-- Add comprehensive descriptions for remaining Cat A rules (27-31, 125-137)

-- Rule ID 27: Suspicious High Value Manual Entry
UPDATE risk_rules SET description = 'This rule detects potentially fraudulent manual card entry transactions where security features like chip/contactless are deliberately bypassed.

System flags when:
1. Transaction is manually keyed (entry mode indicates no card present)
2. Transaction amount is high-value (category-specific thresholds)
3. Merchant has card-present processing capability (not e-commerce)

Manual entry on high-value transactions is suspicious because:
- Bypasses chip security and card verification
- Common in card-not-present fraud using stolen card numbers
- May indicate merchant collusion with fraudsters
- Could be counterfeit card that failed chip authentication
- Higher chargeback risk due to reduced authentication

Transaction placed on HOLD for:
- Verification that manual entry was necessary (damaged card, etc.)
- Merchant contact to confirm transaction legitimacy
- Cardholder authentication
- Review of merchant manual entry patterns' 
WHERE id = 27;

-- Rule ID 28: New Merchant International Card (First 50 Days)
UPDATE risk_rules SET description = 'This rule provides enhanced monitoring for international card usage at newly onboarded merchants during their initial high-risk period.

Triggers when:
1. Merchant account age is less than 50 days from activation
2. International (foreign-issued) card is used
3. Merchant still in probationary monitoring period

New merchants using international cards are monitored because:
- Fraudulent merchant applications often target international transactions
- Cross-border transactions harder to verify and investigate
- New merchants lack established transaction patterns
- May indicate merchant account testing before large fraud attempt
- Higher chargeback risk during establishment phase

The 50-day window reflects:
- Critical risk period for fraudulent merchant identification
- Time needed to establish baseline international transaction patterns
- Standard new merchant probation period
- Early warning system before significant fraud exposure

Generates ALERT for enhanced validation without disrupting legitimate new international business relationships.' 
WHERE id = 28;

-- Rule ID 29: Expired Card Reuse at Same Merchant
UPDATE risk_rules SET description = 'This rule identifies fraudulent reuse of expired card credentials that should no longer be valid for transactions.

System alerts when:
1. Card expiration date has passed
2. Same expired card attempts transaction at previously-used merchant
3. Transaction should have been automatically declined but wasn''t

Expired card reuse indicates several fraud scenarios:
- Merchant storing card data improperly (PCI DSS violation)
- Fraudster using stolen card data with fake expiration date
- Compromised terminal not validating expiration dates
- Account testing to identify which credentials still work
- Merchant subscription fraud using outdated payment methods

This pattern is concerning because:
- Card should be automatically declined by issuer
- Suggests security control failures in payment flow
- May indicate systematic merchant compliance issues
- Could be part of larger fraud ring operation

Alert enables investigation of:
- Merchant card data handling practices
- Terminal security configuration
- Potential PCI DSS violations
- Need for merchant education or enforcement action' 
WHERE id = 29;

-- Rule ID 30: High Amount of Aggregative Refunds
UPDATE risk_rules SET description = 'This rule detects abnormal patterns of accumulated refunds that may indicate merchant fraud schemes or money laundering.

System flags when:
1. Total refund volume accumulates to suspicious levels
2. Analyzed over rolling time period
3. Significantly exceeds normal business refund patterns

High aggregate refunds can indicate:
- Return fraud schemes (processing fake returns for cash)
- Money laundering (using refunds to layer illicit funds)
- Merchant collusion (issuing fraudulent refunds to associates)
- Business failure (excessive legitimate returns indicating product/service issues)
- Account takeover (fraudster issuing refunds to drain merchant account)

The aggregative approach is critical because:
- Individual small refunds may appear normal
- Pattern only visible when viewing total volume
- Indicates systematic rather than isolated issues
- May represent ongoing criminal enterprise

Generates ALERT to enable:
- Merchant contact and business validation
- Review of refund supporting documentation
- Pattern analysis for fraud ring indicators
- Potential merchant account suspension if fraud confirmed' 
WHERE id = 30;

-- Rule ID 31: High Value Single Refund Alert
UPDATE risk_rules SET description = 'This rule monitors individual high-value refund transactions that represent significant financial risk if fraudulent.

