This rule detects cards that successfully process transactions immediately before/after failed fraud checks, indicating possible compromise.

Triggers when:
1. Card completes a successful transaction
2. Same card has recent declined transaction flagged as fraud-suspect
3. Temporal relationship suggests coordinated fraud testing

This pattern indicates:
- Fraudster testing stolen card on legitimate merchant before fraud attempt
- Card compromise discovered mid-usage session
- Progressive fraud (small legitimate transaction, then large fraudulent attempt)
- Account takeover with fraudster mixed in with legitimate use
- Card testing to identify which security checks card passes/fails

Sequence analysis is critical because:
- Isolated incidents may appear normal
- Pattern reveals card in active fraud usage
- Time proximity suggests same fraud session
- Enables early intervention before major fraud loss

Alert allows fraud team to:
- Contact cardholder immediately for compromise verification
- Block card proactively before additional fraud
- Investigate merchant of successful transaction
- Pattern analysis for fraud ring identification