TracewiseCase ConsoleFraud Investigation Agent
all cases

HHG-008

uncertainOpen

card not present new device

Case HHG-008 resulted in an uncertain verdict with a fraud probability of 0.33, as the disputed $55.68 charge matched the customer's established recurring subscription pattern, which Policy R7 explicitly forbids from triggering an immediate card block. Although the transaction originated from a device marked as new and structurally matched confirmed fraud case CC-0056, the step-up authentication request expired unanswered, raising the probability from 0.29 to 0.33 and preventing a definitive clearance. The final actions of CREATE_CASE, VERIFY_WITH_CUSTOMER, and WARN_CUSTOMER were all executed via the auto route under rule R7, reflecting the policy constraint that prioritizes customer verification over immediate blocking when recurring patterns are present.

exposure
$302.33
affected txns
8
connected cards
0
prior cases cited
5
uncertain
fraud probability
0.150.300.700.85

stop_reason — Evidence request settled the question: probability reached 0.33 (uncertain); further steps are unlikely to change the decision.

recommendation historyunchanged

Initial recommendation

before · on the evidence gathered so far
  1. CREATE_CASEAutoR7
  2. VERIFY_WITH_CUSTOMERAutoR7
  3. WARN_CUSTOMERAutoR7

Evidence requested

ask · 1 request
  • step up authafter step 3

    Step-up authentication request expired unanswered within the window.

Final recommendation

after · no revision required
  1. CREATE_CASEAutoR7
  2. VERIFY_WITH_CUSTOMERAutoR7
  3. WARN_CUSTOMERAutoR7

The assumed step up auth response (Step-up authentication request expired unanswered within the window.) raised fraud probability from 0.29 to 0.33, changing the recommended actions.

entity neighbourhood1 cards · 0 devices
HHG-008-CARD
shared devicecard under investigationflaggedconnected card
policy trace · R1–R101 of 10 predicates fired

Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.

R1
did not fire
Single signal only, fraud probability below 0.70 — must precede any block.
R2
did not fire
Customer was asked to validate and denied the charge.
R3
did not fire
Customer confirmed the charge as their own.
R4
did not fire
No customer reply within 24 hours.
R5
did not fire
3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
R6
did not fire
Device profile, billing region, or recipient email shared across multiple cards in one window.
R7
fired — forbid
Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
Forbids: BLOCK_CARD, DECLINE_TRANSACTION — blocking is withheld even though the case was flagged.
CREATE_CASE·autoVERIFY_WITH_CUSTOMER·autoWARN_CUSTOMER·auto
R8
did not fire
Verdict uncertain with exposure over $500, or evidence conflicts.
R9
did not fire
Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
R10
did not fire
BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
precedent retrieval · graphRAG5 cases retrieved

The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.

Confirming precedent(3)

  • CC-0056shared device
  • CC-0558
  • CC-0540

Exonerating precedent(2)

  • CC-4819shared device
  • CC-0553

Drawn from 5,565 closed investigations.

evidence ledger · 14 itemsprovenance & signals

  • Cardholder disputes the charge: Customer C13171 message: 'I never made this $55.68 purchase. Please check my card.' Refers to 3558054.

    Customer
    trigger:customer_report(HHG-008)T3558054

  • 8 online transaction(s) on card C13171-K2 -- T3551412 ($4.67), T3553223 ($45.75), T3554288 ($78.56), T3554589 ($11.91), T3554683 ($85.57), T3555638 ($11.85), T3556719 ($8.33), T3557987 ($55.69) -- came from a device first marked 'New' for this account (id_15=New)

    Graph
    query:card_window(card_id=C13171-K2)T3551412T3553223T3554288T3554589T3554683T3555638T3556719T3557987

  • Structural match (shared device/region/card) with confirmed-fraud closed case CC-0056 (pattern: card_not_present_new_device)

    Graph
    query:prior_cases_for_entities(case=CC-0056)CC-0056

  • Precedent (confirming): CC-0056 (confirmed fraud, $40.21 exposure): shares 1 entity (card/device/region) with this alert

    Graph
    query:prior_case_candidates(case=CC-0056)CC-0056

  • Precedent (confirming): CC-0558 (confirmed fraud, $150.09 exposure): semantically similar analyst notes (cosine distance 0.29), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0558)CC-0558

  • Precedent (confirming): CC-0540 (confirmed fraud, $45.58 exposure): semantically similar analyst notes (cosine distance 0.30), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0540)CC-0540

  • Precedent (disconfirming): CC-4819 (cleared as legitimate): shares 1 entity (card/device/region) with this alert

    Graph
    query:prior_case_candidates(case=CC-4819)CC-4819

  • Precedent (disconfirming): CC-0553 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.34), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0553)CC-0553

  • Flagged charge matches this customer's own recurring merchant/amount pattern (monthly)

    Graph
    query:customer_baseline(customer_id=C13171)T3558054

  • Fraud Policy R7: Forbids immediate card block when disputed charge matches customer's established recurring subscription.

    Document
    policy:R7R7

  • Agent elected to expand the investigation to the shared-device neighbourhood. Reasoning: YES The combination of a new device marker and a match to a previously closed fraud case strongly suggests the device is part of a broader attack campaign affecting other cards.

    Graph
    llm_decision:expand_device_neighbourhood(case=HHG-008)C13171-K2

  • Agent proposed device_neighbors(device_id=device_id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'device_id_15', 'anchor': '2016-12-20 03:08:56', 'hours': 720}

    Graph
    llm_plan:rejected(column_as_id, depth=1)

  • Agent proposed device_neighbors(device_id=device_id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'device_id_15', 'anchor': '2016-12-20 03:08:56', 'hours': 720}

    Graph
    llm_plan:rejected(column_as_id, depth=2)

  • Confidence check on gathered evidence: high -- The evidence is sufficient for a defensible conclusion. The disputed charge ($55.68) matches the customer's established recurring subscription pattern ($55.69), which is a strong indicator of legitimacy. Furthermore, Policy R7 explicitly forbids immediate card blocking in such scenarios. While there are structural matches to prior fraud cases, the direct match to the customer's baseline behavior and the specific policy constraint provide a clear path for the policy engine to process. The failed attempts to query device neighbors due to invalid IDs do not prevent a conclusion because the primary signal (recurring subscription) is strong and policy-supported.

    Graph
    llm_decision:confidence_gate(case=HHG-008, depth=3)
prior cases · memory5 cited

Confirming precedent

  • CC-0056Supports fraud
  • CC-0558Supports fraud
  • CC-0540Supports fraud

Disconfirming precedent

  • CC-4819Exonerates
  • CC-0553Exonerates
Stop reasonEvidence request settled the question: probability reached 0.33 (uncertain); further steps are unlikely to change the decision.
Tool calls0
Tokens0
Latency0.0s