Detection Rules

A detection rule has a name, version, expression and status. The Rule Steward uses those details to distinguish a draft change from a reviewed or active rule. An alert points back to its rule, giving the Fraud Investigator a way to understand why that alert belongs in the case. A rule version should remain identifiable when the team later examines an earlier application or a confirmed alert.

Review the expression in the terms your fraud team uses for case evaluation. A rule’s text is an operational definition and deserves deliberate review before it is marked active. Retiring a rule should leave its earlier alerts intelligible. The team should retain the version that explains each alert rather than rewriting history when criteria change.

• Rule register. Active rules can be found by name, version, expression and status.
• Review work. Draft and reviewed rule records give the Rule Steward a focused change queue.
• Alert link. Each fraud alert identifies the rule that belongs to its application review.

Decide who authors expressions, who reviews them and what evidence supports activation. Define the practical meaning of draft, reviewed, active and retired for your team. A new version should be named consistently so reviewers can distinguish it from the earlier one. Record who will check alert effects after a rule change, especially when the new expression might change which cases investigators see first.

Use a representative rule during setup. Write its expression, review the conditions with a second person, and mark the version reviewed only after the intended cases are understood. Examine an existing alert linked to that rule. The investigator should be able to read the version and explain the alert’s place in the application history without guessing what the rule meant at the time.

Take an application with a linked alert. Open the rule from the alert and check its name, version and expression. Compare those conditions with the application and assessment evidence. If the expression is being revised, keep the earlier version identifiable while the Rule Steward works on the replacement. Ask the Fraud Investigator to state which rule version they used for the disposition. If a rule is retired, the old case should still make sense to the Credit Reviewer reviewing the decision.

• Detection Rules Active Register — Active rule definitions and their versions.
• Detection Rules Review — Draft and reviewed definitions awaiting stewardship.
• Fraud Alerts Review Queue — Open alerts linked to a rule and application.

Read rule review before changing a version, then alert investigation for the case handoff.