Rule-based fraud triage: six alerts, one gap in the rulebook

Test each alert against all four rules before applying precedence.

• A1 → R1 (auto-block). ₹2.4 lakh > ₹2 lakh, device 2 days old (< 7), beneficiary 12 days old (< 30). All three limbs satisfied. R2 is not triggered because the amount is above ₹2 lakh; R3 is not stated.
• A2 → R2 (hold and call). ₹1.6 lakh lies within ₹50,000–₹2 lakh, time 02:15 is inside the 23:00–06:00 window, and Pune ≠ Nashik. R4 cannot apply because of the amount and the night-time condition does not matter for R4, but R2 outranks R4 anyway.
• A3 → R3 (auto-block). The beneficiary is on the mule list, so R3 fires irrespective of amount and outranks everything. R1 also happens to be satisfied (device new), which confirms the block.
• A4 → R4 (auto-approve). KYC verified, 4-year relationship ≥ 3 years, ₹85,000 ≤ ₹1 lakh, beneficiary used 4 times. R2 fails because 19:00 is outside the night window; no other rule fires. This is the only clean auto-approve.
• A5 → unresolved. R1 fails (device 45 days old). R2 fails on amount (₹2.1 lakh is above ₹2 lakh). R3 fails (not a mule). R4 fails on amount. No rule covers it → it must fall to a default manual review.
• A6 → R2 (hold and call). ₹95,000 is in range, 03:00 is in the night window, location differs. R4 fails because the beneficiary has never been used before.

The gap is A5: a high-value, odd-hours, geo-mismatched transaction with a 6-month-old beneficiary is the exact profile of an account-takeover, yet the rulebook passes it because R1 was written narrowly around new devices and R2 was capped at ₹2 lakh.

Amend R2, not R1. The defect is the upper bound: risk does not fall when the amount rises above ₹2 lakh, so capping R2 at ₹2,00,000 creates a blind spot exactly where the loss would be largest. Suggested form:

R2 (revised) - amount above ₹50,000 AND transaction between 23:00 and 06:00 AND transaction location different from registered address AND beneficiary not previously used successfully → hold and call the customer.

Effect on the six alerts: A5 now becomes a hold-and-call (₹2.1 lakh, 01:00, Pune vs Nashik, beneficiary never used). A2 still holds, A6 still holds. A4 is untouched because 19:00 is outside the night window. A1 is still blocked first by R1, so precedence is unchanged. Nothing that was auto-approved becomes blocked - the change only converts silent passes into a call, which is a low-friction control.

Why not widen R1 instead? Lowering the ₹2 lakh threshold or broadening "new device" would block routine salary-day transactions and cause more false positives than R2's night-plus-geo-mismatch combination, which is already narrow. A second, structural fix worth recommending is a default rule: any transaction above ₹2 lakh that satisfies no rule goes to manual review within 30 minutes, so the rulebook is closed rather than open-ended.

Step 1 - which rule can produce an auto-approve? Only R4. So the four R4 limbs must all be true: KYC verified; relationship ≥ 3 years; amount ≤ ₹1,00,000; beneficiary used successfully before.

Step 2 - because precedence is R3 > R1 > R2 > R4, an auto-approve means no higher rule could have fired.

• R3 not satisfied → beneficiary is not on the mule list (this one is certain and absolute).
• R1 not satisfied → but amount ≤ ₹1 lakh already makes the "above ₹2 lakh" limb false, so R1 is excluded automatically and tells us nothing further.
• R2 not satisfied → amount ≤ ₹1 lakh means the amount limb can be satisfied (₹50,000–₹1,00,000 is inside R2's band), so at least one of the other two limbs must be false: either the transaction was not between 23:00 and 06:00, or the transaction location equals the registered address (or both).

Step 3 - a common trap. It is tempting to conclude "auto-approved, therefore it was a daytime transaction". That does not follow: a ₹70,000 transaction at 02:00 from the registered address would also be auto-approved, because the geo limb fails. The only logically forced conclusions are the four R4 limbs plus "not a mule beneficiary" plus "not (night-time AND different location)".

Answer: certain - KYC verified, ≥ 3-year relationship, amount ≤ ₹1 lakh, beneficiary previously used, beneficiary not on the mule list, and not both night-time and geo-mismatched; not certain - the specific time, the specific location, or the device age.