This rule detects suspicious geographic behavior changes where cards suddenly shift from domestic to international usage patterns.

System alerts when:
1. Card with established domestic usage pattern
2. Suddenly processes international transactions
3. Geographic shift deviates from historical behavior profile

Domestic-to-international shifts are suspicious because:
- May indicate card theft with international usage
- Could be card data compromise sold to international fraud rings
- Account takeover with fraudulent international purchases
- Unusual for legitimate cardholders to suddenly shift geographic patterns
- Common fraud pattern after data breaches

Profile analysis evaluates:
- Historical transaction geography (past 30-90 days)
- Sudden vs. gradual pattern changes
- Travel indicators (hotel, airline transactions)
- Time zone consistency with international location

Alert approach balances:
- Fraud detection for compromised cards
- Legitimate international travel usage
- Enables cardholder verification without blocking valid transactions
- Pattern monitoring for escalation if fraud confirmed

Fraud team can:
- Contact cardholder to verify international usage
- Confirm travel plans or legitimate international purchases
- Block card if unauthorized usage confirmed
- Investigate geographic shift patterns for systematic fraud