TracewiseCase ConsoleFraud Investigation Agent
all cases

HHG-018

uncertainOpen

card not present new device

Case HHG-018 remains uncertain with a fraud probability of 0.18, as the step-up authentication request expired unanswered, which raised the risk score from 0.15 and prevented a definitive conclusion on the card_not_present_new_device pattern. Key evidence includes the customer's dispute of a $39.08 charge and two online transactions totaling $150.06 from a new device, which structurally match confirmed fraud case CC-4942 but also align with the customer's established recurring merchant history and billing region. The final actions of CREATE_CASE, VERIFY_WITH_CUSTOMER, and WARN_CUSTOMER were all executed via the auto route under rule R7, which forbids immediate card blocking when a disputed charge matches an established subscription. Because the investigation could not reach a confident verdict, the case was escalated per policy to resolve the conflicting signals between the new device usage and the customer's normal spending habits.

exposure
$150.06
affected txns
2
connected cards
0
prior cases cited
5
uncertain
fraud probability
0.150.300.700.85

stop_reason — Evidence request settled the question: probability reached 0.18 (uncertain); further steps are unlikely to change the decision.

recommendation historyunchanged

Initial recommendation

before · on the evidence gathered so far
  1. CREATE_CASEAutoR7
  2. VERIFY_WITH_CUSTOMERAutoR7
  3. WARN_CUSTOMERAutoR7

Evidence requested

ask · 1 request
  • step up authafter step 3

    Step-up authentication request expired unanswered within the window.

Final recommendation

after · no revision required
  1. CREATE_CASEAutoR7
  2. VERIFY_WITH_CUSTOMERAutoR7
  3. WARN_CUSTOMERAutoR7

The assumed step up auth response (Step-up authentication request expired unanswered within the window.) raised fraud probability from 0.15 to 0.18, changing the recommended actions.

entity neighbourhood1 cards · 0 devices
HHG-018-CARD
shared devicecard under investigationflaggedconnected card
policy trace · R1–R101 of 10 predicates fired

Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.

R1
did not fire
Single signal only, fraud probability below 0.70 — must precede any block.
R2
did not fire
Customer was asked to validate and denied the charge.
R3
did not fire
Customer confirmed the charge as their own.
R4
did not fire
No customer reply within 24 hours.
R5
did not fire
3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
R6
did not fire
Device profile, billing region, or recipient email shared across multiple cards in one window.
R7
fired — forbid
Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
Forbids: BLOCK_CARD, DECLINE_TRANSACTION — blocking is withheld even though the case was flagged.
CREATE_CASE·autoVERIFY_WITH_CUSTOMER·autoWARN_CUSTOMER·auto
R8
did not fire
Verdict uncertain with exposure over $500, or evidence conflicts.
R9
did not fire
Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
R10
did not fire
BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
precedent retrieval · graphRAG5 cases retrieved

The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.

Confirming precedent(3)

  • CC-0391
  • CC-0491
  • CC-4942shared device

Exonerating precedent(2)

  • CC-0023
  • CC-0405shared device

Drawn from 5,565 closed investigations.

evidence ledger · 12 itemsprovenance & signals

  • Cardholder disputes the charge: Customer C02354 message: 'I never made this $39.08 purchase. Please check my card.' Refers to 3491361.

    Customer
    trigger:customer_report(HHG-018)T3491361

  • 2 online transaction(s) on card C02354-K2 -- T3487659 ($99.97), T3489428 ($50.09) -- came from a device first marked 'New' for this account (id_15=New)

    Graph
    query:card_window(card_id=C02354-K2)T3487659T3489428

  • Structural match (shared device/region/card) with confirmed-fraud closed case CC-4942 (pattern: out_of_region_use)

    Graph
    query:prior_cases_for_entities(case=CC-4942)CC-4942

  • Precedent (confirming): CC-0391 (confirmed fraud, $92.08 exposure): semantically similar analyst notes (cosine distance 0.32), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0391)CC-0391

  • Precedent (confirming): CC-0491 (confirmed fraud, $99.93 exposure): semantically similar analyst notes (cosine distance 0.32), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0491)CC-0491

  • Precedent (confirming): CC-4942 (confirmed fraud, $1,094.94 exposure): shares 1 entity (card/device/region) with this alert

    Graph
    query:prior_case_candidates(case=CC-4942)CC-4942

  • Precedent (disconfirming): CC-0023 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.33), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0023)CC-0023

  • Precedent (disconfirming): CC-0405 (cleared as legitimate): shares 1 entity (card/device/region) with this alert

    Graph
    query:prior_case_candidates(case=CC-0405)CC-0405

  • Flagged transaction's product category and billing region match this customer's established history

    Graph
    query:customer_baseline(customer_id=C02354)T3491361

  • Flagged charge matches this customer's own recurring merchant/amount pattern (monthly)

    Graph
    query:customer_baseline(customer_id=C02354)T3491361

  • Fraud Policy R7: Forbids immediate card block when disputed charge matches customer's established recurring subscription.

    Document
    policy:R7R7

  • Agent declined to expand the investigation beyond this card -- activity looks contained. Reasoning: NO The findings indicate the activity is contained to this specific cardholder, as the behavior is in-character and matches a closed case without evidence of a broader campaign.

    Graph
    llm_decision:decline_expansion(case=HHG-018)C02354-K2
prior cases · memory5 cited

Confirming precedent

  • CC-0391Supports fraud
  • CC-0491Supports fraud
  • CC-4942Supports fraud

Disconfirming precedent

  • CC-0023Exonerates
  • CC-0405Exonerates
Stop reasonEvidence request settled the question: probability reached 0.18 (uncertain); further steps are unlikely to change the decision.
Tool calls0
Tokens0
Latency0.0s