What an investigation is for
An alert is a hypothesis. An investigation tests it, and the discipline is in treating it as a test rather than as a confirmation exercise.
That framing has practical force, because the default drift of any fraud queue is toward confirmation. A case arrives labelled as fraud, the reviewer looks for evidence of fraud, finds something consistent with fraud, and closes it as fraud. The same evidence would frequently be consistent with a legitimate customer having an ordinary week, and nobody looked.
The counter-discipline is to state, at the start of each case, what would disconfirm the hypothesis. If nothing would, the case is not being investigated.
The order of work
A repeatable sequence produces consistent outcomes and survives review.
Read the alert and state the hypothesis explicitly. Which typology is this, and what would have to be true for it to be that?
Establish the account's own baseline before looking at the triggering event. What is normal for this customer? A deposit that is alarming for one account is Tuesday for another, and reviewers who skip this step judge everything against a population average.
Examine the triggering event in context. What preceded it, what followed it, what else changed.
Look for linkage. Shared device, network, instrument, address, contact details, behavioural pattern. Linkage is where weak individual signals become strong.
Check the other domains. Has this customer triggered responsible gambling markers? Is there a financial crime angle? A case that is only examined as fraud will be resolved as fraud.
Seek disconfirming evidence deliberately. What in this account's history is inconsistent with the hypothesis?
Reach a conclusion, with a confidence level. "Probable stolen instrument use, moderate confidence, based on X and Y" is a usable finding. "Fraud" is not.
Decide the action proportionate to the confidence, using the tiers from the previous lesson.
Record all of it.
Evidence, and its limits
Fraud investigation in an operator works almost entirely from internal data, and being clear about what each source proves prevents overreach.
Transaction records are strong and complete. They show what happened, to the cent, with timestamps.
Device and network data is strong for linkage and weak for identity. A shared device means two accounts used the same device. It does not mean one person operates both: households, shared computers, public machines and refurbished handsets all produce genuine sharing.
Behavioural data is good for pattern and poor for intent. It shows what was done, never why.
Identity verification records show what was checked and when, which is frequently the most important thing in the file.
Customer communications are the most underused source. What the customer said, when, and how they responded to a question carries real information, and it sits in a support system most fraud teams do not read.
External data such as bureau checks and consortium data adds independent corroboration where available.
The limit that matters: none of this establishes intent. An operator can establish that money moved in a pattern consistent with fraud. It cannot usually establish that a person intended to defraud it, and conclusions written as though it can are the ones that fall apart under challenge.
Writing the case
Assume every case file will be read by someone who was not there: a colleague, a complaints handler, an ADR body, a regulator, or a court. In Britain that is routine rather than hypothetical: licensees must let a customer refer a dispute not resolved within eight weeks to an accredited ADR entity, and should keep records of complaints and disputes to make available to the Commission on request, and the Commission expects them to answer an ADR entity's requests for information in full within ten working days.
A usable record contains: what triggered the case and when; the hypothesis tested; the evidence examined, including what was looked at and found to be unremarkable; the linkage established and its strength; the conclusion with a confidence level; the action taken and why that action rather than a stronger or weaker one; what the customer was told; and the review or reopening trigger.
Two failure modes recur.
The conclusion without the reasoning. "Account closed for fraud." Nobody can tell what happened, whether it was right, or whether the same decision would be made again.
The evidence without the conclusion. Pages of transaction data and no statement of what it means. Equally unusable, and slightly worse, because it looks thorough.
The test: if this customer complains in six months and the case is read by someone who has never seen the account, does the file explain and justify what was done?
Talking to the customer
Most investigations involve contacting the customer, and how it is done affects both the outcome and the operator's exposure.
Ask, do not accuse. An open question produces information; an accusation produces defence and ends the conversation. The reviewer's job at this stage is to gather evidence, and an accusation forecloses it.
