It knows when it doesn't know yet.

No pattern

Case HHG-001 was reviewed after a real-time model scored transaction 3514030 at 0.61, but the final verdict is legitimate with a fraud probability of 0.08. Key evidence includes the flagged transaction's product category and billing region matching the customer's established history, supported by disconfirming precedents CC-0601 and CC-0077 which were cleared as legitimate. No evidence request was issued, and the agent declined to expand the investigation because the activity appears contained to card C12382-K1 without indicators of a broader campaign. The final action is CLOSE_NO_FRAUD (auto, R0: policy default, settled low, no rule triggered), which was chosen because the findings indicate the activity is in character for the customer and lacks corroborating signals of fraud.

No pattern

Case HHG-002 regarding transaction 3478782 on card C11891-K1 resulted in an uncertain verdict with a fraud probability of 0.17, as the real-time model score of 0.79 was not corroborated by other signals and the customer did not reply to the validation request within the 24-hour window. The evidence presented mixed signals, including three confirming precedents (CC-0712, CC-0783, CC-0762) and two disconfirming precedents (CC-0678, CC-0702), all lacking direct structural overlap. Consequently, the final actions include VERIFY_WITH_CUSTOMER (auto, R1), STEP_UP_AUTH (auto, R1), MONITOR_CARD (auto, R4), and DECLINE_TRANSACTION (L1, R4), with the latter recommended under rule R4 via route L1 pending approval. The investigation remains unresolved due to the lack of definitive evidence linking the activity to a broader fraud campaign or shared devices.

No pattern

Case HHG-003 was closed as legitimate with a fraud probability of 0.02, as the disputed $49.00 charge on card C08623-K2 matched the customer's established recurring merchant and billing history. Although the customer did not reply to the validation request within the 24-hour window, the lack of response did not alter the low fraud probability or the initial assessment that the activity was contained and in character. The final actions include MONITOR_CARD (auto, R4), CREATE_CASE (auto, R7), VERIFY_WITH_CUSTOMER (auto, R7), and WARN_CUSTOMER (auto, R7), which were retained because the evidence supported a legitimate outcome under Fraud Policy R7.

card not present new device

Case HHG-004 concludes with an uncertain verdict and a fraud probability of 0.21, driven by customer C08106's denial of a $128.33 charge on card C08106-K1 and the use of a device marked as new to the account. The investigation was hampered by a refused device_neighbors query due to an invalid parameter and an expired step-up authentication request, which raised the probability from 0.18 to 0.21. Although three prior cases (CC-0584, CC-0086, CC-0283) semantically support fraud, the lack of a definitive device link and the presence of disconfirming precedents (CC-0696, CC-0308) leave the matter unresolved. Consequently, the final action remains MONITOR_CARD (auto, R0: policy default, below case-creation threshold), as the evidence did not meet the threshold for escalation.

No pattern

Case HHG-005 is closed as legitimate with a fraud probability of 0.12, based on the finding that transaction 3523199 for $100.07 on card C02923-K1 matched the customer's established product category and billing region despite occurring on a new device. The investigation reached its maximum depth limit after two attempts to query device neighbors for device_id_15 were refused because the identifier was recognized as a raw dataset column name rather than a valid entity ID. The final action of CLOSE_NO_FRAUD was selected via the auto route under rule R0: policy default, settled low, no rule triggered, reflecting the lack of corroborating fraud evidence and the resolution of the initial model score of 0.54.

undocumented

Case HHG-006 resulted in an uncertain verdict with a fraud probability of 0.58, driven by four online purchases on card C07297-K1 totaling $1,906.07 that were structured just under the $500 authorization threshold from a new device. The investigation relied on the customer's dispute of transaction T3476682 and the structural anomaly, while a proposed device neighbor query was refused because the provided identifier appeared to be a raw dataset column name rather than a valid entity ID. The step-up authentication evidence request expired unanswered within the window, which increased the fraud probability from 0.53 to 0.58 and prevented a definitive resolution. Consequently, the final action was ESCALATE_TO_ANALYST (auto, R8), as the case remained unresolved due to the undocumented pattern and lack of customer verification required by Fraud Policy R1.

