TracewiseCase ConsoleFraud Investigation Agent
all cases

HHG-014

fraudClosed — Fraud

undocumented

Activity shares a device profile, billing region, or recipient email across multiple customers within a short window but does not match any of the five documented patterns; flagged per R9 as coordinated/repeated abuse across customers rather than forced into a named category.

Case HHG-014 resulted in a fraud verdict with a probability of 0.61, driven by transaction T3478561 on card C13487-K1 which originated from a device profile shared across 18 unrelated customers within a 7-day window. The evidence request for customer validation yielded no reply within the 24-hour window, leaving the fraud probability unchanged and confirming the initial assessment. The final actions include MONITOR_CARD via auto route under R4, DECLINE_TRANSACTION via L1 route under R4, CREATE_CASE via auto route under R6, FILE_REPORT via L2 route under R6, and MONITOR_CONNECTED_CARDS via auto route under R6. These actions were selected because the shared device profile constitutes a coordinated ring, triggering mandatory card block, case creation, and supervisory escalation under Fraud Policy R6, while also requiring Suspicious Activity Reports per FinCEN Advisory.

exposure
$74.96
affected txns
1
connected cards
17
prior cases cited
5
uncertain
fraud probability
0.150.300.700.85

stop_reason — Evidence request settled the question: probability reached 0.61 (fraud); further steps are unlikely to change the decision.

recommendation historyrevised after evidence

Initial recommendation

before · on the evidence gathered so far
  1. CREATE_CASEAutoR6
  2. FILE_REPORTL2 approvalR6
  3. MONITOR_CONNECTED_CARDSAutoR6

Evidence requested

ask · 1 request
  • customer validationafter step 3

    No reply received from the customer within the 24-hour window.

Revised recommendation

after · after the response came back
  1. MONITOR_CARDAutonewR4
  2. DECLINE_TRANSACTIONL1 approvalnewR4
  3. CREATE_CASEAutoR6
  4. FILE_REPORTL2 approvalR6
  5. MONITOR_CONNECTED_CARDSAutoR6

The assumed customer validation response (No reply received from the customer within the 24-hour window.) did not move fraud probability (stayed at 0.61); actions are unchanged from the initial recommendation.

awaiting human approval

DECLINE_TRANSACTIONL1 approval

R4

FILE_REPORTL2 approval

R6

entity neighbourhood17 cards · 1 device
SM-G935F Build/NRD90MC01289-K2
shared devicecard under investigationflaggedconnected card
policy trace · R1–R102 of 10 predicates fired

Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.

R1
did not fire
Single signal only, fraud probability below 0.70 — must precede any block.
R2
did not fire
Customer was asked to validate and denied the charge.
R3
did not fire
Customer confirmed the charge as their own.
R4
fired
No customer reply within 24 hours.
MONITOR_CARD·autoDECLINE_TRANSACTION·L1
R5
did not fire
3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
R6
fired
Device profile, billing region, or recipient email shared across multiple cards in one window.
CREATE_CASE·autoFILE_REPORT·L2MONITOR_CONNECTED_CARDS·auto
R7
did not fire
Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
R8
did not fire
Verdict uncertain with exposure over $500, or evidence conflicts.
R9
did not fire
Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
R10
did not fire
BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
precedent retrieval · graphRAG5 cases retrieved

The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.

Confirming precedent(3)

  • CC-0078
  • CC-0247
  • CC-0178

Exonerating precedent(2)

  • CC-0815
  • CC-0488

Drawn from 5,565 closed investigations.

evidence ledger · 14 itemsprovenance & signals

  • 1 online transaction(s) on card C13487-K1 -- T3478561 ($74.96) -- came from a device first marked 'New' for this account (id_15=New)

    Graph
    query:card_window(card_id=C13487-K1)T3478561

  • Shared device profile 'SM-G935F Build/NRD90M | Android 7.0 | chrome 62.0 for android | 1920x1080' appears on 23 transactions across 18 unrelated customers (C01289 (card C01289-K2), C01996 (card C01996-K2), C02910 (card C02910-K1), C02975 (card C02975-K1), C03676 (card C03676-K2), C04108 (card C04108-K2), C04274 (card C04274-K1), C06710 (card C06710-K1), C08168 (card C08168-K1), C09049 (card C09049-K1), C09906 (card C09906-K1), C09975 (card C09975-K2), C10193 (card C10193-K2), C11082 (card C11082-K1), C11670 (card C11670-K2), C12796 (card C12796-K1), C13291 (card C13291-K1), C13487 (card C13487-K1)) within 6 day(s) of a 7-day window -- one device profile tying together cards ['C01289-K2', 'C01996-K2', 'C02910-K1', 'C02975-K1', 'C03676-K2', 'C04108-K2', 'C04274-K1', 'C06710-K1', 'C08168-K1', 'C09049-K1', 'C09906-K1', 'C09975-K2', 'C10193-K2', 'C11082-K1', 'C11670-K2', 'C12796-K1', 'C13291-K1', 'C13487-K1'] that share no other connection is the structural signature of a coordinated ring rather than 18 unrelated cardholders coincidentally using the same one

    Graph
    query:device_neighbors(device_profile=SM-G935F Build/NRD90M | Android 7.0 | chrome 62.0 for android | 1920x1080)T3460634T3461032T3462447T3463379T3466014T3467346T3467635T3467764T3467828T3468314T3468363T3468463T3469068T3470763T3471032T3473050T3473057T3474445T3475406T3476202T3477916T3478133T3478561

