Fraud Alerts

A fraud alert links a detection rule to an application. It retains when the activity was detected, a score and the current disposition. The Fraud Investigator starts with the alert, opens its application and compares the rule with the applicant and assessment evidence. The score helps order review, but the disposition records the human outcome. A confirmed alert should be understandable from the application context; a dismissed one needs the same care.

An unreviewed alert can move into investigation while the team checks source evidence. Once the investigator has resolved the case, mark it confirmed or dismissed. The Credit Reviewer uses that result during the application decision. Keep the application link intact through the handoff so the alert does not become an isolated number with no case history.

• Review queue. Unreviewed and investigating alerts keep unfinished work visible.
• Case context. Rule and application links let the investigator move from the alert to its cause and related evidence.
• Outcomes. Confirmed and dismissed alerts remain available for later case review and rule evaluation.

Set who may move an alert into investigation and who can record a final disposition. Agree how the team handles an alert on an application already under credit review, and what the Credit Reviewer must see before deciding. Define how the score is interpreted locally without turning it into an automatic approval or denial. Keep the source of alert creation clear so the investigator knows which evidence should be checked.

For a pilot, choose an alert with a known rule and application. Have an investigator read the rule version, inspect the case evidence and record a disposition. Then ask the Credit Reviewer to explain how that result affects the application decision. Repeat with a dismissed alert to ensure the team can describe why the alert did not change the case outcome.

Open an unreviewed alert for a submitted application. Verify the rule link and detection time, then read the applicant’s identity reference and provider evidence. Move the alert into investigation while those sources are checked. If the evidence supports the suspicion, mark it confirmed and return the case to the Credit Reviewer with the relevant source context. If it does not, mark it dismissed and retain the linked rule for later evaluation. The decision record should be attributable to the Credit Reviewer rather than inferred from the alert score.

• Fraud Alerts Review Queue — Unreviewed and investigating alerts tied to applications.
• Fraud Alert Outcomes — Confirmed and dismissed cases for follow-up review.
• Applications Review Queue — The applications behind the alerts.

Use alert investigation for the disposition path and credit decision for the next decision.