02Investigations

Financialcrimeintelligence.

Realistic example investigations inspired by my AML, fraud-review, onboarding and branch-banking experience.

⚠ Illustrative case studies · Inspired by Erik’s experience. People, transactions, dates, scores and outcomes are synthetic—not actual customer cases or employer results.
Featured example

Tracing a suspected account takeover

Read case study →
ILLUSTRATIVE-TM-001 · Transaction monitoring

Rapid pass-through activity

A fictional personal account receives funds from three new counterparties, then moves most of the money out within hours. The review weighs the activity against the customer profile without treating an alert as proof of wrongdoing.

Incoming
$6,050
Outgoing
$6,000
Remaining
$50
02 / ILLUSTRATIVE INVESTIGATIONSREVIEW PENDING
Money-flow mapIllustrative score 86/100
$1,900$2,400$1,750$5,600$400Subject accountSender 01Sender 02Sender 03ExchangeATM cash
highmedlow
02 / Timeline
  1. Day 1 · 09:12–09:35
    Three new senders credit $6,050 in total.
  2. Day 1 · 10:00FLAG
    Monitoring flags activity above the declared monthly expectation of $800.
  3. Day 1 · 12:05FLAG
    $5,600 transferred to an exchange; stated purpose is not documented.
  4. Day 1 · 14:30FLAG
    $400 withdrawn at an ATM; $50 of the incoming funds remains.
  5. Day 2 · Review
    Profile, 90-day activity and counterparties reviewed; unresolved gaps documented for escalation.
03 / Evidence

Synthetic profile: student, expected monthly credits of $800. The prior 90 days show routine low-value spending and no transfers involving these counterparties. A change in circumstances remains a possible explanation.

04 / Analyst reasoning
  • 01Compare the alert with the declared profile and observed baseline; the mismatch warrants review, not a finding of criminal conduct.
  • 02Trace and reconcile the $6,050 received and $6,000 sent. Short holding time and new counterparties are indicators consistent with possible pass-through activity.
  • 03Consider legitimate gifts, shared expenses or a change in circumstances. The supplied evidence does not resolve these possibilities.
  • 04Document facts, alternative explanations and information gaps. Escalate under the institution’s procedures; do not make an unsupported accusation.
05 / Proposed disposition

A proposed next step—not a finding of wrongdoing or an actual employer outcome.

03 / Next section
The Impact