HHG-003
legitimateClosed — Legitimateno pattern identified
Case HHG-003 was closed as legitimate with a fraud probability of 0.02, as the disputed $49.00 charge on card C08623-K2 matched the customer's established recurring merchant and billing history. Although the customer did not reply to the validation request within the 24-hour window, the lack of response did not alter the low fraud probability or the initial assessment that the activity was contained and in character. The final actions include MONITOR_CARD (auto, R4), CREATE_CASE (auto, R7), VERIFY_WITH_CUSTOMER (auto, R7), and WARN_CUSTOMER (auto, R7), which were retained because the evidence supported a legitimate outcome under Fraud Policy R7.
- exposure
- $0.00
- affected txns
- 0
- connected cards
- 0
- prior cases cited
- 5
stop_reason — Evidence request settled the question: probability reached 0.02 (legitimate); further steps are unlikely to change the decision.
Initial recommendation
before · on the evidence gathered so far- CREATE_CASEAutoR7
- VERIFY_WITH_CUSTOMERAutoR7
- WARN_CUSTOMERAutoR7
Evidence requested
ask · 1 request- customer validationafter step 2
No reply received from the customer within the 24-hour window.
Revised recommendation
after · after the response came back- MONITOR_CARDAutonewR4
- CREATE_CASEAutoR7
- VERIFY_WITH_CUSTOMERAutoR7
- WARN_CUSTOMERAutoR7
The assumed customer validation response (No reply received from the customer within the 24-hour window.) did not move fraud probability (stayed at 0.02); actions are unchanged from the initial recommendation.
Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.
- R1 did not fire
- Single signal only, fraud probability below 0.70 — must precede any block.
- R2 did not fire
- Customer was asked to validate and denied the charge.
- R3 did not fire
- Customer confirmed the charge as their own.
- R4 fired
- No customer reply within 24 hours.
- MONITOR_CARD·auto
- R5 did not fire
- 3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
- R6 did not fire
- Device profile, billing region, or recipient email shared across multiple cards in one window.
- R7 fired — forbid
- Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
- Forbids: BLOCK_CARD, DECLINE_TRANSACTION — blocking is withheld even though the case was flagged.
- CREATE_CASE·autoVERIFY_WITH_CUSTOMER·autoWARN_CUSTOMER·auto
- R8 did not fire
- Verdict uncertain with exposure over $500, or evidence conflicts.
- R9 did not fire
- Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
- R10 did not fire
- BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.
Confirming precedent(3)
- CC-0086
- CC-0161
- CC-0469
Exonerating precedent(2)
- CC-1589shared device
- CC-0264
Cardholder disputes the charge: Customer C08623 message: 'I never made this $49.00 purchase. Please check my card.' Refers to 3530164.
Customertrigger:customer_report(HHG-003)T3530164Structural match (shared device/region/card) with cleared closed case CC-1589 (pattern: none, outcome: cleared)
Graphquery:prior_cases_for_entities(case=CC-1589)CC-1589Precedent (confirming): CC-0086 (confirmed fraud, $83.81 exposure): semantically similar analyst notes (cosine distance 0.31), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0086)CC-0086Precedent (confirming): CC-0161 (confirmed fraud, $300.06 exposure): semantically similar analyst notes (cosine distance 0.32), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0161)CC-0161Precedent (confirming): CC-0469 (confirmed fraud, $104.68 exposure): semantically similar analyst notes (cosine distance 0.33), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0469)CC-0469Precedent (disconfirming): CC-1589 (cleared as legitimate): shares 1 entity (card/device/region) with this alert
Graphquery:prior_case_candidates(case=CC-1589)CC-1589Precedent (disconfirming): CC-0264 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.33), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0264)CC-0264Flagged transaction's product category and billing region match this customer's established history
Graphquery:customer_baseline(customer_id=C08623)T3530164Flagged charge matches this customer's own recurring merchant/amount pattern (monthly)
Graphquery:customer_baseline(customer_id=C08623)T3530164Fraud Policy R7: Forbids immediate card block when disputed charge matches customer's established recurring subscription.
Documentpolicy:R7R7Agent declined to expand the investigation beyond this card -- activity looks contained. Reasoning: NO The findings indicate the activity is in character for this specific customer and matches their recurring merchants, suggesting the transaction is legitimate and contained to this card.
Graphllm_decision:decline_expansion(case=HHG-003)C08623-K2
Confirming precedent
- CC-0086Supports fraud
- CC-0161Supports fraud
- CC-0469Supports fraud
Disconfirming precedent
- CC-1589Exonerates
- CC-0264Exonerates