TracewiseCase ConsoleFraud Investigation Agent
all cases

HHG-010

legitimateClosed — Legitimate

no pattern identified

Case HHG-010 was reviewed after a real-time model scored transaction 3506725 for $1,000.03 at a high risk of 0.90, but the final verdict is legitimate with a fraud probability of 0.12. The key evidence indicates that while the transaction originated from a device marked as new, the product category and billing region align with the customer's established history, and the agent's request to expand the investigation to the shared-device neighborhood was refused because the provided parameter appeared to be a raw dataset column name rather than a valid entity ID. The final action of CLOSE_NO_FRAUD was selected via the auto route under rule R0, which serves as the policy default for settled low-risk cases where no specific rule is triggered.

exposure
$0.00
affected txns
0
connected cards
0
prior cases cited
5
likely legitimate
fraud probability
0.150.300.700.85

stop_reason — Probability 0.12 with at least two independent evidence sources supporting no fraud; stopping per policy §6.

recommendation historyunchanged

Initial recommendation

before · on the evidence gathered so far
  1. CLOSE_NO_FRAUDAutoR0: policy default, settled low, no rule triggered

Final recommendation

after · no revision required
  1. CLOSE_NO_FRAUDAutoR0: policy default, settled low, no rule triggered

The evidence settled the question without changing the recommended course of action.

entity neighbourhood1 cards · 0 devices
HHG-010-CARD
shared devicecard under investigationflaggedconnected card
policy trace · R1–R100 of 10 predicates fired

Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.

R1
did not fire
Single signal only, fraud probability below 0.70 — must precede any block.
R2
did not fire
Customer was asked to validate and denied the charge.
R3
did not fire
Customer confirmed the charge as their own.
R4
did not fire
No customer reply within 24 hours.
R5
did not fire
3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
R6
did not fire
Device profile, billing region, or recipient email shared across multiple cards in one window.
R7
did not fire
Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
R8
did not fire
Verdict uncertain with exposure over $500, or evidence conflicts.
R9
did not fire
Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
R10
did not fire
BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
precedent retrieval · graphRAG5 cases retrieved

The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.

Confirming precedent(3)

  • CC-0707
  • CC-0609
  • CC-0307

Exonerating precedent(2)

  • CC-0675
  • CC-0567

Drawn from 5,565 closed investigations.

evidence ledger · 11 itemsprovenance & signals

  • 1 online transaction(s) on card C10434-K1 -- T3506725 ($1000.03) -- came from a device first marked 'New' for this account (id_15=New)

    Graph
    query:card_window(card_id=C10434-K1)T3506725

  • Precedent (confirming): CC-0707 (confirmed fraud, $35.06 exposure): semantically similar analyst notes (cosine distance 0.29), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0707)CC-0707

  • Precedent (confirming): CC-0609 (confirmed fraud, $67.03 exposure): semantically similar analyst notes (cosine distance 0.29), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0609)CC-0609

  • Precedent (confirming): CC-0307 (confirmed fraud, $25.23 exposure): semantically similar analyst notes (cosine distance 0.29), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0307)CC-0307

  • Precedent (disconfirming): CC-0675 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.23), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0675)CC-0675

  • Precedent (disconfirming): CC-0567 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.23), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0567)CC-0567

  • Flagged transaction's product category and billing region match this customer's established history

    Graph
    query:customer_baseline(customer_id=C10434)T3506725

  • Agent elected to expand the investigation to the shared-device neighbourhood. Reasoning: YES The new device marker suggests a potential shared device that could be linked to other compromised cards or customers.

    Graph
    llm_decision:expand_device_neighbourhood(case=HHG-010)C10434-K1

  • Agent proposed device_neighbors(device_id=device_id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'device_id_15', 'anchor': '2016-12-02 18:18:27', 'hours': 720}

    Graph
    llm_plan:rejected(column_as_id, depth=1)

  • customer_baseline returned 37 connected entities at depth 2. Reasoning: The goal is to understand the customer's historical device usage pattern and identify recent changes in device fingerprint or location. The 'customer_baseline' query is the most appropriate installed query to retrieve the historical baseline for customer C10434, which will reveal typical devices and locations, allowing us to spot anomalies like the 'New' device flag.

    Graph
    query:customer_baseline(customer_id=C10434)3306585C10434-K130823263094730307589433519353087486339731030780523053503308296832178583411190315752232825423139246349208631973563237387335077132373393193185329216031216173197666347534430163773506725351985830709863091950332902235772443076736328266133924183419055

  • Confidence check on gathered evidence: medium -- The investigation has reached its maximum depth limit (3 of 3). The evidence presents a mixed signal: a high real-time risk score (0.90) and a new device flag are counterbalanced by the transaction matching the customer's established product and billing region history, as well as the presence of both confirming and disconfirming precedent cases with no direct structural overlap. While the new device is a risk factor, the lack of geographic or behavioral anomaly relative to the baseline, combined with the depth limit, means no further evidence can be gathered. The policy engine must weigh the high model score against the benign baseline characteristics.

    Graph
    llm_decision:confidence_gate(case=HHG-010, depth=3)
prior cases · memory5 cited

Confirming precedent

  • CC-0707Supports fraud
  • CC-0609Supports fraud
  • CC-0307Supports fraud

Disconfirming precedent

  • CC-0675Exonerates
  • CC-0567Exonerates
Stop reasonProbability 0.12 with at least two independent evidence sources supporting no fraud; stopping per policy §6.
Tool calls0
Tokens0
Latency0.0s