HHG-001
legitimateClosed — Legitimateno pattern identified
Case HHG-001 was reviewed after a real-time model scored transaction 3514030 at 0.61, but the final verdict is legitimate with a fraud probability of 0.08. Key evidence includes the flagged transaction's product category and billing region matching the customer's established history, supported by disconfirming precedents CC-0601 and CC-0077 which were cleared as legitimate. No evidence request was issued, and the agent declined to expand the investigation because the activity appears contained to card C12382-K1 without indicators of a broader campaign. The final action is CLOSE_NO_FRAUD (auto, R0: policy default, settled low, no rule triggered), which was chosen because the findings indicate the activity is in character for the customer and lacks corroborating signals of fraud.
- exposure
- $0.00
- affected txns
- 0
- connected cards
- 0
- prior cases cited
- 5
stop_reason — Probability 0.08 with at least two independent evidence sources supporting no fraud; stopping per policy §6.
Initial recommendation
before · on the evidence gathered so far- CLOSE_NO_FRAUDAutoR0: policy default, settled low, no rule triggered
Final recommendation
after · no revision required- CLOSE_NO_FRAUDAutoR0: policy default, settled low, no rule triggered
The evidence settled the question without changing the recommended course of action.
Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.
- R1 did not fire
- Single signal only, fraud probability below 0.70 — must precede any block.
- R2 did not fire
- Customer was asked to validate and denied the charge.
- R3 did not fire
- Customer confirmed the charge as their own.
- R4 did not fire
- No customer reply within 24 hours.
- R5 did not fire
- 3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
- R6 did not fire
- Device profile, billing region, or recipient email shared across multiple cards in one window.
- R7 did not fire
- Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
- R8 did not fire
- Verdict uncertain with exposure over $500, or evidence conflicts.
- R9 did not fire
- Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
- R10 did not fire
- BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.
Confirming precedent(3)
- CC-0414
- CC-0707
- CC-0775
Exonerating precedent(2)
- CC-0601
- CC-0077
Precedent (confirming): CC-0414 (confirmed fraud, $35.00 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0414)CC-0414Precedent (confirming): CC-0707 (confirmed fraud, $35.06 exposure): semantically similar analyst notes (cosine distance 0.29), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0707)CC-0707Precedent (confirming): CC-0775 (confirmed fraud, $310.91 exposure): semantically similar analyst notes (cosine distance 0.29), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0775)CC-0775Precedent (disconfirming): CC-0601 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.22), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0601)CC-0601Precedent (disconfirming): CC-0077 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.22), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0077)CC-0077Model risk score 0.61 on the flagged transaction, no other corroborating signal found
Graphquery:card_window(card_id=C12382-K1, hours=2)T3514030Flagged transaction's product category and billing region match this customer's established history
Graphquery:customer_baseline(customer_id=C12382)T3514030Agent declined to expand the investigation beyond this card -- activity looks contained. Reasoning: NO The findings indicate the activity is in character for the customer and lacks indicators of a broader campaign or shared device compromise.
Graphllm_decision:decline_expansion(case=HHG-001)C12382-K1
Confirming precedent
- CC-0414Supports fraud
- CC-0707Supports fraud
- CC-0775Supports fraud
Disconfirming precedent
- CC-0601Exonerates
- CC-0077Exonerates