No pattern

Case HHG-007 was reviewed after a real-time model scored transaction 3514948 at 0.87, but the final verdict is legitimate with a fraud probability of 0.12. The key evidence indicates that while a new device marker was present, the transaction's product category and billing region matched the customer's established history, and disconfirming precedents CC-0388 and CC-0248 supported a legitimate outcome. An evidence request to expand the investigation to the shared-device neighborhood was refused because the provided identifier appeared to be a raw dataset column name rather than a valid entity ID. The final action of CLOSE_NO_FRAUD was chosen via the auto route under rule R0: policy default, settled low, no rule triggered, as no new information changed the initial assessment.

card not present new device

Case HHG-008 resulted in an uncertain verdict with a fraud probability of 0.33, as the disputed $55.68 charge matched the customer's established recurring subscription pattern, which Policy R7 explicitly forbids from triggering an immediate card block. Although the transaction originated from a device marked as new and structurally matched confirmed fraud case CC-0056, the step-up authentication request expired unanswered, raising the probability from 0.29 to 0.33 and preventing a definitive clearance. The final actions of CREATE_CASE, VERIFY_WITH_CUSTOMER, and WARN_CUSTOMER were all executed via the auto route under rule R7, reflecting the policy constraint that prioritizes customer verification over immediate blocking when recurring patterns are present.

No pattern

Case HHG-009 was closed with a verdict of legitimate and a fraud probability of 0.09, as the disputed $30.02 charge on card C08299-K1 matched the customer's established recurring merchant and amount patterns despite a new device marker. The key evidence included the customer's dispute message and the alignment of the transaction with their baseline history, which triggered Fraud Policy R7 to forbid an immediate card block. An evidence request for step-up authentication expired unanswered, which raised the fraud probability from 0.07 to 0.09 and influenced the final recommended actions. The final actions consisted of CREATE_CASE (auto, R7), VERIFY_WITH_CUSTOMER (auto, R7), and WARN_CUSTOMER (auto, R7), reflecting the policy-driven response to a recurring subscription dispute without corroborating fraud.

No pattern

Case HHG-010 was reviewed after a real-time model scored transaction 3506725 for $1,000.03 at a high risk of 0.90, but the final verdict is legitimate with a fraud probability of 0.12. The key evidence indicates that while the transaction originated from a device marked as new, the product category and billing region align with the customer's established history, and the agent's request to expand the investigation to the shared-device neighborhood was refused because the provided parameter appeared to be a raw dataset column name rather than a valid entity ID. The final action of CLOSE_NO_FRAUD was selected via the auto route under rule R0, which serves as the policy default for settled low-risk cases where no specific rule is triggered.

card not present new device

Case HHG-011 resulted in an uncertain verdict with a fraud probability of 0.33, as the disputed $131.30 charge on card C11923-K2 matched the customer's established recurring subscription pattern, which conflicts with the new device marker and structural similarities to prior fraud cases. The step-up authentication request expired unanswered, which raised the fraud probability from 0.29 to 0.33 and triggered the final recommended actions. Consequently, the case was handled via CREATE_CASE (auto, R7), VERIFY_WITH_CUSTOMER (auto, R7), WARN_CUSTOMER (auto, R7), and ESCALATE_TO_ANALYST (auto, R8). These actions were chosen because Fraud Policy R7 forbids immediate card blocking when a disputed charge matches a customer's recurring pattern, while Policy R8 mandates escalation when the investigation cannot reach a confident verdict.

No pattern

Case HHG-012 was reviewed after a real-time model scored transaction 3553342 at 0.55, but the final verdict is legitimate with a fraud probability of 0.12. Key evidence indicates that the flagged transaction's product category and billing region match the customer's established history, and while a new device marker was noted, no corroborating fraud evidence was found. An evidence request to expand the investigation to the shared-device neighbourhood was refused because the provided parameter appeared to be a raw dataset column name rather than a valid entity ID, and a subsequent generated traversal failed to execute due to an event loop error. The final action of CLOSE_NO_FRAUD was chosen via the auto route under rule R0: policy default, settled low, no rule triggered, as no new information changed the initial assessment.

card not present new device

Case HHG-013 resulted in an uncertain verdict with a fraud probability of 0.27, as the investigation reached its maximum depth limit and the step-up authentication request expired unanswered. Key evidence included a $35.66 online transaction on card C07671-K2 from a new device, supported by mixed precedent signals from cases CC-0707, CC-0446, and CC-0046 confirming fraud versus CC-0526 and CC-0726 clearing as legitimate. The agent's attempt to expand the investigation to the shared-device neighborhood was refused because the proposed device_id_15 was identified as a raw dataset column name rather than a valid entity ID. Consequently, the final action was set to MONITOR_CARD (auto, R0: policy default, below case-creation threshold) because the expired authentication response raised the probability from 0.23 to 0.27, leaving the case below the threshold for more severe intervention.

undocumented

Case HHG-014 resulted in a fraud verdict with a probability of 0.61, driven by transaction T3478561 on card C13487-K1 which originated from a device profile shared across 18 unrelated customers within a 7-day window. The evidence request for customer validation yielded no reply within the 24-hour window, leaving the fraud probability unchanged and confirming the initial assessment. The final actions include MONITOR_CARD via auto route under R4, DECLINE_TRANSACTION via L1 route under R4, CREATE_CASE via auto route under R6, FILE_REPORT via L2 route under R6, and MONITOR_CONNECTED_CARDS via auto route under R6. These actions were selected because the shared device profile constitutes a coordinated ring, triggering mandatory card block, case creation, and supervisory escalation under Fraud Policy R6, while also requiring Suspicious Activity Reports per FinCEN Advisory.