Alerts when:
1. Single refund transaction exceeds high-value threshold
2. Refund amount is substantial regardless of merchant size
3. Transaction represents elevated fraud/loss exposure

Large individual refunds warrant scrutiny because:
- Significant financial impact if fraudulent
- Uncommon even for legitimate high-volume merchants
- May indicate merchant account compromise
- Could be authorized by unauthorized employee
- Potential money laundering red flag
- High risk of merchant dispute/chargeback

Alert-based approach allows:
- Real-time fraud analyst review
- Merchant contact to verify refund authorization
- Documentation review (return receipt, cancellation proof)
- Validation against original purchase transaction
- Pattern analysis for systematic fraud

Alerts without automatic HOLD to enable legitimate business operations while maintaining oversight on high-risk refund activity.' 
WHERE id = 31;

-- Rule ID 125: Round Figure Transaction on same Terminal
UPDATE risk_rules SET description = 'This rule identifies suspicious patterns of round-amount transactions at individual terminals that deviate from normal customer behavior.

System flags when:
1. Multiple transactions at same terminal use exact round amounts
2. Amounts like 1000, 5000, 10000 AED (perfectly divisible)
3. Pattern concentration at single terminal location

Round amount patterns are suspicious because:
- Real customers rarely purchase in perfectly round amounts
- Common in money laundering (moving specific amounts)
- Used in card testing (fraudsters test with round numbers)
- May indicate merchant self-dealing or fraud
- Pattern of internal theft (employees processing fake transactions)

Terminal concentration is significant because:
- Indicates localized fraud activity
- Suggests specific terminal/location compromise
- May involve merchant employee collusion
- Easier to investigate and remediate single terminal

Alert enables:
- Terminal security inspection
- Employee activity review at location
- Transaction receipt/documentation validation
- Pattern correlation with other fraud indicators' 
WHERE id = 125;

-- Rule ID 126: Transaction followed by Fraud-Suspect declined (Same Card)
UPDATE risk_rules SET description = 'This rule detects cards that successfully process transactions immediately before/after failed fraud checks, indicating possible compromise.

Triggers when:
1. Card completes a successful transaction
2. Same card has recent declined transaction flagged as fraud-suspect
3. Temporal relationship suggests coordinated fraud testing

This pattern indicates:
- Fraudster testing stolen card on legitimate merchant before fraud attempt
- Card compromise discovered mid-usage session
- Progressive fraud (small legitimate transaction, then large fraudulent attempt)
- Account takeover with fraudster mixed in with legitimate use
- Card testing to identify which security checks card passes/fails

Sequence analysis is critical because:
- Isolated incidents may appear normal
- Pattern reveals card in active fraud usage
- Time proximity suggests same fraud session
- Enables early intervention before major fraud loss

Alert allows fraud team to:
- Contact cardholder immediately for compromise verification
- Block card proactively before additional fraud
- Investigate merchant of successful transaction
- Pattern analysis for fraud ring identification' 
WHERE id = 126;

-- Rule ID 127: Transaction followed by Wrong PIN Entry Attempts
UPDATE risk_rules SET description = 'This rule identifies potential card theft situations where successful transactions are followed by failed PIN authentication attempts.

System alerts when:
1. Card successfully completes transaction
2. Same card then has multiple failed PIN entry attempts
3. Pattern suggests different users attempting to use same card

This sequence indicates:
- Card stolen after legitimate use (owner unaware yet)
- Lost card found and fraud attempted
- Skimmed card being tested by fraudster without correct PIN
- Family fraud (authorized user followed by unauthorized family member)
- Card details sold but PIN not included in stolen data

Failed PIN attempts after success are suspicious because:
- Legitimate cardholder knows their PIN
- Sudden PIN failures suggest different person using card
- Common pattern in physical card theft
- Indicates active fraud in progress

Alert enables rapid response:
- Immediate cardholder contact
- Proactive card blocking before additional fraud
- Law enforcement notification if theft confirmed
- Investigation of location pattern between successful and failed transactions

Time-sensitive intervention can prevent fraud loss and assist in criminal apprehension.' 
WHERE id = 127;

-- Rule ID 128: Daily Volume Above Average (4x)
UPDATE risk_rules SET description = 'This rule uses statistical baselines to detect abnormal surges in merchant transaction volumes that may indicate fraud attacks or compromised accounts.

