TracewiseCase ConsoleFraud Investigation Agent
all cases

HHG-009

legitimateClosed — Legitimate

no pattern identified

Case HHG-009 was closed with a verdict of legitimate and a fraud probability of 0.09, as the disputed $30.02 charge on card C08299-K1 matched the customer's established recurring merchant and amount patterns despite a new device marker. The key evidence included the customer's dispute message and the alignment of the transaction with their baseline history, which triggered Fraud Policy R7 to forbid an immediate card block. An evidence request for step-up authentication expired unanswered, which raised the fraud probability from 0.07 to 0.09 and influenced the final recommended actions. The final actions consisted of CREATE_CASE (auto, R7), VERIFY_WITH_CUSTOMER (auto, R7), and WARN_CUSTOMER (auto, R7), reflecting the policy-driven response to a recurring subscription dispute without corroborating fraud.

exposure
$0.00
affected txns
0
connected cards
0
prior cases cited
5
likely legitimate
fraud probability
0.150.300.700.85

stop_reason — Evidence request settled the question: probability reached 0.09 (legitimate); further steps are unlikely to change the decision.

recommendation historyunchanged

Initial recommendation

before · on the evidence gathered so far
  1. CREATE_CASEAutoR7
  2. VERIFY_WITH_CUSTOMERAutoR7
  3. WARN_CUSTOMERAutoR7

Evidence requested

ask · 1 request
  • step up authafter step 2

    Step-up authentication request expired unanswered within the window.

Final recommendation

after · no revision required
  1. CREATE_CASEAutoR7
  2. VERIFY_WITH_CUSTOMERAutoR7
  3. WARN_CUSTOMERAutoR7

The assumed step up auth response (Step-up authentication request expired unanswered within the window.) raised fraud probability from 0.07 to 0.09, changing the recommended actions.

entity neighbourhood1 cards · 0 devices
HHG-009-CARD
shared devicecard under investigationflaggedconnected card
policy trace · R1–R101 of 10 predicates fired

Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.

R1
did not fire
Single signal only, fraud probability below 0.70 — must precede any block.
R2
did not fire
Customer was asked to validate and denied the charge.
R3
did not fire
Customer confirmed the charge as their own.
R4
did not fire
No customer reply within 24 hours.
R5
did not fire
3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
R6
did not fire
Device profile, billing region, or recipient email shared across multiple cards in one window.
R7
fired — forbid
Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
Forbids: BLOCK_CARD, DECLINE_TRANSACTION — blocking is withheld even though the case was flagged.
CREATE_CASE·autoVERIFY_WITH_CUSTOMER·autoWARN_CUSTOMER·auto
R8
did not fire
Verdict uncertain with exposure over $500, or evidence conflicts.
R9
did not fire
Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
R10
did not fire
BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
precedent retrieval · graphRAG5 cases retrieved

The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.

Confirming precedent(3)

  • CC-0414
  • CC-0707
  • CC-0213

Exonerating precedent(2)

  • CC-0182
  • CC-0281

Drawn from 5,565 closed investigations.

evidence ledger · 14 itemsprovenance & signals

  • Cardholder disputes the charge: Customer C08299 message: 'I never made this $30.02 purchase. Please check my card.' Refers to 3581141.

    Customer
    trigger:customer_report(HHG-009)T3581141

  • 1 online transaction(s) on card C08299-K1 -- T3576079 ($80.02) -- came from a device first marked 'New' for this account (id_15=New)

    Graph
    query:card_window(card_id=C08299-K1)T3576079

  • Precedent (confirming): CC-0414 (confirmed fraud, $35.00 exposure): semantically similar analyst notes (cosine distance 0.32), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0414)CC-0414

  • Precedent (confirming): CC-0707 (confirmed fraud, $35.06 exposure): semantically similar analyst notes (cosine distance 0.32), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0707)CC-0707

  • Precedent (confirming): CC-0213 (confirmed fraud, $110.02 exposure): semantically similar analyst notes (cosine distance 0.33), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0213)CC-0213

  • Precedent (disconfirming): CC-0182 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.33), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0182)CC-0182

  • Precedent (disconfirming): CC-0281 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.34), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0281)CC-0281

  • Flagged transaction's product category and billing region match this customer's established history

    Graph
    query:customer_baseline(customer_id=C08299)T3581141

  • Flagged charge matches this customer's own recurring merchant/amount pattern (monthly)

    Graph
    query:customer_baseline(customer_id=C08299)T3581141

  • Fraud Policy R7: Forbids immediate card block when disputed charge matches customer's established recurring subscription.

    Document
    policy:R7R7

  • Agent elected to expand the investigation to the shared-device neighbourhood. Reasoning: YES The presence of a new device marker combined with in-character activity suggests a potential shared device compromise that could extend to other cards.

    Graph
    llm_decision:expand_device_neighbourhood(case=HHG-009)C08299-K1

  • Agent proposed device_neighbors(device_id=device_id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'device_id_15', 'anchor': '2016-12-28 17:10:53', 'hours': 72}

    Graph
    llm_plan:rejected(column_as_id, depth=1)

  • card_window returned 11 connected entities at depth 2. Reasoning: The specific device_id_15 is not in the known identifiers list. To find the device associated with the 'New' marker for card C08299-K1, I must first retrieve the transaction history for this card around the case anchor. The card_window query will surface the relevant transactions, allowing me to identify the specific device ID before potentially running device_neighbors.

    Graph
    query:card_window(card_id=C08299-K1, anchor=2016-12-28 17:10:53, hours=72)35888593587043358698035760793588876358891935870423581141358895035888743588905

  • Confidence check on gathered evidence: medium -- The investigation has reached its depth limit (3 of 3). The evidence presents a clear conflict: the customer disputes the charge, and a new device marker is present (risk factors), but the transaction perfectly matches the customer's established recurring subscription pattern and baseline history (strong legitimacy indicators). Policy R7 explicitly forbids blocking in this scenario. While the 'new device' signal is unexplained, the depth limit prevents further verification of the device neighborhood. The policy engine can now apply the deterministic rules regarding recurring subscriptions and customer disputes to make the final verdict.

    Graph
    llm_decision:confidence_gate(case=HHG-009, depth=3)
prior cases · memory5 cited

Confirming precedent

  • CC-0414Supports fraud
  • CC-0707Supports fraud
  • CC-0213Supports fraud

Disconfirming precedent

  • CC-0182Exonerates
  • CC-0281Exonerates
Stop reasonEvidence request settled the question: probability reached 0.09 (legitimate); further steps are unlikely to change the decision.
Tool calls0
Tokens0
Latency0.0s