Assess whether the model score is a false positive from a life event from ACH

SITUATION In a mortgage correspondent channel, ACH return-reason code R10 spike is the evidence after an email that matches a known BEC lure almost exactly. Payments-risk officer has to pick Remove access or reverse the item or Temporary compensating control for this Fraud Detection Credit and Identity Fraud close using ACH return-reason code R10 spike.

DECISION Payments-risk officer in a mortgage correspondent channel must choose Remove access or reverse the item / Temporary compensating control / Approve a documented exception / Hold using ACH return-reason code R10 spike after an email that matches a known BEC lure almost exactly.

HYPOTHESES TO TEST 1. The population in ACH return-reason code R10 spike is the one an email that matches a known BEC lure almost exactly named, so Remove access or reverse the item follows for this Credit and Identity Fraud file. 2. The population in ACH return-reason code R10 spike is adjacent only to an email that matches a known BEC lure almost exactly; Temporary compensating control is the honest Fraud Detection call. 3. A mortgage correspondent channel already contained an email that matches a known BEC lure almost exactly before ACH return-reason code R10 spike arrived; no new Credit and Identity Fraud path. 4. Provenance on ACH return-reason code R10 spike after an email that matches a known BEC lure almost exactly is broken; do not pick Remove access or reverse the item or Temporary compensating control yet.

ANALYSIS REQUIRED 1. Trace funds, counterparties, and reversals in ACH return-reason code R10 spike through the window opened by an email that matches a known BEC lure almost exactly. 2. Quantify loss if the hold is released before ACH return-reason code R10 spike is complete. 3. Test a one-off dispute against the first edge of a scheme around the model score is. 4. For this Fraud Detection Credit and Identity Fraud file, read ACH return-reason code R10 spike against an email that matches a known BEC lure almost exactly and write the one fact that would move the model score is for payments-risk officer.

RECOMMENDATION Choose Remove access or reverse the item / Temporary compensating control / Approve a documented exception / Hold on this Fraud Detection / Credit and Identity Fraud packet (ACH return-reason code R10 spike after an email that matches a known BEC lure almost exactly). Lead with the Fraud Detection option ACH return-reason code R10 spike can support after an email that matches a known BEC lure almost exactly, then the two facts that force it, then the Monday action for payments-risk officer in a mortgage correspondent channel.

COMMAND RETURNS - Bottom-line Fraud Detection option on the model score is, then the evidence in ACH return-reason code R10 spike, then the action for payments-risk officer - Hypothesis scorecard against ACH return-reason code R10 spike: supported / rejected / untestable - Missing page in ACH return-reason code R10 spike after an email that matches a known BEC lure almost exactly, if any - Regulatory or exam hook Credit and Identity Fraud would cite