System flags when:
1. Merchant daily transaction volume exceeds 4x rolling average
2. Baseline calculated from historical merchant activity
3. Sudden volume spike deviates from normal business patterns

Volume spikes can indicate multiple fraud scenarios:
- Merchant account compromise (fraudster processing fake transactions)
- Terminal compromise being exploited for bulk fraud
- Organized fraud ring coordinated attack
- Money laundering operation (rapid high-volume processing)
- Merchant collusion with fraud ring

4x threshold is significant because:
- Normal business fluctuations rarely exceed 2-3x average
- Indicates substantial abnormal activity
- Balances fraud detection with legitimate business variations
- Reduces false positives from seasonal/promotional spikes

Alert enables fraud team to:
- Merchant contact for business validation
- Review of transaction legitimacy
- Velocity monitoring for escalation
- Terminal security inspection if needed
- Account suspension if fraud confirmed' 
WHERE id = 128;

-- Rule ID 129: Multiple Transactions with Same Amount
UPDATE risk_rules SET description = 'This rule detects suspicious patterns of identical-amount transactions that are statistically unlikely in legitimate commerce.

Triggers when:
1. Multiple transactions share exact same amount
2. Concentration exceeds normal business expectations
3. Pattern suggests systematic rather than random occurrence

Identical amounts are suspicious because:
- Real customer purchases naturally vary in amount
- Common in card testing (fraudsters use same test amount)
- Money laundering indicator (moving specific sums)
- Merchant fraud (processing predetermined fake transactions)
- Subscription fraud (unauthorized recurring charges)

Pattern analysis is important because:
- Single matching amount may be coincidence
- Multiple identical amounts indicate systematic activity
- Suggests automated fraud tools or coordinated scheme
- Enables detection of fraud rings using standardized amounts

System evaluates:
- Frequency of amount repetition
- Time distribution of matching amounts
- Merchant type appropriateness (subscriptions vs. retail)
- Geographic distribution of identical amounts

Alert allows investigation of:
- Transaction legitimacy and supporting documentation
- Merchant business model validation
- Customer identity verification for matching amounts
- Pattern correlation with known fraud schemes' 
WHERE id = 129;

-- Rule ID 130: Self Card Transactions by Merchant
UPDATE risk_rules SET description = 'This rule detects merchant self-dealing where business owners process transactions using their own payment cards, which may indicate fraud or money laundering.

System flags when:
1. Cardholder identity matches merchant owner/employee
2. Transaction processed at merchant own business
3. Pattern indicates self-processing rather than legitimate purchase

Self-card transactions are problematic because:
- Merchant fee fraud (earning interchange fees on own purchases)
- Money laundering (creating appearance of legitimate revenue)
- Tax fraud (generating false expenses/deductible purchases)
- Chargeback fraud (self-transaction then dispute for refund)
- Violates processor terms of service and card network rules

Detection requires cross-referencing:
- Merchant owner/employee identity data
- Cardholder name and details
- Address matching between merchant and cardholder
- Transaction pattern analysis

Alert enables compliance team to:
- Merchant account review and education
- Violation documentation for enforcement
- Account termination if systematic fraud
- Reporting to card networks for merchant violations
- Recovery of improperly earned interchange fees

Most processors explicitly prohibit self-card processing to prevent fee fraud and maintain payment system integrity.' 
WHERE id = 130;

-- Rule ID 131: High Value International Same Card
UPDATE risk_rules SET description = 'This rule monitors high-value transactions using the same international card repeatedly, which may indicate card testing before major fraud or money laundering.

Triggers when:
1. Same international card processes multiple high-value transactions
2. Cumulative value or single transaction exceeds thresholds
3. Pattern unusual for international card usage

Repeated high-value international card use is flagged because:
- Stolen international cards often tested at increasing amounts
- Money laundering using same card for multiple large transfers
- Business email compromise payments processed in stages
- Account takeover with fraudster conducting multiple transfers
- Cross-border merchant collusion for fraud schemes

International cards have elevated risk because:
- More difficult to verify cardholder across borders
- Challenging fraud investigation and recovery
- Higher chargeback likelihood
- Jurisdictional complications for enforcement

System analyzes:
- Transaction frequency and timing
- Amount progression (testing pattern)
- Merchant types accessed
- Geographic consistency

Alert enables:
- Issuing bank notification for fraud screening
- Cardholder verification through international channels
- Merchant validation of goods/services delivered
- Pattern analysis for organized fraud indicators' 
WHERE id = 131;

-- Rule ID 132: Out-of-Profile Geographic Shift (Domestic to International)
UPDATE risk_rules SET description = 'This rule detects suspicious geographic behavior changes where cards suddenly shift from domestic to international usage patterns.

