| { |
| "version": 1, |
| "seed": 42, |
| "histories_path": "data/synthetic/token_ids.npy", |
| "stage_names": [ |
| "pre_attack", |
| "probing", |
| "monetization", |
| "exfiltration", |
| "dormant" |
| ], |
| "type_names": [ |
| "victim_fraud", |
| "account_takeover", |
| "scam_redirected", |
| "declined_legit" |
| ], |
| "cast": [ |
| { |
| "pattern": "probing_then_takeover", |
| "display_name": "Customer A \u2014 card just got tested", |
| "customer_idx": 16, |
| "flagged_idx": 39, |
| "stage_label": 1, |
| "stage_label_name": "probing", |
| "type_label": 1, |
| "type_label_name": "account_takeover", |
| "description": "3+ small-amount CNP transactions in the 6-tx window before tx39, and the flagged transaction uses a device that appears nowhere else in the history. Probing in progress on a compromised card.", |
| "context_text": "Upstream fraud detector escalated transaction 39 at score 0.84. Assess pattern stage and type.", |
| "diagnostics": { |
| "probe_density": 5, |
| "post_attack_density": 0, |
| "novel_device": true, |
| "signature_clean": false, |
| "recent_authorize_density": 7 |
| }, |
| "original_customer_idx": 147105 |
| }, |
| { |
| "pattern": "exfiltration_takeover", |
| "display_name": "Customer B \u2014 full attack chain", |
| "customer_idx": 6, |
| "flagged_idx": 11, |
| "stage_label": 3, |
| "stage_label_name": "exfiltration", |
| "type_label": 1, |
| "type_label_name": "account_takeover", |
| "description": "Probing cluster preceding the flag AND multiple large unfamiliar-merchant charges around tx11. Novel device. Mature account takeover, attacker is harvesting.", |
| "context_text": "URGENT: tx 11 flagged at 0.92. Pre-decline window closing \u2014 classify now.", |
| "diagnostics": { |
| "probe_density": 0, |
| "post_attack_density": 3, |
| "novel_device": true, |
| "signature_clean": false, |
| "recent_authorize_density": 0 |
| }, |
| "original_customer_idx": 34242 |
| }, |
| { |
| "pattern": "monetization_victim", |
| "display_name": "Customer C \u2014 handed over card info", |
| "customer_idx": 0, |
| "flagged_idx": 22, |
| "stage_label": 2, |
| "stage_label_name": "monetization", |
| "type_label": 0, |
| "type_label_name": "victim_fraud", |
| "description": "Probing-then-big-purchase pattern at tx22, but the device fingerprint matches the customer's normal devices. Customer likely shared credentials under social engineering.", |
| "context_text": "Investigation requested for transaction 22. Upstream model score 0.78. Stage + type?", |
| "diagnostics": { |
| "probe_density": 3, |
| "post_attack_density": 1, |
| "novel_device": false, |
| "signature_clean": false, |
| "recent_authorize_density": 0 |
| }, |
| "original_customer_idx": 7105 |
| }, |
| { |
| "pattern": "scam_redirected", |
| "display_name": "Customer D \u2014 romance scam pattern", |
| "customer_idx": 7, |
| "flagged_idx": 22, |
| "stage_label": 1, |
| "stage_label_name": "probing", |
| "type_label": 2, |
| "type_label_name": "scam_redirected", |
| "description": "Customer's last 16 transactions show 5+ CNP charges to unfamiliar merchants on the customer's own device. Pattern consistent with customer-authorized scam payments.", |
| "context_text": "Hey, tx 22 pinged the fraud detector at 0.66. What's going on?", |
| "diagnostics": { |
| "probe_density": 4, |
| "post_attack_density": 0, |
| "novel_device": false, |
| "signature_clean": false, |
| "recent_authorize_density": 5 |
| }, |
| "original_customer_idx": 44699 |
| }, |
| { |
| "pattern": "dormant_false_positive", |
| "display_name": "Customer E \u2014 false alarm", |
| "customer_idx": 10, |
| "flagged_idx": 28, |
| "stage_label": 4, |
| "stage_label_name": "dormant", |
| "type_label": 3, |
| "type_label_name": "declined_legit", |
| "description": "Flagged transaction matches the customer's normal signature: home country, CVV match, AVS match, familiar merchant, no probe cluster, no exfil density. Likely an upstream rules false-positive.", |
| "context_text": "Investigator review on tx 28 (detector 0.61). Need stage + type.", |
| "diagnostics": { |
| "probe_density": 0, |
| "post_attack_density": 0, |
| "novel_device": false, |
| "signature_clean": true, |
| "recent_authorize_density": 0 |
| }, |
| "original_customer_idx": 75149 |
| }, |
| { |
| "pattern": "pre_attack_signal", |
| "display_name": "Customer F \u2014 early warning", |
| "customer_idx": 13, |
| "flagged_idx": 25, |
| "stage_label": 0, |
| "stage_label_name": "pre_attack", |
| "type_label": 1, |
| "type_label_name": "account_takeover", |
| "description": "Single anomalous transaction at tx25 with no chain evidence yet (no probe cluster, no exfil density). Device is novel. Step-up auth + watch.", |
| "context_text": "tx25 flagged @ 0.71. Classify.", |
| "diagnostics": { |
| "probe_density": 0, |
| "post_attack_density": 0, |
| "novel_device": true, |
| "signature_clean": false, |
| "recent_authorize_density": 3 |
| }, |
| "original_customer_idx": 96744 |
| } |
| ], |
| "subset_note": "customer_idx values have been remapped to [0, N) for HF Space deployment. original_customer_idx preserves the source pool index." |
| } |