Say what is happening, without saying more than you can support. "Your withdrawal is under review and we need to verify the payment method" is accurate and bounded. "We have identified fraudulent activity" is a conclusion the operator frequently cannot support and will have to retract.
Give a timeframe and keep to it. Delay and silence are what customers complain about: in 2024 the Gambling Commission said withdrawal delays remained the number one subject of complaints it received, at around 2,000 a year, and featured prominently in cases raised with ADR providers.
Be able to explain what is needed and why. A verification request with no explanation reads as obstruction, particularly to a customer waiting on their own money. The Gambling Commission has criticised operators that give no reason for requesting information, or say only that it is "for regulatory purposes", and in Britain, for remote licensees, a withdrawal request must not trigger a demand for information the operator could reasonably have requested earlier, unless another legal obligation requires it at that point.
Know when you cannot explain. Where a case has become a financial crime matter, the reason may be one the customer cannot be told. In Britain, a person working for a casino operator, which is in the anti-money laundering regulated sector, commits the offence of tipping off by disclosing that a suspicious activity disclosure has been made, including one made internally to the nominated officer, or that an investigation is contemplated or under way, where the disclosure is likely to prejudice an investigation. Anyone, in any gambling business, can commit the separate offence of prejudicing an investigation they know or suspect is under way or about to begin. The Commission's advice is that reasonable, tactful enquiries about activity inconsistent with a customer's normal pattern should not amount to that offence, unless they are made in a way that discloses an investigation known or suspected to be under way, which is one more reason to ask rather than accuse. Staff need a prepared, accurate, minimal form of words for that situation, because improvising produces either a disclosure or an obvious evasion.
Outcomes
The full range, and the discipline is in not defaulting to the strongest.
No action. The hypothesis did not survive. This should be a substantial proportion of closures, and a function where it is near zero is not testing hypotheses.
Monitor. Insufficient evidence to act, sufficient to watch. Requires a defined trigger, or it means nothing.
Verify. A step-up check resolving the uncertainty.
Restrict specifically. Block a payout route, remove offer eligibility, cap stakes. Proportionate and reversible.
Restrict broadly. Suspend the account pending resolution.
Close and recover. The strongest commercial response, and it has limits. The Commission, following the CMA, holds that anti-money laundering and fraud obligations may justify delaying a payout but do not give an operator a right to confiscate customer deposits; where money laundering is known or suspected, funds should not be moved or returned until a suspicious activity report has been made and, where needed, a defence sought from the National Crime Agency.
Refer. To financial crime for reporting (in Britain, the nominated officer decides whether to disclose suspicious activity to the National Crime Agency), to responsible gambling for intervention, or to law enforcement where the threshold is met. Referral is an outcome in its own right and is frequently the correct one alongside a commercial action rather than instead of it.
Reversal, and why it must be easy
A proportion of decisions will be wrong. The system's quality is measured partly by how well it handles that.
A defined route to challenge, communicated to the customer at the point of restriction.
Review by someone other than the original decision-maker. Self-review of a decision is not review.
Full restoration when a decision is reversed, including funds, account status and offer eligibility. A customer reinstated but quietly excluded from promotions has not been reinstated.
Feedback into tuning. Every reversal identifies a rule, a threshold or a review practice that produced it. A function that reverses decisions without recording why is repeating the error by design.
An accurate record. Where the original case said fraud and the review said otherwise, the file has to say so plainly, because the earlier characterisation will otherwise follow the customer through every future interaction.
Measuring the function
Case volume and closure rate describe activity. Four measures describe effect.
Precision by alert source, which tells you which rules are worth keeping.
Reversal rate, and the pattern within it.
Prevented loss and realised loss, the pair that shows what the function is delivering.
False positive cost, estimated from reversals, complaints and abandoned customers, because the alternative to estimating it is implicitly valuing it at zero.
The fourth is the one that changes decisions, and it is the one most easily left undone. An operator that has measured it may well find at least one blunt control costing more than the fraud it prevents, which is exactly the finding the first lesson of this course said was available to anyone willing to look.