  • Device profile SM-G935F Build/NRD90M | Android 7.0 | chrome 62.0 for android | 1920x1080 also used on connected card(s) C01289-K2, C01996-K2, C02910-K1, C02975-K1, C03676-K2, C04108-K2, C04274-K1, C06710-K1, C08168-K1, C09049-K1, C09906-K1, C09975-K2, C10193-K2, C11082-K1, C11670-K2, C12796-K1, C13291-K1

    Graph
    query:device_neighbors(device_id=SM-G935F Build/NRD90M | Android 7.0 | chrome 62.0 for android | 1920x1080)C01289-K2C01996-K2C02910-K1C02975-K1C03676-K2C04108-K2C04274-K1C06710-K1C08168-K1C09049-K1C09906-K1C09975-K2C10193-K2C11082-K1C11670-K2C12796-K1C13291-K1

  • Graph community detection (tg_wcc) confirms card C13487-K1 is in a shared-device cluster spanning 17 connected card(s) on profile SM-G935F Build/NRD90M | Android 7.0 | chrome 62.0 for android | 1920x1080

    Graph
    algorithm:tg_wcc(v_type=Card|DeviceProfile)C01289-K2C01996-K2C02910-K1C02975-K1C03676-K2C04108-K2C04274-K1C06710-K1C08168-K1C09049-K1C09906-K1C09975-K2C10193-K2C11082-K1C11670-K2C12796-K1C13291-K1

  • Precedent (confirming): CC-0078 (confirmed fraud, $131.31 exposure): semantically similar analyst notes (cosine distance 0.25), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0078)CC-0078

  • Precedent (confirming): CC-0247 (confirmed fraud, $78.86 exposure): semantically similar analyst notes (cosine distance 0.25), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0247)CC-0247

  • Precedent (confirming): CC-0178 (confirmed fraud, $90.87 exposure): semantically similar analyst notes (cosine distance 0.25), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0178)CC-0178

  • Precedent (disconfirming): CC-0815 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.27), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0815)CC-0815

  • Precedent (disconfirming): CC-0488 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.27), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0488)CC-0488

  • Fraud Policy R6: Mandates card block, case creation, and supervisory escalation for multi-account shared origin rings.

    Document
    policy:R6R6

  • FinCEN Advisory: Requires filing of Suspicious Activity Reports for syndicated account compromise and proxy rings.

    Document
    reg:fincen_sar_narrative:0SAR

  • Agent elected to expand the investigation to the shared-device neighbourhood. Reasoning: YES The shared_device_across_cards finding indicates the compromise extends beyond this single cardholder, necessitating a check for other affected accounts.

    Graph
    llm_decision:expand_device_neighbourhood(case=HHG-014)C13487-K1

  • card_window returned 1 connected entities at depth 1. Reasoning: To determine if C01289-K2 shows coordinated activity (velocity, merchant, geo anomalies) similar to the case card, I need to examine its transaction history around the case anchor time. card_window is the specific query for retrieving transactions for a given card within a time window.

    Graph
    query:card_window(card_id=C01289-K2, anchor=2016-11-22 20:11:00, hours=72)3472269

  • card_window returned 1 connected entities at depth 2. Reasoning: The goal is to identify specific transactions on card C01289-K2 within the 72-hour window around the case anchor time to compare anomalies with the case card. The 'card_window' query is designed to retrieve transactions for a specific card within a time window, making it the direct fit for this request.

    Graph
    query:card_window(card_id=C01289-K2, anchor=2016-11-22 20:11:00, hours=72)3472269
prior cases · memory5 cited

Confirming precedent

  • CC-0078Supports fraud
  • CC-0247Supports fraud
  • CC-0178Supports fraud

Disconfirming precedent

  • CC-0815Exonerates
  • CC-0488Exonerates

Regulatory filing

Suspicious Activity Report

Filing required

3a: activity connects to a shared device/region or another customer's fraud; pattern is undocumented/coordinated (R9)

Customer C13487, associated with card C13487-K1, engaged in activity on the online channel between 2016-11-22 and 2016-11-22 that is consistent with an undocumented fraud pattern. The activity shares a device profile, billing region, or recipient email across multiple customers within a short window but does not match any of the five documented patterns. This behavior was flagged as coordinated and repeated abuse across customers rather than being forced into a named category. The specific transaction T3478561 on card C13487-K1 originated from a device profile shared across 18 unrelated customers within a 7-day window. This device profile is identified as SM-G935F Build/NRD90M | Android 7.0 | chrome 62.0 for android | 1920x1080. The total exposure identified in this matter is $74.96. An evidence request for customer validation yielded no reply within the 24-hour window, leaving the fraud probability unchanged at 0.61. Case HHG-014 resulted in a fraud verdict based on these findings. Related prior investigations reviewed as case memory include CC-0078, CC-0247, CC-0178, CC-0815, and CC-0488. The final actions taken include MONITOR_CARD, DECLINE_TRANSACTION, CREATE_CASE, FILE_REPORT, and MONITOR_CONNECTED_CARDS.

Amount

$74.96

Activity dates

2016-11-22 to 2016-11-22

Subjects

C13487C13487-K1C01289-K2C01996-K2C02910-K1C02975-K1C03676-K2C04108-K2C04274-K1C06710-K1C08168-K1C09049-K1C09906-K1C09975-K2C10193-K2C11082-K1C11670-K2C12796-K1C13291-K1SM-G935F Build/NRD90M | Android 7.0 | chrome 62.0 for android | 1920x1080CC-0078CC-0247CC-0178CC-0815CC-0488
Stop reasonEvidence request settled the question: probability reached 0.61 (fraud); further steps are unlikely to change the decision.
Tool calls0
Tokens0
Latency0.0s