Mousecat Fraud Investigator

Workflow

When this skill triggers, follow these steps in order.

Step 1 — Locate the transactions file

Check whether the user has specified a CSV path.

• If a path is provided, confirm the file exists and contains a header row with at minimum: txn_id, timestamp, account_id, card_last4, merchant, amount, country.
• If no path is provided, ask: "Please provide the path to your transactions CSV. It must include columns: txn_id, timestamp, account_id, card_last4, merchant, amount, country. See resources/transactions.csv for a working example."
• If the user has a different schema, map their column names to the expected ones before proceeding.

Step 2 — Enumerate fraud hypotheses

Before running the engine, state the hypotheses that will be tested:

1. Velocity — same account, many transactions in a short window.
2. Structuring — amounts just below a reporting threshold.
3. Shared card — same card_last4 across multiple account_ids.
4. Impossible travel — same account in two countries within an impossible time span.
5. Round-number burst — repeated identical round amounts from one account rapidly.

Step 3 — Run the investigation engine

Execute the engine from the skill root:

node scripts/investigate.mjs <path-to-transactions.csv>

The engine outputs a Markdown report with one section per check. Each section includes:

• The hypothesis being tested
• Flagged txn_id values
• A one-line rationale
• A table of the flagged rows

Capture stdout. If the process exits non-zero, surface the stderr message and stop.

Step 4 — Report flagged rows and rationale

For each check that produced flags:

• Name the fraud pattern.
• List the flagged txn_id values.
• State the rationale in plain language — what pattern triggered the flag and why it is suspicious.
• Highlight the highest-risk flags first (impossible travel and structuring carry regulatory consequences).

Output format

## [Check Name]

**Flagged:** T001, T002, ...
**Why:** <plain-language explanation of the fraud signal>
**Risk level:** HIGH | MEDIUM | LOW

Step 5 — Recommend next steps

For each category with flags, recommend a concrete action:

• Velocity — freeze the account; initiate cardholder verification; check merchant list for card-testing merchants.
• Structuring — escalate to compliance; file a Suspicious Activity Report (SAR) if BSA/AML obligations apply.
• Shared card — deactivate the card number; notify the card issuer; investigate linked accounts for synthetic identity fraud.
• Impossible travel — block the account immediately; contact the cardholder to confirm which transaction was legitimate.
• Round-number burst — suspend automated payment capability on the account; audit the payment processor integration logs.

Example

See examples/input.md for the dataset and investigation request, and examples/output.md for the full report produced by the engine.

Run the example yourself from the skill root:

cd skills/mousecat-fraud-investigator
bash examples/run.sh