TracewiseCase ConsoleFraud Investigation Agent
all cases

HHG-004

uncertainOpen

card not present new device

Case HHG-004 concludes with an uncertain verdict and a fraud probability of 0.21, driven by customer C08106's denial of a $128.33 charge on card C08106-K1 and the use of a device marked as new to the account. The investigation was hampered by a refused device_neighbors query due to an invalid parameter and an expired step-up authentication request, which raised the probability from 0.18 to 0.21. Although three prior cases (CC-0584, CC-0086, CC-0283) semantically support fraud, the lack of a definitive device link and the presence of disconfirming precedents (CC-0696, CC-0308) leave the matter unresolved. Consequently, the final action remains MONITOR_CARD (auto, R0: policy default, below case-creation threshold), as the evidence did not meet the threshold for escalation.

exposure
$221.19
affected txns
2
connected cards
0
prior cases cited
5
uncertain
fraud probability
0.150.300.700.85

stop_reason — Evidence request settled the question: probability reached 0.21 (uncertain); further steps are unlikely to change the decision.

recommendation historyunchanged

Initial recommendation

before · on the evidence gathered so far
  1. MONITOR_CARDAutoR0: policy default, below case-creation threshold

Evidence requested

ask · 1 request
  • step up authafter step 3

    Step-up authentication request expired unanswered within the window.

Final recommendation

after · no revision required
  1. MONITOR_CARDAutoR0: policy default, below case-creation threshold

The assumed step up auth response (Step-up authentication request expired unanswered within the window.) raised fraud probability from 0.18 to 0.21, changing the recommended actions.

entity neighbourhood1 cards · 0 devices
HHG-004-CARD
shared devicecard under investigationflaggedconnected card
policy trace · R1–R100 of 10 predicates fired

Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.

R1
did not fire
Single signal only, fraud probability below 0.70 — must precede any block.
R2
did not fire
Customer was asked to validate and denied the charge.
R3
did not fire
Customer confirmed the charge as their own.
R4
did not fire
No customer reply within 24 hours.
R5
did not fire
3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
R6
did not fire
Device profile, billing region, or recipient email shared across multiple cards in one window.
R7
did not fire
Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
R8
did not fire
Verdict uncertain with exposure over $500, or evidence conflicts.
R9
did not fire
Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
R10
did not fire
BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
precedent retrieval · graphRAG5 cases retrieved

The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.

Confirming precedent(3)

  • CC-0584
  • CC-0086
  • CC-0283

Exonerating precedent(2)

  • CC-0696shared device
  • CC-0308

Drawn from 5,565 closed investigations.

evidence ledger · 12 itemsprovenance & signals

  • Cardholder disputes the charge: Customer C08106 message: 'I never made this $128.33 purchase. Please check my card.' Refers to 3583227.

    Customer
    trigger:customer_report(HHG-004)T3583227

  • 2 online transaction(s) on card C08106-K1 -- T3580804 ($92.86), T3583227 ($128.33) -- came from a device first marked 'New' for this account (id_15=New)

    Graph
    query:card_window(card_id=C08106-K1)T3580804T3583227

  • Structural match (shared device/region/card) with cleared closed case CC-0696 (pattern: none, outcome: cleared)

    Graph
    query:prior_cases_for_entities(case=CC-0696)CC-0696

  • Precedent (confirming): CC-0584 (confirmed fraud, $128.30 exposure): semantically similar analyst notes (cosine distance 0.31), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0584)CC-0584

  • Precedent (confirming): CC-0086 (confirmed fraud, $83.81 exposure): semantically similar analyst notes (cosine distance 0.32), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0086)CC-0086

  • Precedent (confirming): CC-0283 (confirmed fraud, $149.93 exposure): semantically similar analyst notes (cosine distance 0.32), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0283)CC-0283

  • Precedent (disconfirming): CC-0696 (cleared as legitimate): shares 1 entity (card/device/region) with this alert

    Graph
    query:prior_case_candidates(case=CC-0696)CC-0696

  • Precedent (disconfirming): CC-0308 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.34), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0308)CC-0308

  • Agent elected to expand the investigation to the shared-device neighbourhood. Reasoning: YES The new device marker indicates a potential shared device that could be linked to other compromised cards.

    Graph
    llm_decision:expand_device_neighbourhood(case=HHG-004)C08106-K1

  • Agent proposed device_neighbors(device_id=device_id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'device_id_15', 'anchor': '2016-12-29 07:53:54', 'hours': 720}

    Graph
    llm_plan:rejected(column_as_id, depth=1)

  • card_window returned 48 connected entities at depth 2. Reasoning: The goal is to find the device identifier associated with the 'New' marker for card C08106-K1. The identifier 'device_id_15' is a column name, not a value, so it cannot be used directly in a query that requires a specific device ID. The 'card_window' query retrieves transactions for the specified card within the last 720 hours, which will reveal the actual device IDs used, allowing us to identify the one marked as 'New'.

    Graph
    query:card_window(card_id=C08106-K1, anchor=2016-12-29 07:53:54, hours=720)350426535808043521229358572635531923583227355243935419723514703349918835530843508384356127035607513550051352124334988443569296351415335419213504647356159335118343521237355313535141993514168358401735123513568649358350335704123560218355243135418883587858351830534976003521219352115934975033585446358349935211993532758355899435141223562049

  • Confidence check on gathered evidence: medium -- The investigation has reached its maximum depth limit (3 of 3). While the specific device neighborhood query was rejected due to a parameter error, sufficient evidence exists for a defensible handoff: the customer explicitly denies the transaction, the transaction occurred on a device marked 'New' to the account, and there are three semantically similar confirmed fraud precedents (CC-0584, CC-0086, CC-0283) with close cosine distances. Although there is one disconfirming structural match (CC-0696) and one disconfirming semantic match (CC-0308), the combination of customer denial, new device usage, and strong semantic alignment with confirmed fraud cases provides a reasonable basis for the policy engine to evaluate. Further digging is impossible due to the depth limit.

    Graph
    llm_decision:confidence_gate(case=HHG-004, depth=3)
prior cases · memory5 cited

Confirming precedent

  • CC-0584Supports fraud
  • CC-0086Supports fraud
  • CC-0283Supports fraud

Disconfirming precedent

  • CC-0696Exonerates
  • CC-0308Exonerates
Stop reasonEvidence request settled the question: probability reached 0.21 (uncertain); further steps are unlikely to change the decision.
Tool calls0
Tokens0
Latency0.0s