TracewiseCase ConsoleFraud Investigation Agent
all cases

HHG-002

uncertainOpen

no pattern identified

Case HHG-002 regarding transaction 3478782 on card C11891-K1 resulted in an uncertain verdict with a fraud probability of 0.17, as the real-time model score of 0.79 was not corroborated by other signals and the customer did not reply to the validation request within the 24-hour window. The evidence presented mixed signals, including three confirming precedents (CC-0712, CC-0783, CC-0762) and two disconfirming precedents (CC-0678, CC-0702), all lacking direct structural overlap. Consequently, the final actions include VERIFY_WITH_CUSTOMER (auto, R1), STEP_UP_AUTH (auto, R1), MONITOR_CARD (auto, R4), and DECLINE_TRANSACTION (L1, R4), with the latter recommended under rule R4 via route L1 pending approval. The investigation remains unresolved due to the lack of definitive evidence linking the activity to a broader fraud campaign or shared devices.

exposure
$292.36
affected txns
1
connected cards
0
prior cases cited
5
uncertain
fraud probability
0.150.300.700.85

stop_reason — Evidence request settled the question: probability reached 0.17 (uncertain); further steps are unlikely to change the decision.

recommendation historyrevised after evidence

Initial recommendation

before · on the evidence gathered so far
  1. VERIFY_WITH_CUSTOMERAutoR1
  2. STEP_UP_AUTHAutoR1

Evidence requested

ask · 1 request
  • customer validationafter step 3

    No reply received from the customer within the 24-hour window.

Revised recommendation

after · after the response came back
  1. VERIFY_WITH_CUSTOMERAutoR1
  2. STEP_UP_AUTHAutoR1
  3. MONITOR_CARDAutonewR4
  4. DECLINE_TRANSACTIONL1 approvalnewR4

The assumed customer validation response (No reply received from the customer within the 24-hour window.) did not move fraud probability (stayed at 0.17); actions are unchanged from the initial recommendation.

awaiting human approval

DECLINE_TRANSACTIONL1 approval

R4

entity neighbourhood1 cards · 0 devices
HHG-002-CARD
shared devicecard under investigationflaggedconnected card
policy trace · R1–R102 of 10 predicates fired

Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.

R1
fired
Single signal only, fraud probability below 0.70 — must precede any block.
VERIFY_WITH_CUSTOMER·autoSTEP_UP_AUTH·auto
R2
did not fire
Customer was asked to validate and denied the charge.
R3
did not fire
Customer confirmed the charge as their own.
R4
fired
No customer reply within 24 hours.
MONITOR_CARD·autoDECLINE_TRANSACTION·L1
R5
did not fire
3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
R6
did not fire
Device profile, billing region, or recipient email shared across multiple cards in one window.
R7
did not fire
Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
R8
did not fire
Verdict uncertain with exposure over $500, or evidence conflicts.
R9
did not fire
Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
R10
did not fire
BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
precedent retrieval · graphRAG5 cases retrieved

The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.

Confirming precedent(3)

  • CC-0712
  • CC-0783
  • CC-0762

Exonerating precedent(2)

  • CC-0678
  • CC-0702

Drawn from 5,565 closed investigations.

evidence ledger · 7 itemsprovenance & signals

  • Precedent (confirming): CC-0712 (confirmed fraud, $7.82 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0712)CC-0712

  • Precedent (confirming): CC-0783 (confirmed fraud, $99.92 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0783)CC-0783

  • Precedent (confirming): CC-0762 (confirmed fraud, $58.02 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0762)CC-0762

  • Precedent (disconfirming): CC-0678 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.21), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0678)CC-0678

  • Precedent (disconfirming): CC-0702 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.21), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0702)CC-0702

  • Model risk score 0.79 on the flagged transaction, no other corroborating signal found

    Graph
    query:card_window(card_id=C11891-K1, hours=2)T3478782

  • Agent declined to expand the investigation beyond this card -- activity looks contained. Reasoning: NO The findings are limited to a single risk score trigger without evidence of shared devices or broader campaign activity.

    Graph
    llm_decision:decline_expansion(case=HHG-002)C11891-K1
prior cases · memory5 cited

Confirming precedent

  • CC-0712Supports fraud
  • CC-0783Supports fraud
  • CC-0762Supports fraud

Disconfirming precedent

  • CC-0678Exonerates
  • CC-0702Exonerates
Stop reasonEvidence request settled the question: probability reached 0.17 (uncertain); further steps are unlikely to change the decision.
Tool calls0
Tokens0
Latency0.0s