APP Fraud Decision Evidence Pack

0.  Executive summary

The conclusion first, on one page, for a senior reader (CRO, Audit, Board Risk, Model Risk). Every figure is a direct engine output; the detail and basis follow in §1–§6.

1.  Scope and basis of the evidence

What this pack is, what it is not, and the exact basis of every number.

This pack reports the decisions the CADi engine produced when the four labelled Aizle APP-fraud scam episodes — and the entire 494-send outbound push-payment book they sit in — were run through the live decision engine, cut at the pre-execution authorisation point: the moment before a payment would be released. The fraud label never entered the engine; it is joined afterwards, off the decision path, only to report what each send turned out to be. Legitimate sends carry no label at all: absence is their honest ground truth.

Supersedes an earlier proxy pack. A previous version of this document hand-mapped the routing and reported “2 Protect, 2 Augment, 0 Automate” at confidences of 0.60–0.75. Those figures were hand-assigned, not engine output. The real engine result below differs materially and replaces it.

2.  The portfolio

Four scam episodes, 16 sends, £34,026.82 total exposure, read directly from the synthetic ledger.

Fact Grooming-pattern scams unfold as an escalating series, not a single payment. The timeline shows every send of this run's longest episode at its real calendar position and £ size; detector flags appear on 1 of the 13 sends — the opening send, where the beneficiary is still a first-time payee. Inference That is precisely the point of an episode-level evidence record: after the first payment the per-send novelty signal goes quiet, and only the arc — recurring sends to the same beneficiary, stepping up in size — carries the pattern. A single-payment view cannot see it.

The full push-payment book the episodes sit in

Fact The same engine, under the same run discipline (pre-execution decision cut, no labels on the stream), also processed the entire outbound push-rail population of the sample ledger: 494 sends — the 16 labelled scam sends plus 478 legitimate sends — drawn from 5,912 personal transactions across 4 banks (2025-01→07). Card-rail rows (POS, ATM, direct debit) are excluded by shape: they are not push payments, and an APP-scam lane cannot honestly claim to have screened them. Within the push lane the scam share is 3.2%; against the whole ledger it is the familiar sub-1% base-rate picture.

Fact Routing over the book: Augment×494 — identical review posture to the episode result (§3), for the same corroboration-bar reason (§4). The operational meaning is a workload statement: on this data, every push-payment send is routed to human-augmented review, none to straight-through processing and none to a hold.

Limitation This is a review-surface density, not a false-positive rate. The ledger carries no ground truth for “should have been flagged”, so no precision figure exists to claim. The dominant signal — payee novelty, 177 fires — is additionally inflated by window truncation: the first observed leg of a long-running standing order reads as “first-time” inside the sample’s seven-month window. The 31 Confirmation-of-Payee mismatches on legitimate sends are genuine name-check mismatches recorded in the source data.

Limitation Sample-slice ceiling. Ten people, four fraud episodes. The book adds portfolio shape — workload split, detector surface, base-rate context — it does not add statistical power. Calibration, precision/recall and P&L claims remain out of reach at n=4 positives; they require the full corpus this sample is drawn from, or a real operator’s data (§A2).

The scam economy this portfolio samples: real-world prevalence context

Fact For scale context only: across 350,361 fraud complaint reports to the Canadian Anti-Fraud Centre (2021-01-01 → 2025-09-30), reported losses total CAD $2,687,420,244. Grouped into the UK APP vocabulary this pack uses, the mix is:

Limitation Context, not calibration. These are complaint reports (one row per report, not per transaction), self-selected and self-reported, in Canadian dollars, from a different jurisdiction; the five-family grouping is CADi's own mapping of the source categories (listed beneath). Nothing in this pack is calibrated to these figures and no UK equivalence is claimed. Their role is the opposite of a claim: they show that the episode typologies this pack reports — which fall in the Investment, Impersonation, Romance families — sit in the loss-heavy region of the real scam economy, where investment and romance/impersonation arcs dominate reported loss while high-frequency purchase scams dominate report counts at small median size.

Contains information licensed under the Open Government Licence – Canada. Source: Canadian Anti-Fraud Centre fraud-and-cybercrime reporting data, 2021-01-01 → 2025-09-30 (retrieved 2026-07-04).
Family mapping (authored): Investment ← Investments; Impersonation ← Bank Investigator, Spear Phishing, Emergency (Jail, Accident, Hospital, Help); Romance ← Romance; Purchase / invoice ← Merchandise, Counterfeit Merchandise, Vendor Fraud, Service, False Billing; Advance fee ← Prize, Loan, GRANT, Foreign Money Offer, Recovery Pitch. Enabler categories (identity theft/fraud, phishing, personal-information — ≈139k reports with a universal $0 loss by source convention) are deliberately excluded from every family above.

