Function 5 · financial crime
Do the monitoring rules find the planted typologies, and which alert should an investigator open first?
Four rules at the reporting threshold's boundary fired 649 alerts over three years, 7.9 per hundred thousand ledger entries, and found 362 of the 422 complete planted episodes. Structuring carries the workload: cash intensive businesses make 376 of its alerts and only 41.5% are real. The triage model orders the queue, and in the last two months every real alert sits above every lookalike. Nothing here is a suspicious activity finding, and no report is filed anywhere.
The investigator's view: alerted communities in the transfer network
The 43,318 accounts that pay other customers fall into 9,263 separate groups, mostly small circles of friends and family, and Louvain finds no finer structure inside any of them, so each group is one community. 12 of the 15 planted rings sit whole inside one community, and the round tripping rule fired on members of 10 of them, every ring with a trip that posted in full. Mule accounts show as stars: many outside senders, one wire out.
- Alerted account (outlined)
- Planted ring member the round tripping rule found
- Outside party
- Colour: the three most suspicious communities; grey, every other
Source: generated, Harborline deposit accounts and their entries, September 2023 to August 2026, seed 20260831, as of 2026-08-31.
What each rule finds, against the planted truth
| Rule | Alerts | Precision | Complete episodes | Found | Recall | Posted in part | Alerts per 100k entries |
|---|---|---|---|---|---|---|---|
| Structuring | 376 | 41.5% | 204 | 156 | 76.5% | 0 | 4.57 |
| Rapid movement | 100 | 100.0% | 100 | 100 | 100.0% | 0 | 1.22 |
| Round tripping | 90 | 100.0% | 24 | 24 | 100.0% | 19 | 1.09 |
| Mule fan in | 83 | 100.0% | 94 | 82 | 87.2% | 0 | 1.01 |
Source: generated, Harborline deposit accounts and their entries, September 2023 to August 2026, seed 20260831, as of 2026-08-31.
Alerts by month and rule
Alerts
Source: generated, Harborline deposit accounts and their entries, September 2023 to August 2026, seed 20260831, as of 2026-08-31.
The case queue, 2026-06-28 to 2026-08-27
30 alerts in the order the triage model sets. The last column is the generator's truth, which an investigator would never see; it is here so you can check the order.
| # | Rule | Account | Closed | Amount | Triage | What fired | Truth |
|---|---|---|---|---|---|---|---|
| 1 | Structuring | A0071621 | 2026-07-10 | $53,716 | 1.000 | 6 cash deposits between $8,000 and $10,000 within 10 days, $53,716 in all | ▲ planted |
| 2 | Structuring | A0048481 | 2026-07-22 | $53,882 | 1.000 | 6 cash deposits between $8,000 and $10,000 within 10 days, $53,882 in all | ▲ planted |
| 3 | Rapid movement | A0035247 | 2026-07-12 | $118,035 | 1.000 | $118,035 arrived by wire and $108,389 left within 24 hours | ▲ planted |
| 4 | Structuring | A0054663 | 2026-07-22 | $35,563 | 0.999 | 4 cash deposits between $8,000 and $10,000 within 10 days, $35,563 in all | ▲ planted |
| 5 | Structuring | A0012218 | 2026-07-12 | $35,704 | 0.999 | 4 cash deposits between $8,000 and $10,000 within 10 days, $35,704 in all | ▲ planted |
| 6 | Structuring | A0052575 | 2026-07-28 | $35,319 | 0.999 | 4 cash deposits between $8,000 and $10,000 within 10 days, $35,319 in all | ▲ planted |
| 7 | Structuring | A0018320 | 2026-07-21 | $54,685 | 0.999 | 6 cash deposits between $8,000 and $10,000 within 10 days, $54,685 in all | ▲ planted |
| 8 | Rapid movement | A0044409 | 2026-07-23 | $68,806 | 0.999 | $68,806 arrived by wire and $62,597 left within 24 hours | ▲ planted |
| 9 | Structuring | A0052563 | 2026-07-15 | $54,310 | 0.999 | 6 cash deposits between $8,000 and $10,000 within 10 days, $54,310 in all | ▲ planted |
| 10 | Mule fan in | A0030998 | 2026-07-22 | $24,199 | 0.999 | Payments in from 16 unrelated senders within 14 days, then $21,817 out in one transfer | ▲ planted |
| 11 | Structuring | A0020758 | 2026-07-03 | $26,989 | 0.998 | 3 cash deposits between $8,000 and $10,000 within 10 days, $26,989 in all | ▲ planted |
| 12 | Structuring | A0030112 | 2026-07-20 | $27,603 | 0.997 | 3 cash deposits between $8,000 and $10,000 within 10 days, $27,603 in all | ▲ planted |
