The Vanishing Refund Queue
You are the lead investigator for a mid-size online retailer. Customer-service data shows 412 refunds totaling $187,400 issued over 14 months by one agent, "M.R." All were coded "goodwill" and none has a matching returned item. M.R. approved every one personally, always just under the $500 supervisor threshold, and 78% went to 23 customer accounts sharing only 9 mailing addresses. The fraud-analytics vendor flagged the pattern two weeks ago. M.R.'s manager wants to confront her today and suspend access immediately. Legal counsel has not yet been consulted. You have read-only access to the refund system, the HR file is held by the people team, and the payment processor retains transaction logs for 180 days. The oldest flagged refunds are 16 months old.
1. What should happen before any confrontation with M.R., and why?
Read the worked answer
Confrontation is premature. Three gaps must close first.
Evidence preservation. Processor logs expire at 180 days, so the 16-month-old refunds may already be unrecoverable through normal channels. Issue a written litigation-hold/preservation request to the processor and to internal IT today, before anyone tips off M.R. Preservation is time-critical and independent of whether discipline follows.
Scope and linkage. Confirm the 23 accounts and 9 addresses are genuinely linked (shared device fingerprints, IP ranges, bank accounts) rather than coincidence or a legitimate reseller. Pull the "goodwill" coding trail to see whether M.R. acted alone or a supervisor tolerated the pattern.
Legal and HR sequencing. Consult counsel on employment-law exposure, privacy limits on monitoring, and whether the conduct may be criminal (warranting law enforcement referral). HR should control the personnel file; as investigator you request only what the case needs.
Suspending system access quietly is reasonable to stop ongoing loss, but it should be framed as administrative pending review, not as an accusation, and coordinated with HR and counsel so it does not compromise the investigation or create liability.
2. Draft the sequence of investigative steps from today to a decision point, and identify the single biggest risk to the case.
Read the worked answer
Sequence:
- Day 0: preservation letters to processor and IT; quiet read-only export of refund records and audit logs.
- Days 1–3: link analysis on the 23 accounts/9 addresses; identify device and IP overlap; check whether any refunds reached M.R. or associates directly.
- Days 3–5: counsel and HR alignment on scope, privacy boundaries, and referral criteria.
- Days 5–7: structured interview of M.R. only after documentary record is locked; prepare exhibits and a non-accusatory opening.
- Post-interview: corroborate admissions, quantify loss, decide on restitution, termination, and law-enforcement referral.
Biggest risk: premature confrontation destroying evidence and tipping off co-participants. M.R. controls the refund workflow and could delete records, alter account data, or warn the 23 beneficiaries. A close second is spoliation through the 180-day processor window. Preservation and sequencing, not interrogation skill, decide whether this case survives.