Fictional scenario. Synthetic data. Your notes stay on this browser; do not enter real customer information.
What the team did, and what it cost.
Ines reported the 35 new accounts and the five new bank references to Stilling Bank as suspected fraud. She reported Dario's account separately, in the free-text field, as unexplained and under watch, with the thirteen strangers' withdrawals set out as an observation and both inferences beneath it. The form had no box for that. She wrote it anyway.
The three older accounts had their withdrawals released on Thursday at 14:00, as promised. Dario took his money and closed his Lagoon account the same afternoon. Whether that is the act of a wronged customer or of someone who has been noticed, the desk does not know, and the note says so.
The cost of six weeks is now a list, and the analyst reads it out at the Friday meeting because Ines insists that costs are said aloud. Three abandoned gift-card purchases. Nine credits that went out while the desk was looking. Four days of backlog at Hollow Oak and one public complaint. Forty-one support contacts at Lagoon. One fourteen-month customer gone. Against that: EUR 10,400 that did not leave by bank transfer, a key revoked, a column of the export that now has a rule on it.
The decision.
It is made in a room, in forty minutes, with the whiteboard still up. Every action has a scope, an owner and a review date.
Pondside Gifts. The challenge rule was retired on schedule weeks ago. In its place, a standing alert: when attempts in a window exceed distinct cards by more than a set ratio, somebody looks. It blocks nothing. Owner Tomas. Review at 30 days against how often it wakes someone for nothing.
Hollow Oak Supplements. Dual approval for standalone credits above EUR 50 becomes a condition of the merchant agreement. Petra accepted it with the enthusiasm of someone accepting a parking fine. The key ho-refund-02 is revoked. What happened with AG-14's login is Hollow Oak's matter; Northbank's note records what the agent log showed and stops there.
Lagoon Casino. Benedikt closed the 35 accounts under Lagoon's terms and returned the deposits to the originating cards, the least harmful of the available destinations and also, the analyst observes, the list itself. Whatever Lagoon files with its regulator is Lagoon's decision. Northbank's cohort has gone to Stilling Bank with the timeline attached.
The 31 gift cards. Four fraud reports and two disputes so far. Pondside's volumes are small enough that the acquirer's ratio programmes are a distant concern; two ratios and their denominators explains why, and for which merchants it would not be.
The desk. Two new lines in the runbook: standalone credits are a monitored flow, and a portfolio-wide card alert is the first thing set after any check-the-list pattern, not an afterthought in week two.
Tomas asks whether it worked. Ines says the honest answer is that it stopped. "It stopped" and "we stopped it" are different sentences, and the note uses the first one.
What is still open.
Tomas, writing the final note, puts two things on the board under a heading that says not resolved.
The first is the seventeen. Seventeen of the 96 cards were checked at Pondside on 10 November and have not been seen anywhere at Northbank since. They were on the list for a reason, and the desk does not know the reason. They may be funded elsewhere. They may be waiting. They may be nothing.
The second is the address. 203.0.113.44 created the Hollow Oak API key on 2 October. It was in the Pondside burst on 10 November. It was on 22 Lagoon logins in late November. Five weeks before anyone touched a gift card, someone using that address was inside Hollow Oak's merchant dashboard with permission to create a key, and nobody at Hollow Oak has yet said whose login that was. Petra is, in her words, still looking.
That leaves two readings and the desk holds both. One: Hollow Oak's dashboard was taken over, the way a customer account is taken over, and the merchant is a victim from the beginning of the story rather than halfway through it. Two: someone at Hollow Oak was a participant from 2 October, and the agent log is only the careless part. The second reading is the kind that gets written down and not said in meetings. The analyst writes it down.
"Then we write both," Ines says, and closes the notebook. "And we date it."
Before next time.
The series Anatomy of a scheme takes each piece of this one at a time, from enumeration to cash-out. If you would rather stay at the desk, the case Silent rule is what happens at Northbank three weeks after the next export format changes.
Fictional scenario. Synthetic data. No real customer records.