| 13 | Mule fan in | A0032472 | 2026-08-05 | $14,803 | 0.995 | Payments in from 12 unrelated senders within 14 days, then $21,663 out in one transfer | ▲ planted |
| 14 | Structuring | A0024074 | 2026-07-26 | $26,825 | 0.992 | 3 cash deposits between $8,000 and $10,000 within 10 days, $26,825 in all | ▲ planted |
| 15 | Structuring | A0015325 | 2026-07-01 | $25,939 | 0.989 | 3 cash deposits between $8,000 and $10,000 within 10 days, $25,939 in all | ▲ planted |
| 16 | Structuring | A0026272 | 2026-08-27 | $26,804 | 0.156 | 3 cash deposits between $8,000 and $10,000 within 10 days, $26,804 in all | lookalike |
| 17 | Structuring | A0001320 | 2026-08-05 | $27,808 | 0.089 | 3 cash deposits between $8,000 and $10,000 within 10 days, $27,808 in all | lookalike |
| 18 | Structuring | A0003662 | 2026-07-03 | $25,705 | 0.033 | 3 cash deposits between $8,000 and $10,000 within 10 days, $25,705 in all | lookalike |
| 19 | Structuring | A0077648 | 2026-08-23 | $34,913 | 0.032 | 4 cash deposits between $8,000 and $10,000 within 10 days, $34,913 in all | lookalike |
| 20 | Structuring | A0044316 | 2026-07-21 | $25,782 | 0.032 | 3 cash deposits between $8,000 and $10,000 within 10 days, $25,782 in all | lookalike |
| 21 | Structuring | A0046649 | 2026-08-11 | $26,298 | 0.018 | 3 cash deposits between $8,000 and $10,000 within 10 days, $26,298 in all | lookalike |
| 22 | Structuring | A0005480 | 2026-07-06 | $25,884 | 0.017 | 3 cash deposits between $8,000 and $10,000 within 10 days, $25,884 in all | lookalike |
| 23 | Structuring | A0052548 | 2026-07-04 | $26,824 | 0.010 | 3 cash deposits between $8,000 and $10,000 within 10 days, $26,824 in all | lookalike |
| 24 | Structuring | A0076082 | 2026-08-05 | $25,558 | 0.008 | 3 cash deposits between $8,000 and $10,000 within 10 days, $25,558 in all | lookalike |
| 25 | Structuring | A0039228 | 2026-06-28 | $25,874 | 0.007 | 3 cash deposits between $8,000 and $10,000 within 10 days, $25,874 in all | lookalike |
| 26 | Structuring | A0078052 | 2026-07-19 | $25,403 | 0.004 | 3 cash deposits between $8,000 and $10,000 within 10 days, $25,403 in all | lookalike |
| 27 | Structuring | A0072800 | 2026-08-25 | $25,803 | 0.002 | 3 cash deposits between $8,000 and $10,000 within 10 days, $25,803 in all | lookalike |
| 28 | Structuring | A0039228 | 2026-08-09 | $26,523 | 0.002 | 3 cash deposits between $8,000 and $10,000 within 10 days, $26,523 in all | lookalike |
| 29 | Structuring | A0078065 | 2026-08-26 | $25,290 | 0.001 | 3 cash deposits between $8,000 and $10,000 within 10 days, $25,290 in all | lookalike |
| 30 | Structuring | A0024601 | 2026-07-21 | $25,795 | 0.000 | 3 cash deposits between $8,000 and $10,000 within 10 days, $25,795 in all | lookalike |
The communities with planted accounts
| Community | Accounts | Alerts | Share alerted | Planted accounts | Rules fired | Money inside |
|---|---|---|---|---|---|---|
| 0 | 25 | 15 | 20.0% | 5 | round_tripping | $730,800 |
| 11 | 14 | 12 | 28.6% | 4 | round_tripping | $493,756 |
| 10 | 15 | 4 | 26.7% | 4 | round_tripping | $269,814 |
| 3 | 20 | 8 | 20.0% | 4 | round_tripping | $431,068 |
| 2 | 22 | 8 | 18.2% | 4 | round_tripping | $272,630 |
| 1 | 23 | 16 | 17.4% | 4 | round_tripping | $613,443 |
| 13 | 11 | 9 | 27.3% | 3 | round_tripping | $300,847 |
| 9 | 17 | 6 | 17.6% | 3 | round_tripping | $257,653 |
Source: generated, Harborline deposit accounts and their entries, September 2023 to August 2026, seed 20260831, as of 2026-08-31.
Method and limitations
- The typologies and their lookalikes are generated, and the rules are graded against the generator's truth. A real program learns from investigator dispositions, which are noisier and arrive weeks later.
- Three of the four rules fired no false alerts here. The generator's lookalikes for rapid movement and mule fan in do not look enough like the real thing, which a real program's rules would not be so lucky with.
- Recall counts only episodes whose every entry posted; 19 round trips posted with a hop missing and are counted beside it.
- Cases on this page are a ranked list. The API opens, updates and audits cases for the fraud desk's alerts; monitoring alerts are not wired into it.