3.  The decisions the engine produced

Fact Observed routing split: 0 Protect, 16 Augment, 0 Automate. None of the 16 sends was routed to straight-through processing; every send was routed for human-augmented review.

Fact The engine routed 16 of 16 sends to Augment (human + Ai review) and zero to Automate (straight-through). 4 of 16 sends carried at least one detector flag (7 flags in total), and regulatory distance varies across the portfolio: from 0.000 on the unflagged sends up to 0.142 on the most-evidenced send (01000862965). Consumer-Duty scope returned UNDETERMINED (16); the engine's own scope reasons record why, and §A4 sets them out.

Fact Confidence was uniform at 0.165: every send resolved to the same review posture (Augment, human-confirms, collaborative review) and carries the same recorded confidence. Inference The confidence attaches to that resolved posture rather than varying case by case on this data. Limitation It is therefore not a per-send uncertainty estimate on this portfolio; like the £0 commercial-cost view (§5), the uniformity is information about what this dataset does not vary, and a portfolio that varies the posture-driving inputs would spread it.

Inference On this portfolio the detectors changed what the engine records (the evidence written to the case file) without changing the routing action. §4 sets out the observable reason for that separation.

The 4 flagged sends, most-evidenced first

Fact On each flagged send the CADi detectors wrote the flags above, and their regulatory citations, to the case file; the send is held at Augment for review with interventions build evidence package, hold payout, request additional evidence. The evidence is recorded whether or not it changes the routing action. The most-evidenced send is worked end to end in §A5.

Each row below is traceable to a source record in the engine's output by its transaction ID; the detector flags and citations on each are reproduced verbatim from that record.

4.  Differentiation observed in the evidence, not in the action

Fact The engine separates the most-evidenced send (£862.00 Romance Scam, 01000862965) from an unflagged send by the evidence it records: 2 detector flags and regulatory distance 0.142 versus none and 0.000. Fact It does not separate them in the routing action: both route Augment.

Fact 4 of the 16 sends carry a typology-specific flag stack and a non-zero regulatory distance recorded on the dossier (§3); the remaining sends return the baseline Augment at regulatory distance 0.000. Inference The engine therefore ranks and separates these sends by the evidence it surfaces, but does not change the routing action as a result on this portfolio. The observable reason is as follows:

• This traffic is held for review by default. The engine routes account-to-account sends to human-augmented review (Augment) as a baseline; the detectors add evidence to the case file and can raise the response from there.
• A payment hold requires corroborating evidence. The detectors distinguish higher-severity signals from supporting diagnostics. A single signal is recorded and acted on within review, but the engine requires corroborating higher-severity evidence before it will apply a Protect hold: friction on a payment that may well be legitimate. This is a deliberate guard against acting on a single, uncorroborated signal.
• No send in this portfolio met that bar. Each flagged send carried supporting evidence but not the corroborating combination the engine requires for a hold, so all remained at Augment. The most-evidenced send (the highest regulatory distance in the run, 01000862965) is the closest case and is worked end-to-end in §A5. This is also why the earlier proxy’s hand-assigned “2 Protect” was not reproducible from the engine.

The same evidence under different hold bars

Inference The recorded evidence stacks make the hold policy a tunable governance choice rather than a fixed property of the engine. The table below re-reads the severity mixes published in §3 under illustrative hold bars; it is arithmetic on the recorded evidence, not a re-run.

On this portfolio the two middle bars pick out the same 2 sends: every higher-severity signal recorded here arrived with a supporting diagnostic alongside it.

Limitation The illustrative bars are governance discussion aids, not the engine's configured thresholds, and a hold candidate is not a detection of additional fraud: whether any bar is appropriate is a calibration question for a powered, labelled dataset (§A2). Inference On this portfolio the strictest bar changes nothing and the loosest changes at most 2 of 16 routings: the anti-overblocking posture is visible at every bar.

5.  The commercial-cost view

Fact Alongside the loss-side view, the engine also assesses the commercial cost of its decisions: the throughput and acceptance trade-offs a payment operation cares about. On this portfolio the module executed on every send but the dataset does not populate it; the assessment returns £0.00. Inference The reason is the dataset, and it is stated below.

Fact The zero is now shown, not asserted. The assessment decomposes into four commercial channels plus a cross-channel interaction term, and the run record serialises that decomposition for every send of the full 494-send book, with an internal consistency check passing on every one. The table reads it directly; each channel carries the method's own rigor label and the specific reason it prices £0 on this data.

