TracewiseCase ConsoleFraud Investigation Agent
all cases

HHG-020

uncertainOpen

card not present new device

Case HHG-020 resulted in an uncertain verdict with a fraud probability of 0.27, driven by transaction T3509359 on card C12265-K2 which originated from a device marked as new for customer C12265. The evidence presented a mixed signal, as three confirming precedents (CC-0667, CC-0309, CC-0659) were counterbalanced by two disconfirming legitimate cases (CC-0175, CC-0736), while attempts to expand the investigation into the device neighborhood were refused because the proposed identifier id_15 was deemed a raw dataset column name rather than a valid entity. The step_up_auth evidence request expired unanswered within the window, which raised the fraud probability from 0.23 to 0.27 and altered the recommended course of action. Consequently, the final action chosen was MONITOR_CARD via the auto route under rule R0: policy default, below case-creation threshold, reflecting the inability to gather further structural verification due to the depth limit and contradictory precedent matches.

exposure
$125.08
affected txns
1
connected cards
0
prior cases cited
5
uncertain
fraud probability
0.150.300.700.85

stop_reason — Evidence request settled the question: probability reached 0.27 (uncertain); further steps are unlikely to change the decision.

recommendation historyrevised after evidence

Initial recommendation

before · on the evidence gathered so far
  1. VERIFY_WITH_CUSTOMERAutoR1
  2. STEP_UP_AUTHAutoR1

Evidence requested

ask · 1 request
  • step up authafter step 3

    Step-up authentication request expired unanswered within the window.

Revised recommendation

after · after the response came back
  1. MONITOR_CARDAutonewR0: policy default, below case-creation threshold
  • VERIFY_WITH_CUSTOMERwithdrawn
  • STEP_UP_AUTHwithdrawn

The assumed step up auth response (Step-up authentication request expired unanswered within the window.) raised fraud probability from 0.23 to 0.27, changing the recommended actions.

entity neighbourhood1 cards · 0 devices
HHG-020-CARD
shared devicecard under investigationflaggedconnected card
policy trace · R1–R100 of 10 predicates fired

Every rule below is a deterministic predicate evaluated against this case’s evidence — not a model’s assertion of an outcome. The engine checks all ten; most do not apply here, and that is shown deliberately.

R1
did not fire
Single signal only, fraud probability below 0.70 — must precede any block.
R2
did not fire
Customer was asked to validate and denied the charge.
R3
did not fire
Customer confirmed the charge as their own.
R4
did not fire
No customer reply within 24 hours.
R5
did not fire
3+ sub-$5 online authorizations within an hour on one card, then a larger purchase.
R6
did not fire
Device profile, billing region, or recipient email shared across multiple cards in one window.
R7
did not fire
Disputed charge matches the customer's own recurring pattern — merchant, amount, monthly.
R8
did not fire
Verdict uncertain with exposure over $500, or evidence conflicts.
R9
did not fire
Fits none of the five documented patterns, and abuse is coordinated or repeated across customers.
R10
did not fire
BLOCK_ALL_CARDS was proposed — requires 2+ cards confirmed fraud or confirmed compromised credentials, else downgrades to a single-card BLOCK_CARD.
precedent retrieval · graphRAG5 cases retrieved

The closed-case history runs 4,665 confirmed fraud to 900 cleared — a single merged ranking over that history returns almost nothing but incriminating cases and pushes every verdict toward blocking. Retrieval runs as two separate pools, confirming and exonerating, so that imbalance cannot silently decide the case.

Confirming precedent(3)

  • CC-0667
  • CC-0309
  • CC-0659

Exonerating precedent(2)

  • CC-0175
  • CC-0736

Drawn from 5,565 closed investigations.

evidence ledger · 10 itemsprovenance & signals

  • 1 online transaction(s) on card C12265-K2 -- T3509359 ($125.08) -- came from a device first marked 'New' for this account (id_15=New)

    Graph
    query:card_window(card_id=C12265-K2)T3509359

  • Precedent (confirming): CC-0667 (confirmed fraud, $75.09 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0667)CC-0667

  • Precedent (confirming): CC-0309 (confirmed fraud, $50.00 exposure): semantically similar analyst notes (cosine distance 0.28), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0309)CC-0309

  • Precedent (confirming): CC-0659 (confirmed fraud, $225.94 exposure): semantically similar analyst notes (cosine distance 0.29), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0659)CC-0659

  • Precedent (disconfirming): CC-0175 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.23), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0175)CC-0175

  • Precedent (disconfirming): CC-0736 (cleared as legitimate): semantically similar analyst notes (cosine distance 0.23), no direct structural overlap

    Graph
    query:prior_case_candidates(case=CC-0736)CC-0736

  • Agent elected to expand the investigation to the shared-device neighbourhood. Reasoning: YES The new device marker indicates a potential shared device that could be linked to other compromised cards or customers.

    Graph
    llm_decision:expand_device_neighbourhood(case=HHG-020)C12265-K2

  • Agent proposed device_neighbors(device_id=id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'id_15', 'anchor': '2016-12-03 12:04:26', 'hours': 2160}

    Graph
    llm_plan:rejected(column_as_id, depth=1)

  • Agent proposed device_neighbors(device_id=id_15), refused: that looks like a raw dataset column name, not a real entity id -- running it would waste a query rather than gather evidence. Full params: {'device_id': 'id_15', 'anchor': '2016-12-03 12:04:26', 'hours': 2160}

    Graph
    llm_plan:rejected(column_as_id, depth=2)

  • Confidence check on gathered evidence: medium -- The investigation has reached its maximum depth limit (3 of 3). The evidence presents a mixed signal: a new device marker and a moderate risk score (0.52) are supported by three semantically similar confirmed fraud precedents, but are counterbalanced by two semantically similar legitimate precedents. Attempts to expand the investigation into the device neighborhood were rejected due to invalid entity identifiers, preventing further structural verification. Given the depth limit and the contradictory nature of the precedent matches, the evidence is sufficient to hand off to the policy engine for a deterministic decision, as no further data can be gathered.

    Graph
    llm_decision:confidence_gate(case=HHG-020, depth=3)
prior cases · memory5 cited

Confirming precedent

  • CC-0667Supports fraud
  • CC-0309Supports fraud
  • CC-0659Supports fraud

Disconfirming precedent

  • CC-0175Exonerates
  • CC-0736Exonerates
Stop reasonEvidence request settled the question: probability reached 0.27 (uncertain); further steps are unlikely to change the decision.
Tool calls0
Tokens0
Latency0.0s