# Mousecat Fraud Investigator

> Point this skill at a transactions CSV and it runs automated fraud hypothesis checks — velocity bursts, structuring, shared-card rings, impossible travel, and round-number automation — then reports flagged transaction IDs with rationale and recommended next steps.

- Skill: `riteshkew/mousecat-fraud-investigator` (Agent Skill, multi-file: 9 files)
- Install (CLI): `npx skillmds@latest add riteshkew/mousecat-fraud-investigator`
- Raw SKILL.md: https://api.skillmd.com/api/skills/riteshkew/mousecat-fraud-investigator/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Data & Analytics
- Author: riteshkew (https://skillmd.com/u/riteshkew)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/riteshkew/mousecat-fraud-investigator

---


# Workflow

When this skill triggers, follow these steps in order.

## Step 1 — Locate the transactions file

Check whether the user has specified a CSV path.

- If a path is provided, confirm the file exists and contains a header row with at minimum: `txn_id`, `timestamp`, `account_id`, `card_last4`, `merchant`, `amount`, `country`.
- If no path is provided, ask: "Please provide the path to your transactions CSV. It must include columns: txn_id, timestamp, account_id, card_last4, merchant, amount, country. See `resources/transactions.csv` for a working example."
- If the user has a different schema, map their column names to the expected ones before proceeding.

## Step 2 — Enumerate fraud hypotheses

Before running the engine, state the hypotheses that will be tested:

1. **Velocity** — same account, many transactions in a short window.
2. **Structuring** — amounts just below a reporting threshold.
3. **Shared card** — same card_last4 across multiple account_ids.
4. **Impossible travel** — same account in two countries within an impossible time span.
5. **Round-number burst** — repeated identical round amounts from one account rapidly.

## Step 3 — Run the investigation engine

Execute the engine from the skill root:

```bash
node scripts/investigate.mjs <path-to-transactions.csv>
```

The engine outputs a Markdown report with one section per check. Each section includes:
- The hypothesis being tested
- Flagged `txn_id` values
- A one-line rationale
- A table of the flagged rows

Capture stdout. If the process exits non-zero, surface the stderr message and stop.

## Step 4 — Report flagged rows and rationale

For each check that produced flags:

- Name the fraud pattern.
- List the flagged `txn_id` values.
- State the rationale in plain language — what pattern triggered the flag and why it is suspicious.
- Highlight the highest-risk flags first (impossible travel and structuring carry regulatory consequences).

### Output format

```
## [Check Name]

**Flagged:** T001, T002, ...
**Why:** <plain-language explanation of the fraud signal>
**Risk level:** HIGH | MEDIUM | LOW
```

## Step 5 — Recommend next steps

For each category with flags, recommend a concrete action:

- **Velocity** — freeze the account; initiate cardholder verification; check merchant list for card-testing merchants.
- **Structuring** — escalate to compliance; file a Suspicious Activity Report (SAR) if BSA/AML obligations apply.
- **Shared card** — deactivate the card number; notify the card issuer; investigate linked accounts for synthetic identity fraud.
- **Impossible travel** — block the account immediately; contact the cardholder to confirm which transaction was legitimate.
- **Round-number burst** — suspend automated payment capability on the account; audit the payment processor integration logs.

## Example

See `examples/input.md` for the dataset and investigation request, and `examples/output.md` for the full report produced by the engine.

Run the example yourself from the skill root:

```bash
cd skills/mousecat-fraud-investigator
bash examples/run.sh
```