out of region use

Case HHG-015 resulted in an uncertain verdict with a fraud probability of 0.46, driven by transaction T3464869 for $599.94 on card C03042-K1 which occurred on a new device in region 327.0, outside the cardholder's historical regions, and only 22.9 hours after a transaction in region 299.0, creating an impossible travel scenario indicative of a clone. The investigation attempted to expand to the shared-device neighborhood but the proposed device_neighbors query was refused because the parameter device_id_15 appeared to be a raw dataset column name rather than a valid entity ID, and the step-up authentication request expired unanswered within the window. The final action of ESCALATE_TO_ANALYST was chosen via the auto route under rule R8, as the expired authentication response raised the probability from 0.41 to 0.46 and the case could not reach a confident verdict due to the unresolved nature of the out_of_region_use pattern.

card not present new device

Case HHG-016 resulted in an uncertain verdict with a fraud probability of 0.38, driven by customer C09988's dispute of transaction T3534820 ($59.67) on card C09988-K1, which originated from a device marked as new to the account. The investigation was constrained by the expiration of the step-up authentication request and the refusal of device neighbor queries due to invalid entity IDs, leaving the new device marker and mixed precedent cases as the primary evidence. The final actions of CREATE_CASE (auto, R0: 3a, fraud_probability >= 0.30) and MONITOR_CARD (auto, R0: policy default, keep watching while case is open) were selected because the unresolved authentication response raised the probability from 0.33 to 0.38, triggering the specific rule thresholds for case creation and continued monitoring.

No pattern

Case HHG-017 was reviewed after a real-time model scored transaction 3450629 at 0.57, but the final verdict is legitimate with a fraud probability of 0.08. Key evidence includes the flagged transaction's product category and billing region matching the customer's established history, alongside disconfirming precedents CC-0776 and CC-0175 that were cleared as legitimate. No evidence request was issued, and the agent declined to expand the investigation because the activity appears contained to card C04570-K1 without indicators of a broader campaign. The final action is CLOSE_NO_FRAUD via the auto route under R0: policy default, settled low, no rule triggered, which was chosen because the findings indicate the activity is in character for the customer.

card not present new device

Case HHG-018 remains uncertain with a fraud probability of 0.18, as the step-up authentication request expired unanswered, which raised the risk score from 0.15 and prevented a definitive conclusion on the card_not_present_new_device pattern. Key evidence includes the customer's dispute of a $39.08 charge and two online transactions totaling $150.06 from a new device, which structurally match confirmed fraud case CC-4942 but also align with the customer's established recurring merchant history and billing region. The final actions of CREATE_CASE, VERIFY_WITH_CUSTOMER, and WARN_CUSTOMER were all executed via the auto route under rule R7, which forbids immediate card blocking when a disputed charge matches an established subscription. Because the investigation could not reach a confident verdict, the case was escalated per policy to resolve the conflicting signals between the new device usage and the customer's normal spending habits.

No pattern

Case HHG-019 was reviewed after a real-time model scored transaction 3503878 ($99.92, online) at 0.90, but the final verdict is legitimate with a fraud probability of 0.12. Key evidence indicates the transaction originated from a device marked 'New' (id_15=New), yet the product category and billing region align with the customer's established history, and disconfirming precedents CC-0678 and CC-0388 support a legitimate classification. The agent's request to expand the investigation to the shared-device neighborhood using device_neighbors(device_id=device_id_15) was refused because the parameter appeared to be a raw dataset column name rather than a valid entity ID. Consequently, the final action remains CLOSE_NO_FRAUD (auto, R0: policy default, settled low, no rule triggered), as the initial assessment was upheld without changes.

card not present new device

Case HHG-020 resulted in an uncertain verdict with a fraud probability of 0.27, driven by transaction T3509359 on card C12265-K2 which originated from a device marked as new for customer C12265. The evidence presented a mixed signal, as three confirming precedents (CC-0667, CC-0309, CC-0659) were counterbalanced by two disconfirming legitimate cases (CC-0175, CC-0736), while attempts to expand the investigation into the device neighborhood were refused because the proposed identifier id_15 was deemed a raw dataset column name rather than a valid entity. The step_up_auth evidence request expired unanswered within the window, which raised the fraud probability from 0.23 to 0.27 and altered the recommended course of action. Consequently, the final action chosen was MONITOR_CARD via the auto route under rule R0: policy default, below case-creation threshold, reflecting the inability to gather further structural verification due to the depth limit and contradictory precedent matches.