -> None:
         device_restriction_id = blocked_device.json()["restriction_id"]
         user_restriction_id = blocked_user.json()["restriction_id"]
 
+        blocked_sms = admin_client.get(
+            "/admin/api/risk-monitor/incidents/sms?status=blocked",
+            headers=headers,
+        )
+        assert blocked_sms.status_code == 200
+        assert blocked_sms.json()["items"][0]["restriction_id"] == device_restriction_id
+        assert blocked_sms.json()["items"][0]["restricted"] is True
+
+        blocked_compare = admin_client.get(
+            "/admin/api/risk-monitor/incidents/compare?status=blocked",
+            headers=headers,
+        )
+        assert blocked_compare.status_code == 200
+        assert blocked_compare.json()["items"][0]["restriction_id"] == user_restriction_id
+        assert blocked_compare.json()["items"][0]["restricted"] is True
+
     denied_sms = client.post(
         "/api/v1/auth/sms/send",
         json={