System alerts when:
1. Card with established domestic usage pattern
2. Suddenly processes international transactions
3. Geographic shift deviates from historical behavior profile

Domestic-to-international shifts are suspicious because:
- May indicate card theft with international usage
- Could be card data compromise sold to international fraud rings
- Account takeover with fraudulent international purchases
- Unusual for legitimate cardholders to suddenly shift geographic patterns
- Common fraud pattern after data breaches

Profile analysis evaluates:
- Historical transaction geography (past 30-90 days)
- Sudden vs. gradual pattern changes
- Travel indicators (hotel, airline transactions)
- Time zone consistency with international location

Alert approach balances:
- Fraud detection for compromised cards
- Legitimate international travel usage
- Enables cardholder verification without blocking valid transactions
- Pattern monitoring for escalation if fraud confirmed

Fraud team can:
- Contact cardholder to verify international usage
- Confirm travel plans or legitimate international purchases
- Block card if unauthorized usage confirmed
- Investigate geographic shift patterns for systematic fraud' 
WHERE id = 132;

-- Rule ID 133: High Chargeback Rate (>1%)
UPDATE risk_rules SET description = 'This rule monitors merchant chargeback rates as a key fraud and business quality indicator, flagging when dispute levels exceed acceptable thresholds.

System alerts when:
1. Merchant chargeback rate exceeds 1% of total transactions
2. Calculated over rolling measurement period
3. Exceeds card network acceptable thresholds

>1% chargeback rate indicates serious issues:
- Card network violation threshold (many networks set 1% limit)
- May trigger merchant penalties or account termination
- Indicates fraud attacks, poor business practices, or both
- Represents significant financial risk to acquiring bank
- Customer satisfaction and product/service quality concerns

High chargeback causes include:
- Merchant experiencing fraud attack (unauthorized transactions)
- Delivery failures or product quality issues
- Unclear billing descriptors (customers don''t recognize charges)
- Merchant fraud (unauthorized charges, subscription abuse)
- Friendly fraud (customer dispute legitimate charges)

Alert enables risk management to:
- Merchant consultation on chargeback reduction strategies
- Fraud prevention tool implementation
- Business practice review and improvement
- Account monitoring for potential termination
- Card network reporting compliance
- Enhanced transaction screening for affected merchant

Maintained <1% chargeback rate is critical for merchant account health and payment processor relationships.' 
WHERE id = 133;

-- Rule ID 134: High Fraud Rate (>0.5%)
UPDATE risk_rules SET description = 'This rule tracks confirmed fraud as a percentage of total merchant transactions, identifying businesses with elevated fraud exposure.

System flags when:
1. Confirmed fraud transactions exceed 0.5% of total volume
2. Measured over rolling analysis period
3. Fraud rate indicates security or business model issues

>0.5% fraud rate is significant because:
- Industry average is typically 0.1-0.3%
- Indicates merchant vulnerability or fraud targeting
- May signal security control weaknesses
- Could indicate fraudulent merchant business model
- Represents preventable financial losses

High fraud rates can result from:
- Inadequate fraud prevention tools/processes
- High-risk product/service offerings
- Compromised payment systems or terminals
- Merchant collusion with fraud rings
- Ineffective customer verification procedures
- Target of organized fraud operations

Alert enables risk management to:
- Fraud prevention consultation and tool implementation
- Security assessment of merchant systems
- Business model risk evaluation
- Enhanced transaction screening activation
- Merchant education on fraud indicators
- Account review for potential enhanced monitoring or termination

Addressing fraud rate requires:
- Multi-factor authentication implementation
- Enhanced verification procedures
- Fraud detection tool deployment
- Employee training on fraud recognition
- Regular security audits and updates' 
WHERE id = 134;

-- Rule ID 135: Round or Unusual Amount Patterns (Alert)
UPDATE risk_rules SET description = 'This rule uses pattern recognition to identify statistically unusual transaction amount patterns that often indicate fraud or money laundering.

