Fictional scenario. Synthetic data. Your notes stay on this browser; do not enter real customer information.
The last nine days are about the desk as part of something larger: an incident process, an acquirer relationship, a merchant portfolio, and the colleagues who will do this work after you. Week four runs to day thirty.
Day 22 — The first fifteen minutes.
An incident is decided in its first quarter of an hour, and not by the cleverness of the response. By whether anyone knew who could act, what they were allowed to do without waking someone, and where to write it down. The runbook is a list of permissions, not a list of techniques.
Today: write down, for an overnight attack on your busiest merchant, who would see it, what the first action they are permitted to take is, and who they must call before the second. If any of those three has no answer, that is the runbook's first line.
Read: The first fifteen minutes.
Day 23 — What the acquirer asks.
Your acquirer sees your portfolio through ratios and reports, and asks questions that sound like accusations and are usually requests for a denominator. Knowing what they will ask, and having the cohort ready, turns a difficult call into a short one.
Today: find the last written question your acquirer sent and the answer that went back. Was the answer a count, a ratio, or a story? Write down what you would attach next time: the cohort, the rule, the review date. If you have never had such a question, ask your acquirer contact what they would want first in an incident.
Read: What the acquirer asks, and why.
Day 24 — Who carries the dispute.
When a transaction is authenticated through 3-D Secure, liability for certain fraud disputes can shift to the issuer; when an SCA exemption is used and authentication is skipped, it generally stays with the merchant side. Confirm the detail with your acquirer. Every exemption is therefore a decision about who pays if it goes wrong, made at checkout by whoever configured it.
Today: list the exemptions your merchants use and, for each, write down who carries a fraud dispute on an exempted transaction. If nobody on the desk knows, ask the acquirer, today. Then write the question for the team: which exemptions would we keep if the liability shift did not exist?
Read: Who carries the risk when 3DS is skipped. and look up liability shift.
Day 25 — Read a merchant before the first transaction.
A merchant file has a date on it, and that date is usually onboarding. Everything a merchant has done since is a change the file does not know about. Underwriting that stops at onboarding sees a bust-out only when the chargebacks arrive, by which time the settlement account has changed and the phone is disconnected.
Today: pick three merchants and check when each file was last reviewed. For each, write down one thing that has changed since: volume, product, average ticket, settlement details. If the answer is "nothing has changed", check the average ticket anyway.
Read: Reading a merchant before the first transaction.
Day 26 — Three layers of a takeover.
An account takeover shows in three places: the session, the device, and the behaviour. A new device alone is a person with a new phone. A new device, a password reset and a changed payout destination within an hour is a sequence, and the sequence is the signal.
Today: for your most sensitive account action, a withdrawal destination change or a payout detail edit, pull last week's events and look at what else happened on each account in the preceding hour. Write down the commonest sequence. Then write down the innocent version of it.
Read: Three layers of a takeover. and try the case SIM-swap trader.
Day 27 — Teach it to someone.
The fastest way to find out whether you understand a pattern is to give the case to someone who has never seen it and watch where they get stuck. Where they get stuck is where your note was unclear, or where the pattern is genuinely hard, and both are worth knowing.
Today: give a colleague, ideally someone newer than you, a Volume 01 case to work in twenty minutes. Do not help. Afterwards, ask what they would have wanted to know first. Write their answer in the second notebook.
Read: the Volume 01 case Card testing is the one to hand over; it is short and the evidence changes its mind twice.
Day 28 — Write the rule's obituary.
A rule that was right in March can be wrong in November. The merchant changed, the attack changed, the channel moved. A rule with no retirement condition lives forever, interrupting customers for a pattern that stopped. Every rule should have, in its description, the condition under which it is switched off.
Today: take the rule from day thirteen and write its obituary now, in advance: "Retire when the step-up rate on this BIN range falls below X for Y weeks" or "Retire when the merchant migrates the channel." Put that sentence in the rule's description field.
Read: A velocity rule is a sentence with four parts.
Day 29 — The question for the team.
A desk that only answers questions never improves. The articles in the library each end with a question for a team meeting, because a question written down and asked out loud changes what a team measures. The best questions have no comfortable answer.
Today: write one question your team cannot currently answer about its own work and bring it to the next meeting. "What did we interrupt last month that was not fraud?" "Which rule has nobody reviewed this year?" Write down what happened when you asked it.
Read: the Volume 01 lesson Time and outcomes, which is the long version of why outcomes arrive late.
Day 30 — What you would tell day one.
Thirty days ago you wrote three lines about one decision. Today you have two notebooks: one about what you worked on, one about how you work. The second is the one that will matter in a year.
Today: read the second notebook from the beginning. Write, in no more than five lines, what you would tell yourself on day one. Then put the date on it and a review date in six months, because advice is a rule too, and rules age.
Read: look up baseline. Everything you measured this month was measured against one, and now you know which. If you want to keep going, The Northbank dossier is six weeks of the same discipline under pressure.
Fictional learning material. Any numerical examples are synthetic. Use only authorised, appropriately minimised records for workplace exercises; do not upload customer information to this learning site.