HHG-015

uncertainEscalated

out of region use

Case HHG-015 resulted in an uncertain verdict with a fraud probability of 0.46, driven by transaction T3464869 for $599.94 on card C03042-K1 which occurred on a new device in region 327.0, outside the cardholder's historical regions, and only 22.9 hours after a transaction in region 299.0, creating an impossible travel scenario indicative of a clone. The investigation attempted to expand to the shared-device neighborhood but the proposed device_neighbors query was refused because the parameter device_id_15 appeared to be a raw dataset column name rather than a valid entity ID, and the step-up authentication request expired unanswered within the window. The final action of ESCALATE_TO_ANALYST was chosen via the auto route under rule R8, as the expired authentication response raised the probability from 0.41 to 0.46 and the case could not reach a confident verdict due to the unresolved nature of the out_of_region_use pattern.

exposure: $599.94
affected txns: 1
connected cards: 0
prior cases cited: 5

uncertain

fraud probability

0.150.300.700.85

stop_reason — Evidence request settled the question: probability reached 0.46 (uncertain); further steps are unlikely to change the decision.

recommendation historyunchanged

Initial recommendation

before · on the evidence gathered so far

ESCALATE_TO_ANALYSTAutoR8

Evidence requested

ask · 1 request

step up authafter step 3
Step-up authentication request expired unanswered within the window.

Final recommendation

after · no revision required

ESCALATE_TO_ANALYSTAutoR8

The assumed step up auth response (Step-up authentication request expired unanswered within the window.) raised fraud probability from 0.41 to 0.46, changing the recommended actions.

entity neighbourhood1 cards · 0 devices

shared devicecard under investigationflaggedconnected card

policy trace · R1–R101 of 10 predicates fired

Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.

R1: Single signal only, fraud probability below 0.70 — must precede any block.
R2: Customer was asked to validate and denied the charge.
R3: Customer confirmed the charge as their own.
R4: No customer reply within 24 hours.
R5: 3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
R6: Device profile, billing region, or recipient email shared across multiple cards in one window.
R7: Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
R8: Verdict uncertain with exposure over $500, or evidence conflicts.; ESCALATE_TO_ANALYST·auto
R9: Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
R10: BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.

precedent retrieval · graphRAG5 cases retrieved

The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.

Confirming precedent(3)

CC-0469
CC-0698
CC-0791

Exonerating precedent(2)

CC-0034
CC-0684

evidence ledger · 12 itemsprovenance & signals

1 online transaction(s) on card C03042-K1 -- T3464869 ($599.94) -- came from a device first marked 'New' for this account (id_15=New)
Graph
query:card_window(card_id=C03042-K1)T3464869
Card C03042-K1 billed in region(s) ['327.0'] outside its historical region set ['123.0', '126.0', '143.0', '170.0', '177.0', '184.0', '204.0', '225.0', '231.0', '264.0', '272.0', '299.0', '315.0', '325.0', '330.0', '337.0', '387.0', '433.0', '472.0', '476.0', '485.0']. Transaction T3464869 ($599.94, region 327.0) sits only 22.9h from T3462404 ($550.01, region 299.0, the cardholder's own historical region) -- no traveler can be billed in two regions 22.9h apart, so this reads as the card being used in two places at once (a clone) rather than one cardholder traveling
Graph
query:customer_baseline + card_window(card_id=C03042-K1)T3464869
Precedent (confirming): CC-0469 (confirmed fraud, $104.68 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap
Graph
query:prior_case_candidates(case=CC-0469)CC-0469
Precedent (confirming): CC-0698 (confirmed fraud, $450.04 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap
Graph
query:prior_case_candidates(case=CC-0698)CC-0698
Precedent (confirming): CC-0791 (confirmed fraud, $599.90 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap
Graph
query:prior_case_candidates(case=CC-0791)CC-0791
Precedent (disconfirming): CC-0034 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.22), no direct structural overlap
Graph
query:prior_case_candidates(case=CC-0034)CC-0034
Precedent (disconfirming): CC-0684 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.23), no direct structural overlap
Graph
query:prior_case_candidates(case=CC-0684)CC-0684
Fraud Policy R1: Requires customer verification before card block when alert rests on single unconfirmed signal.
Document
policy:R1R1
Agent elected to expand the investigation to the shared-device neighbourhood. Reasoning: YES The presence of a new device marker combined with an out-of-region pattern suggests the device may be shared with other compromised cards, warranting a check of the shared-device neighborhood.
Graph
llm_decision:expand_device_neighbourhood(case=HHG-015)C03042-K1
Agent proposed device_neighbors(device_id=device_id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'device_id_15', 'anchor': '2016-11-17 19:03:36', 'hours': 72}
Graph
llm_plan:rejected(column_as_id, depth=1)
Agent proposed device_neighbors(device_id=device_id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'device_id_15', 'anchor': '2016-11-17 19:03:36', 'hours': 72}
Graph
llm_plan:rejected(column_as_id, depth=2)
Confidence check on gathered evidence: high -- The evidence presents a clear and defensible picture of potential fraud. The transaction occurred on a new device in a region outside the customer's historical baseline, and critically, the timing (22.9 hours) makes it physically impossible for a single cardholder to be in both regions, strongly indicating a cloned card. This is supported by three confirming precedents of similar fraud. Although two precedents were cleared, the specific 'impossible travel' signal combined with the new device marker is a strong indicator of compromise. The investigation has reached its depth limit (3 of 3), and further queries (like the rejected device neighbor checks) are not viable or necessary given the strength of the current signals. The policy engine can now apply the appropriate action (e.g., customer verification per Policy R1) based on this clear evidence.
Graph
llm_decision:confidence_gate(case=HHG-015, depth=3)

prior cases · memory5 cited

Confirming precedent

CC-0469Supports fraud
CC-0698Supports fraud
CC-0791Supports fraud

Disconfirming precedent

CC-0034Exonerates
CC-0684Exonerates

Stop reasonEvidence request settled the question: probability reached 0.46 (uncertain); further steps are unlikely to change the decision.

Tool calls0

Tokens0

Latency0.0s