System generates alerts for:
1. Suspiciously round amounts (1000, 5000, 10000, etc.)
2. Repeated unusual amount patterns
3. Statistical deviation from normal merchant amount distribution

Unusual amount patterns can indicate:
- Money laundering (specific amounts being moved)
- Card testing (fraudsters using standard test amounts)
- Merchant fraud (processing predetermined fake transactions)
- Structuring to avoid reporting thresholds
- Automated fraud tools (using programmatic amounts)

Pattern types monitored:
- Excessive round numbers (ending in 00 or 000)
- Repeated identical amounts across transactions
- Sequential amount patterns (100, 200, 300...)
- Just-below-threshold patterns (avoiding detection limits)

Alert-only approach enables:
- Pattern documentation without transaction disruption
- Cumulative analysis over time
- Merchant education on suspicious patterns
- Investigation when patterns confirm fraud indicators

Fraud analysts evaluate:
- Merchant business type (some legitimately have round amounts)
- Transaction context and supporting documentation
- Historical merchant patterns
- Correlation with other fraud indicators

Helpful for identifying subtle fraud schemes that individual transaction monitoring might miss.' 
WHERE id = 135;

-- Rule ID 136: High Decline/Authorization Failure Rate (>20%)
UPDATE risk_rules SET description = 'This rule identifies merchants with abnormally high transaction decline rates that may indicate fraud testing, security issues, or operational problems.

System alerts when:
1. Merchant decline rate exceeds 20% of authorization attempts
2. Measured over rolling time window
3. Significantly above normal authorization failure rates

>20% decline rate indicates potential issues:
- Card testing/validation fraud in progress
- Compromised merchant account being used for fraud
- Payment system configuration problems
- Expired/compromised card credential testing
- Customer fraud targeting (stolen cards being attempted)

High declines can result from:
- Credit card fraud rings testing stolen cards
- Technical issues with payment gateway
- Incorrect merchant category configuration
- Customers using invalid payment methods
- Merchant accepting high-risk transactions

Alert enables operations team to:
- Merchant contact for technical assistance
- Payment system configuration review
- Fraud attack investigation and mitigation
- Customer communication improvement
- Security posture assessment

Investigation focuses on:
- Decline reason codes analysis
- Transaction pattern examination
- Comparison to merchant historical rates
- Industry benchmark comparison
- Fraud vs. technical issue determination

May require:
- Enhanced fraud screening activation
- Technical support intervention
- Merchant education on payment acceptance
- Security review if fraud attack suspected' 
WHERE id = 136;

-- Rule ID 137: Sudden Drop in Daily Transaction Volume
UPDATE risk_rules SET description = 'This rule detects sudden decreases in merchant transaction volume that may indicate business closure, fraud discovery, or operational compromise.

System flags when:
1. Merchant daily transaction volume drops significantly
2. Decrease represents substantial deviation from baseline
3. Sudden change rather than gradual decline

Sudden volume drops can indicate:
- Business closure without notification
- Fraud detection causing customer loss
- Merchant account compromise (owner locked out)
- Regulatory action or payment hold
- Catastrophic business event (fire, natural disaster)
- Merchant switching to competitor processor

Volume drop concerns include:
- Potential insolvency affecting refund/chargeback reserves
- Fraud may have damaged business reputation
- Settlement risk if business is failing
- May precede merchant abandonment
- Could indicate owner is unaware of account status

Alert enables risk management to:
- Proactive merchant contact for status check
- Business viability assessment
- Settlement risk evaluation
- Reserve adjustment if closure imminent
- Orderly account closure if business ceased
- Investigation if compromise suspected

Monitoring volume drops is critical for:
- Preventing merchant abandonment with outstanding liabilities
- Early fraud detection (customer loss after fraud)
- Payment processor risk management
- Reserve adequacy assessment
- Regulatory compliance (business status verification)

Sudden drops require immediate investigation to protect payment processor and customer interests.' 
WHERE id = 137;
