HHG-006

uncertainEscalated

undocumented

Authorization-threshold structuring: several online purchases on one card within an hour, each priced just under $500, consistent with amounts chosen to stay below a $500 authorization limit. Not one of the five documented patterns; matches the bank's own closed cases labelled undocumented (CC-3748, CC-3841, CC-3907, CC-4086, CC-4124).

Case HHG-006 resulted in an uncertain verdict with a fraud probability of 0.58, driven by four online purchases on card C07297-K1 totaling $1,906.07 that were structured just under the $500 authorization threshold from a new device. The investigation relied on the customer's dispute of transaction T3476682 and the structural anomaly, while a proposed device neighbor query was refused because the provided identifier appeared to be a raw dataset column name rather than a valid entity ID. The step-up authentication evidence request expired unanswered within the window, which increased the fraud probability from 0.53 to 0.58 and prevented a definitive resolution. Consequently, the final action was ESCALATE_TO_ANALYST (auto, R8), as the case remained unresolved due to the undocumented pattern and lack of customer verification required by Fraud Policy R1.

exposure: $1,906.07
affected txns: 4
connected cards: 0
prior cases cited: 10

uncertain

fraud probability

0.150.300.700.85

stop_reason — Evidence request settled the question: probability reached 0.58 (uncertain); further steps are unlikely to change the decision.

recommendation historyunchanged

Initial recommendation

before · on the evidence gathered so far

ESCALATE_TO_ANALYSTAutoR8

Evidence requested

ask · 1 request

step up authafter step 3
Step-up authentication request expired unanswered within the window.

Final recommendation

after · no revision required

ESCALATE_TO_ANALYSTAutoR8

The assumed step up auth response (Step-up authentication request expired unanswered within the window.) raised fraud probability from 0.53 to 0.58, changing the recommended actions.

entity neighbourhood1 cards · 0 devices

shared devicecard under investigationflaggedconnected card

policy trace · R1–R101 of 10 predicates fired

Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.

R1: Single signal only, fraud probability below 0.70 — must precede any block.
R2: Customer was asked to validate and denied the charge.
R3: Customer confirmed the charge as their own.
R4: No customer reply within 24 hours.
R5: 3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
R6: Device profile, billing region, or recipient email shared across multiple cards in one window.
R7: Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
R8: Verdict uncertain with exposure over $500, or evidence conflicts.; ESCALATE_TO_ANALYST·auto
R9: Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
R10: BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.

precedent retrieval · graphRAG10 cases retrieved

The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.

Confirming precedent(6)

CC-0485
CC-0668
CC-0076
CC-3748pattern match
CC-3841pattern match
CC-3907pattern match

Exonerating precedent(2)

CC-0489
CC-0683

Referenced, outcome not stated in evidence (2)

CC-4086
CC-4124

evidence ledger · 14 itemsprovenance & signals

Cardholder disputes the charge: Customer C07297 message: 'I never made this $482.12 purchase. Please check my card.' Refers to 3476682.
Customer
trigger:customer_report(HHG-006)T3476682
4 online purchases on card C07297-K1 within 30 minutes, each just under $500 ($478.95, $456.96, $488.04, $482.12) -- consistent with structuring below a $500 authorization threshold, as in closed cases CC-3748, CC-3841, CC-3907
Graph
detector:threshold_structuring(card_id=C07297-K1)T3476602T3476633T3476665T3476682
4 online transaction(s) on card C07297-K1 -- T3476602 ($478.95), T3476633 ($456.96), T3476665 ($488.04), T3476682 ($482.12) -- came from a device first marked 'New' for this account (id_15=New)
Graph
query:card_window(card_id=C07297-K1)T3476602T3476633T3476665T3476682
Precedent (confirming): CC-0485 (confirmed fraud, $299.97 exposure): semantically similar analyst notes (cosine distance 0.33), no direct structural overlap
Graph
query:prior_case_candidates(case=CC-0485)CC-0485
Precedent (confirming): CC-0668 (confirmed fraud, $382.55 exposure): semantically similar analyst notes (cosine distance 0.33), no direct structural overlap
Graph
query:prior_case_candidates(case=CC-0668)CC-0668
Precedent (confirming): CC-0076 (confirmed fraud, $299.85 exposure): semantically similar analyst notes (cosine distance 0.33), no direct structural overlap
Graph
query:prior_case_candidates(case=CC-0076)CC-0076
Precedent (disconfirming): CC-0489 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.32), no direct structural overlap
Graph
query:prior_case_candidates(case=CC-0489)CC-0489
Precedent (disconfirming): CC-0683 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.33), no direct structural overlap
Graph
query:prior_case_candidates(case=CC-0683)CC-0683
Fraud Policy R1: Requires customer verification before card block when alert rests on single unconfirmed signal.
Document
policy:R1R1
FinCEN Guidance: Mandates reporting of structured transactions designed to evade authorization thresholds.
Document
reg:fincen_sar_narrative:0SAR
Agent elected to expand the investigation to the shared-device neighbourhood. Reasoning: YES The new device marker suggests the device may be shared with other cards, warranting a check for broader compromise.
Graph
llm_decision:expand_device_neighbourhood(case=HHG-006)C07297-K1
Agent proposed device_neighbors(device_id=device_id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'device_id_15', 'anchor': '2016-11-22 02:30:00', 'hours': 2160}
Graph
llm_plan:rejected(column_as_id, depth=1)
Agent proposed device_neighbors(device_id=device_id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'device_id_15', 'anchor': '2016-11-22 02:30:00', 'hours': 2160}
Graph
llm_plan:rejected(column_as_id, depth=2)
Confidence check on gathered evidence: high -- The evidence presents a clear and consistent pattern of threshold structuring (four transactions just under $500 within 30 minutes) from a new device, which is a strong fraud signal. This is corroborated by three confirmed fraud precedents with similar semantic profiles. Although two disconfirming precedents exist, they are outweighed by the specific structural anomaly and the customer's denial. The investigation has reached its depth limit (3 of 3), and further queries (such as the rejected device neighbor checks) are not viable or necessary given the strength of the current signals. The policy engine can now process this high-confidence signal for a final verdict.
Graph
llm_decision:confidence_gate(case=HHG-006, depth=3)

prior cases · memory10 cited

Confirming precedent

CC-0485Supports fraud
CC-0668Supports fraud
CC-0076Supports fraud

Disconfirming precedent

CC-0489Exonerates
CC-0683Exonerates

CC-3748Referenced
CC-3841Referenced
CC-3907Referenced
CC-4086Referenced
CC-4124Referenced

Stop reasonEvidence request settled the question: probability reached 0.58 (uncertain); further steps are unlikely to change the decision.

Tool calls0

Tokens0

Latency0.0s