Limitation One commercial quantity is structurally absent rather than zero: the cost of wrongly declining a legitimate payment. Measuring it requires knowing that a declined payment was in fact legitimate — a ground truth no settled-only ledger can carry, and this book records no declines at all. That quantity is not identified here, and no proxy for it is asserted.

Inference A non-zero commercial result therefore requires inputs this dataset does not carry — the authorisation, decline/retry and step-up signals a live payment feed supplies (§A2 lists what a populated run would need). The mechanism above is the part the engine brings; the missing part is data, not machinery.

6.  The two views side by side

Fact Both views on one page: the commercial-cost assessment is £0 on every send; the compliance view is the only one that varies, and it tracks the recorded evidence (§4).

Fact The commercial-cost assessment is £0 on every send — read per send from the serialised post-decision assessment, not asserted (§5 shows the channel decomposition behind it). The compliance view (regulatory distance, which the engine tracks separately) is non-zero on 4 of 16 sends and ranks them by the evidence recorded:

7.  The value beyond the report: counterfactual position

Fact The evidence in §1–§6 is the compliance floor: a defensible record of why each of the 16 sends was handled as it was. Inference The value CADi adds on top of that floor is commercial: the same engine that differentiates these sends by evidence also locates where an operator sits in the payments value chain, and therefore which counterfactual exposure they carry. That exposure is the figure a competing approach would have to beat.

Fact Across this portfolio the engine did not merely flag risk; it separated four distinct APP typologies (Impersonation: Bank, Impersonation: Family, Investment Scam, Romance Scam) and ranked them by the evidence each carries, from regulatory distance 0.000 on the unflagged sends up to 0.142 on the most-evidenced send (§4). Inference That ranked, typology-aware separation is the raw material of commercial direction: a generic fraud score says a payment is risky; CADi identifies which kind of risk it is, and which part of an operation owns the cost of getting it wrong.

Position in the chain decides which counterfactual applies

Inference The same payment carries a different cost depending on position in the chain. CADi reads that position from the routing trail it already produces and points to the exposure that position actually owns: not a generic risk number, but the specific regret a better decision would relieve.

Fact On this portfolio the variation lives in the compliance / evidence channel (4 of 16 sends carry a non-zero regulatory distance; §6). Inference The commercial channel is sized the moment the engine sees the matching traffic for a given position; the mechanism below is the same on both channels.

8.  Audit opinion

A senior-reader summary of what this evidence supports, in one page.

A1.  Provenance and limitations

This pack reports decisions on fully synthetic data for demonstration; the scope and limits of the claim are stated formally in the assurance statement (§A2). It supersedes a prior version whose routing figures were hand-assigned rather than engine-derived.

A2.  Regulatory assurance statement

What a stronger claim would require

Limitation Each claim this pack does not make is gated on a specific input this run did not have. Stated as data requirements, not promises:

A3.  Reproducibility

The basis on which the figures in this pack can be regenerated from source.

Fact Every figure in §0–§8 is a function of those two output records, which are produced by running the named dataset through the engine. An independent party with the dataset and engine access can reproduce them. The synthetic data and the run harness are available under appropriate terms.

A4.  Controls and regulation mapping

Fact The regulatory anchor behind each detector, and the evidence the engine produced against it: mapping the technical output to the obligations it speaks to.

Inference The "regulation" column is the regulatory anchor the engine attaches to each detector in its own output. It records the regulatory incentive to detect, not a regulator-defined indicator: the detectors are operational signals informed by published APP-scam typologies.

A5.  Worked case: one send, end to end

Fact The highest-regulatory-distance send in the run (01000862965, £862.00 Romance Scam) traced from transaction to final record, each step read directly from the engine output.

A6.  Regulatory distance: methodology

What the score is, what drives it, what a higher value means, and how it is computed: enough to confirm the logic is coherent and reproducible, not a black box. Regulatory distance is an evidence-accumulation score, not a fraud probability.

What drives it

Fact Three inputs, and only these three:

The formula

Fact The score is a deterministic, rule-based composite: no trained model, no hidden state.

Fact Severity weights are fixed constants: higher-severity = 0.85, diagnostic = 0.40, informational = 0.15. On the account-to-account path the normalising detector count is 8. Because the denominator uses the higher-severity weight, the maximum any one detector can contribute before normalisation is its own weight, and a fully-saturated transaction (every detector firing higher-severity at full confidence) reaches 1.000.

Worked reproduction: the Romance Scam send (0.142)

Fact The highest-scoring send (01000862965) reproduces exactly from the formula:

Interpreting a value

Inference The following bands are an interpretation aid for this report: a reader's guide to magnitude, not engine thresholds (the engine consumes the raw score, not these bands).

The portfolio, ranked by evidence

Fact The distinct evidence stacks observed in this run, lowest to highest: