Demo data
Transaction Investigation
Select a transaction to review its deterministic signal breakdown, AI narrative and response options.
Transaction ledger
Filter, sort and select a transaction
Attack story · correlation view
Five individually-moderate events on ACC-40219, fused into one campaign.
- 117:48
LOGIN ANOMALY
Credential-stuffing attempt from ASN 200651 (residential proxy exit).
- 217:50
NEW DEVICE
Headless Chrome fingerprint dev_9f21ac enrolled without step-up verification.
- 317:51
NEW LOCATION
Session origin shifts Austin, US → Bucharest, RO — 1,180 km/h implied velocity.
- 417:52
FAILED AUTHENTICATION
4 failed authentication attempts in 90 seconds, then success on the 5th.
- 517:54
LOW-VALUE PROBING
$1.21 and $2.40 authorisations validate the card before escalation.
- 618:33
HIGH-VALUE TRANSACTION
$18,400 routed to CoinBridge OTC crypto off-ramp — irreversible rail.
- 718:34
ACCOUNT TAKEOVER RISK
Correlation engine fuses 5 events into a single coordinated ATO campaign.
$18,400
CoinBridge OTC · Bucharest, Romania · 19 Aug 18:33 UTC
Severity
critical
Confidence
98%
Detectors fired
8/8
Account
ACC-40219 · M. Halloran
Channel
crypto offramp
Device
Linux · Headless Chrome
Device ID
dev_9f21ac
IP address
185.62.204.117
Geo
Bucharest (RO)
Merchant category
Crypto off-ramp
Currency
USD
Why is this suspicious?
$18,400.00 to CoinBridge OTC (Crypto off-ramp) from Bucharest, Romania scored 92/100 because 8 independent detectors fired simultaneously — led by unusual amount, impossible travel, new device. Individually, each of these signals is tolerable. Together they describe a session that does not behave like M. Halloran: the payment rail, the hardware and the geography all changed at once, inside a window too short for a legitimate travel or purchasing explanation. The engine weights corroboration heavily: 8 of 8 detectors agreeing raises confidence to 98%, which is above the auto-escalation threshold.
Transaction is 9.2× the account's 90-day average ticket size.
Device fingerprint has never been observed on this account before.
Originating country is outside the account's historical geography profile.
Implied travel velocity of 1180 km/h between consecutive sessions — physically impossible.
4 failed authentication attempts preceded this transaction.
Executed at 04:00 account-local time — outside the 06:00–23:00 behavioural window.
7 transactions from this account in the preceding 60 minutes (baseline: 1.2/hour).
Merchant risk index 0.90 — high-abuse merchant category with elevated chargeback rates.
AI Investigation
Run the analysis layer to fuse this transaction with correlated account activity and produce a structured incident narrative.
Recommended actions
Actions update transaction state and append to the response timeline.