Assess whether the wire recall window is still open (92f8de)

SITUATION After a new device from a different metro on a 2am login, account-takeover device-fingerprint graph is what payments-risk officer can touch in an ACH originating credit union. Fraud Detection will live with Remove access or reverse the item versus Temporary compensating control on this Payments Fraud file.

DECISION Payments-risk officer in an ACH originating credit union must choose Remove access or reverse the item / Temporary compensating control / Approve a documented exception / Hold using account-takeover device-fingerprint graph after a new device from a different metro on a 2am login.

HYPOTHESES TO TEST 1. A new device from a different metro on a 2am login is noise around an already-controlled Payments Fraud process in an ACH originating credit union, given account-takeover device-fingerprint graph. 2. A new device from a different metro on a 2am login is the event in account-takeover device-fingerprint graph that forces Remove access or reverse the item for payments-risk officer under Fraud Detection. 3. Account-takeover device-fingerprint graph shows a one-file miss after a new device from a different metro on a 2am login, not a Payments Fraud program failure. 4. Account-takeover device-fingerprint graph cannot decide the wire recall window yet after a new device from a different metro on a 2am login; hold is the only Fraud Detection close an ACH originating credit union can defend.

ANALYSIS REQUIRED 1. Map typology and hold authority payments-risk officer actually has in an ACH originating credit union. 2. Trace funds, counterparties, and reversals in account-takeover device-fingerprint graph through the window opened by a new device from a different metro on a 2am login. 3. Quantify loss if the hold is released before account-takeover device-fingerprint graph is complete. 4. For this Fraud Detection Payments Fraud file, read account-takeover device-fingerprint graph against a new device from a different metro on a 2am login and write the one fact that would move the wire recall window for payments-risk officer.

RECOMMENDATION Choose Remove access or reverse the item / Temporary compensating control / Approve a documented exception / Hold on this Fraud Detection / Payments Fraud packet (account-takeover device-fingerprint graph after a new device from a different metro on a 2am login). Lead with the Fraud Detection option account-takeover device-fingerprint graph can support after a new device from a different metro on a 2am login, then the two facts that force it, then the Monday action for payments-risk officer in an ACH originating credit union.

COMMAND RETURNS - Bottom-line Fraud Detection option on the wire recall window, then the evidence in account-takeover device-fingerprint graph, then the action for payments-risk officer - Hypothesis scorecard against account-takeover device-fingerprint graph: supported / rejected / untestable - Missing page in account-takeover device-fingerprint graph after a new device from a different metro on a 2am login, if any - Regulatory or exam hook Payments Fraud would cite