Fictional scenario. Synthetic data. Your notes stay on this browser; do not enter real customer information.
What the team did, and what it cost.
Lagoon held the 36 withdrawals for 72 hours. Benedikt owned the hold and set the release for Thursday at 14:00, and told his support team exactly what to say and what not to.
The cost was immediate and loud. Thirty-eight accounts generated 41 support contacts in 48 hours. Most were short. Three were from the older accounts, and one of those, a player of fourteen months whose first name is Dario, wrote a complaint that Benedikt forwarded to the desk without comment. Ines read it and said, "Three people we may be wrong about. Write their names at the top of the page, not the bottom."
Under the hold, the desk did what a hold is for. It looked.
The bank accounts.
The six bank account references are hashed on Northbank's side, but Lagoon can see when each one was first used and by whom.
- BK-01, BK-03, BK-04, BK-05 and BK-06 were first used at Lagoon in the past 45 days. Between them they are on 22 withdrawal requests from 22 of the new accounts.
- BK-02 is on 14 requests. It was first used at Lagoon fourteen months ago. It is Dario's.
- Thirteen of the fourteen requests to BK-02 come from accounts that are not Dario's.
The observation is simple and the analyst keeps it simple: one person's bank account is the destination for thirteen strangers' winnings. There are two inferences, and the data cannot choose between them. A bank account number is not a secret; anyone Dario has ever paid could have it, and a stranger entering it on a withdrawal form proves nothing about Dario. Or Dario has lent the account, knowingly, for a fee, which is the arrangement the FATF's typology work describes as a money mule. The desk writes both, side by side, and does not pick.
The timeline.
Tomas builds it on the whiteboard with dates, because every piece so far has arrived out of order.
- 2 October: API key ho-refund-02 created at Hollow Oak from 203.0.113.44.
- 7 October to 17 November: 53 standalone credits from Hollow Oak to 44 cards on the list, EUR 7,050 in total.
- 10 November, 02:10 to 02:50: 96 cards checked at Pondside Gifts from the same address and two devices.
- 20 November to 2 December: 38 of the cards deposit at Lagoon, EUR 11,920.
- 3 December: 36 withdrawals requested to six bank accounts, EUR 10,400.
- 4 December, 14:00: withdrawals held.
One thing in the timeline closes a loop from episode two. Of the 23 cards declined at Pondside for insufficient funds, 19 had received no Hollow Oak credit by 10 November. The inference, labelled: the Pondside check was a check on which cards had been funded. It is a tidy fit. Tidy fits are the ones the desk trusts least, and the note says that too.
One thing does not fit. The deposits at Lagoon total more than the credits from Hollow Oak. Either the cards have another source of funds that Northbank cannot see, or the list is longer than 96, or both. The analyst writes another source and leaves it.
What Lagoon knows.
The 35 new accounts passed Lagoon's document checks, which is a fact about the documents and not about the people. Twelve of the 35 share a postal code. The three older accounts are verified in the fullest sense Lagoon has: years of deposits, withdrawals to their own bank accounts, addresses that match. No other account had ever withdrawn to BK-02 until the past three weeks.
Which is, Ines notes, consistent with both inferences about Dario, and distinguishes neither.
The report.
Stilling Bank, the acquirer, needs to be told. The question is what, and how wide. The acquirer's form has three boxes for an account: suspected fraud, confirmed fraud, and nothing. It has no box for thirteen strangers' withdrawals go to this man's bank account and we do not know what that means.
Report all 38 and the three older players are reported alongside the 35 whose documents are the only thing anyone knows about them. Report the 35 and leave the three under watch, and the acquirer has a picture with a hole the desk chose to leave. Report nothing until the files come back, and the hold expires on Thursday with the acquirer still in the dark.
"The report is a case note," Ines says. "Write what we know and how we know it. The bank can read."
Before next week.
Read A shared attribute is a lead, a ring is a finding. and look up mule account. Decide which of the two inferences about Dario you would write first.
Fictional scenario. Synthetic data. No real customer records.