This rule identifies potential card theft situations where successful transactions are followed by failed PIN authentication attempts.

System alerts when:
1. Card successfully completes transaction
2. Same card then has multiple failed PIN entry attempts
3. Pattern suggests different users attempting to use same card

This sequence indicates:
- Card stolen after legitimate use (owner unaware yet)
- Lost card found and fraud attempted
- Skimmed card being tested by fraudster without correct PIN
- Family fraud (authorized user followed by unauthorized family member)
- Card details sold but PIN not included in stolen data

Failed PIN attempts after success are suspicious because:
- Legitimate cardholder knows their PIN
- Sudden PIN failures suggest different person using card
- Common pattern in physical card theft
- Indicates active fraud in progress

Alert enables rapid response:
- Immediate cardholder contact
- Proactive card blocking before additional fraud
- Law enforcement notification if theft confirmed
- Investigation of location pattern between successful and failed transactions

Time-sensitive intervention can prevent fraud loss and assist in criminal apprehension.