HHG-012
legitimateClosed — Legitimateno pattern identified
Case HHG-012 was reviewed after a real-time model scored transaction 3553342 at 0.55, but the final verdict is legitimate with a fraud probability of 0.12. Key evidence indicates that the flagged transaction's product category and billing region match the customer's established history, and while a new device marker was noted, no corroborating fraud evidence was found. An evidence request to expand the investigation to the shared-device neighbourhood was refused because the provided parameter appeared to be a raw dataset column name rather than a valid entity ID, and a subsequent generated traversal failed to execute due to an event loop error. The final action of CLOSE_NO_FRAUD was chosen via the auto route under rule R0: policy default, settled low, no rule triggered, as no new information changed the initial assessment.
- exposure
- $0.00
- affected txns
- 0
- connected cards
- 0
- prior cases cited
- 5
stop_reason — Probability 0.12 with at least two independent evidence sources supporting no fraud; stopping per policy §6.
Initial recommendation
before · on the evidence gathered so far- CLOSE_NO_FRAUDAutoR0: policy default, settled low, no rule triggered
Final recommendation
after · no revision required- CLOSE_NO_FRAUDAutoR0: policy default, settled low, no rule triggered
The evidence settled the question without changing the recommended course of action.
Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.
- R1 did not fire
- Single signal only, fraud probability below 0.70 — must precede any block.
- R2 did not fire
- Customer was asked to validate and denied the charge.
- R3 did not fire
- Customer confirmed the charge as their own.
- R4 did not fire
- No customer reply within 24 hours.
- R5 did not fire
- 3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
- R6 did not fire
- Device profile, billing region, or recipient email shared across multiple cards in one window.
- R7 did not fire
- Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
- R8 did not fire
- Verdict uncertain with exposure over $500, or evidence conflicts.
- R9 did not fire
- Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
- R10 did not fire
- BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.
Confirming precedent(3)
- CC-0842
- CC-0542
- CC-0742
Exonerating precedent(2)
- CC-0553
- CC-0522
1 online transaction(s) on card C05876-K2 -- T3545223 ($5.92) -- came from a device first marked 'New' for this account (id_15=New)
Graphquery:card_window(card_id=C05876-K2)T3545223Precedent (confirming): CC-0842 (confirmed fraud, $99.33 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0842)CC-0842Precedent (confirming): CC-0542 (confirmed fraud, $99.09 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0542)CC-0542Precedent (confirming): CC-0742 (confirmed fraud, $49.03 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0742)CC-0742Precedent (disconfirming): CC-0553 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.20), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0553)CC-0553Precedent (disconfirming): CC-0522 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.21), no direct structural overlap
Graphquery:prior_case_candidates(case=CC-0522)CC-0522Flagged transaction's product category and billing region match this customer's established history
Graphquery:customer_baseline(customer_id=C05876)T3553342Agent elected to expand the investigation to the shared-device neighbourhood. Reasoning: YES The new device marker combined with in-character activity suggests a potential shared device compromise that may extend to other cards.
Graphllm_decision:expand_device_neighbourhood(case=HHG-012)C05876-K2Agent proposed device_neighbors(device_id=device_id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'device_id_15', 'anchor': '2016-12-18 05:00:31', 'hours': 720}
Graphllm_plan:rejected(column_as_id, depth=1)Generated traversal passed the guard but failed to execute: Failed to run query: Event loop is closed. Query verbatim: INTERPRET QUERY () FOR GRAPH FraudInvestigation { t = SELECT tx FROM Transaction:tx WHERE tx.id == "T3545223" LIMIT 1; PRINT t; }
Graphllm_generated_query:failed(depth=2)Confidence check on gathered evidence: unstated -- assess step failed (Error code: 429 - {'error': {'message': 'Rate limit reached for model `qwen/qwen3.8-27b` in organization `org_01m3bgg0gnersb9e8dystst554` service tier `on_demand` on output tokens per minute (OTPM): Limit 1000, Used 780, Requested 229. Please try again in 539.999999ms. Need more tokens? Upgrade to Dev Tier today at https://console.groq.com/settings/billing', 'type': 'tokens', 'code': 'rate_limit_exceeded'}}); stopping rather than guessing
Graphllm_decision:confidence_gate(case=HHG-012, depth=3)
Confirming precedent
- CC-0842Supports fraud
- CC-0542Supports fraud
- CC-0742Supports fraud
Disconfirming precedent
- CC-0553Exonerates
- CC-0522Exonerates