Fictional scenario. Synthetic data. Your notes stay on this browser; do not enter real customer information.
What the team did, and what it cost.
The team widened first, then called. The 90-day search took Tomas a day and a half, mostly because the credit flow exports in a different format from the authorisation flow and nobody had ever joined the two. Ines rang Hollow Oak on Thursday.
The cost of those three days: nine more standalone credits to cards on the list, EUR 1,180. Delay has a price list too. The analyst adds the line to the running total.
The widened search also closed two doors. The three Brightwater cards were exactly what they looked like, and were dropped. Seventeen of the 96 cards had been seen nowhere at Northbank except in Tuesday's check. Not at Hollow Oak, not anywhere. The analyst underlines 17 and moves on, because there is nothing to do with it yet.
The call.
Petra runs operations at Hollow Oak. She is helpful, slightly defensive, and busy, which is the normal condition of an operations lead when a PSP rings.
In October, Hollow Oak recalled one lot of a product after a labelling fault. Support agents were authorised to issue goodwill credits of up to EUR 150 without a second approval, to any customer who complained, by card. Around 300 such credits went out. The policy is still in force because the complaints are still arriving.
So last week's alternative is partly true, and the desk says so out loud. Honest goodwill credits exist at Hollow Oak in quantity. The 53 credits to list cards sit inside a population of roughly 300, and a rule written as "credits to cards that never purchased" would catch some honest recall customers paying with a different card from the one on their subscription. The question is no longer whether the credits are real. It is which ones.
Petra sends the agent log. It is a spreadsheet, and it is the best evidence the desk has had so far.
The agent log.
- The 53 credits to list cards were issued by two routes. 38 carry the agent reference AG-14. 15 came through a merchant API key named ho-refund-02, created on 2 October.
- AG-14 issued 212 credits in October in total. The other 174 look like the recall: median EUR 39.90, one month's subscription, spread across the working week.
- The 38 to list cards cluster on Fridays between 18:00 and 19:00. The other 174 do not.
- 31 of the 38 are between EUR 140 and EUR 149. The recall credits almost never exceed EUR 80.
- None of the 15 API credits reference a support ticket. All of the recall credits do.
- Petra does not know who created ho-refund-02. The dashboard log shows the key was created from 203.0.113.44. The analyst has seen that address before, on Tuesday night, at Pondside.
The inference, written as one: someone with AG-14's access has been issuing credits to cards that never bought anything, just under the approval limit, at the end of the working week, and someone with a key has been doing the same thing without an agent at all. Whether those are the same someone is not something the spreadsheet can say.
The alternatives, kept alive and ranked. First: AG-14 is a shared login, and the Friday-evening person is not the Monday-morning person. Second: AG-14's credentials have been taken over and the agent knows nothing. Third: Hollow Oak's policy is loose enough that a EUR 149 credit to a stranger is within what an agent may do, and someone noticed. The third is the least comfortable, because in it nobody at Hollow Oak has broken a rule.
The cost of each move.
Ines lays it out. Ask Hollow Oak to suspend AG-14 and you are asking a merchant to act against an employee on the strength of a PSP's spreadsheet; if the login is shared, you have suspended the wrong person. Require dual approval at Northbank's end and every honest recall credit above the threshold waits, Petra's queue grows, and Hollow Oak's customers wait with it. Hold the nine unsettled credits and you interrupt the least, learn the least, and the pattern continues next Friday.
"Whatever we choose has a review date and a name on it," Ines says. "And we do not decide who at Hollow Oak did what. We decide what Northbank lets through."
Tomas asks whether the key matters more than the agent. The analyst thinks it does: an agent can be suspended; a key created from an address seen at another merchant's attack is a different kind of problem.
Before next week.
Try the case Refund ring at Hollow Oak, which uses a different export from the same merchant. Then read Write the note for the person who reopens it. and look back at what you recorded in episode one.
Fictional scenario. Synthetic data. No real customer records.