Fraud Alert Rules at a Retail Bank Branch
A retail bank's fraud-monitoring team applies four hard rules to every debit transaction on a savings account. R1: flag if the amount exceeds ₹2,00,000 and the beneficiary was added within the last 24 hours. R2: flag if the account has made three or more debits in the last 24 hours and the average debit exceeds ₹40,000. R3: flag if the transaction is to a beneficiary in a different state and the amount exceeds ₹1,00,000. R4: flag if the account's balance after the transaction is below ₹5,000 and the amount exceeds ₹50,000. On 14 June the team reviews four transactions: T1-₹2,40,000 to a beneficiary added 6 hours earlier; T2-₹45,000, the third debit of the day, day's average ₹46,000, existing balance ₹80,000; T3-₹1,20,000 to an out-of-state beneficiary, balance after debit ₹4,200; T4-₹55,000 to a beneficiary added 30 days earlier, balance after debit ₹4,800. The team must decide alerts, rule redundancy, and an override.
1. Which of T1–T4 trigger at least one rule? Show the outcome rule by rule.
Read the worked answer
- R1: T1 qualifies (₹2.4 lakh > ₹2 lakh; beneficiary 6 hours old).
- R2: T2 qualifies (third debit; average ₹46,000 > ₹40,000).
- R3: T3 qualifies (out-of-state; ₹1.2 lakh > ₹1 lakh). T4 fails the amount test.
- R4: T3 and T4 qualify (balances ₹4,200 and ₹4,800 are below ₹5,000; amounts exceed ₹50,000). T2 fails because its balance is ₹80,000.
Thus all four transactions trigger at least one rule: T1 via R1; T2 via R2; T3 via R3 and R4; T4 via R4. T1's post-transaction balance is not stated, so R4 cannot be decided for T1, but that does not affect the alert outcome because R1 already applies.
2. If R2 were removed, which transaction would lose its only alert, and why is that gap material?
Read the worked answer
T2 would lose its only alert. Its amount (₹45,000) is below the ₹2 lakh R1 threshold, below the ₹1 lakh R3 threshold, and below the ₹50,000 R4 amount threshold; its balance (₹80,000) is also healthy. No other rule catches a repeated pattern of mid-sized debits. That gap is material because structuring often uses amounts just under reporting thresholds, and a customer making several ₹40,000–₹49,000 debits in a day can look normal transaction by transaction while still showing a suspicious aggregate pattern. R2 is therefore not fully redundant.
3. T3's beneficiary age is not recorded. Does that make T3's alert status uncertain? Explain.
Read the worked answer
No. T3 is flagged by R3, which depends only on the beneficiary being in a different state and the amount exceeding ₹1 lakh; both facts are known. T3 is also flagged by R4, which depends on the post-debit balance and the amount, again both known. Beneficiary age matters only for R1, and R1 is not needed to reach an alert. The missing field would be relevant only if the team were trying to decide whether R1 also applies, not whether T3 should be flagged at all.