Assess whether the wire recall window is still open (8cd114)

SITUATION Account-takeover device-fingerprint graph arrived with an email that matches a known BEC lure almost exactly for synthetic-identity detection manager. That is a Fraud Detection Mortgage Fraud decision on the wire recall window in a credit-card issuer during a holiday-authorization spike.

DECISION Synthetic-identity detection manager in a credit-card issuer during a holiday-authorization spike must choose Remove access or reverse the item / Temporary compensating control / Approve a documented exception / Hold using account-takeover device-fingerprint graph after an email that matches a known BEC lure almost exactly.

HYPOTHESES TO TEST 1. Account-takeover device-fingerprint graph reads as Remove access or reverse the item once an email that matches a known BEC lure almost exactly is lined up to the same Fraud Detection population. 2. Account-takeover device-fingerprint graph is closer to Temporary compensating control after an email that matches a known BEC lure almost exactly; Remove access or reverse the item would over-claim this Mortgage Fraud extract. 3. Approve a documented exception is still live in account-takeover device-fingerprint graph for synthetic-identity detection manager in a credit-card issuer during a holiday-authorization spike. 4. Account-takeover device-fingerprint graph is missing the fact synthetic-identity detection manager needs after an email that matches a known BEC lure almost exactly; stop this Fraud Detection close.

ANALYSIS REQUIRED 1. Quantify loss if the hold is released before account-takeover device-fingerprint graph is complete. 2. Test a one-off dispute against the first edge of a scheme around the wire recall window. 3. Check mule or round-trip markers in account-takeover device-fingerprint graph. 4. For this Fraud Detection Mortgage Fraud file, read account-takeover device-fingerprint graph against an email that matches a known BEC lure almost exactly and write the one fact that would move the wire recall window for synthetic-identity detection manager.

RECOMMENDATION Choose Remove access or reverse the item / Temporary compensating control / Approve a documented exception / Hold on this Fraud Detection / Mortgage Fraud packet (account-takeover device-fingerprint graph after an email that matches a known BEC lure almost exactly). The follow-on Mortgage Fraud action is what synthetic-identity detection manager does next: implement the option, assign an owner, and log the missing fact.

COMMAND RETURNS - Bottom-line Fraud Detection option on the wire recall window, then the evidence in account-takeover device-fingerprint graph, then the action for synthetic-identity detection manager - Hypothesis scorecard against account-takeover device-fingerprint graph: supported / rejected / untestable - Mortgage Fraud finding in account-takeover device-fingerprint graph that a second reviewer can re-perform - Missing page in account-takeover device-fingerprint graph after an email that matches a known BEC lure almost exactly, if any