-- Update Risk Rule Descriptions with Detailed Explanations
-- Each rule gets a comprehensive description explaining how it works

-- Rule ID 1: Suspicious International transactions (Cat A)
UPDATE risk_rules SET description = 'This rule monitors all incoming transactions and checks two key conditions:

1. The transaction amount must be greater than or equal to AED 5,000
2. The card used must be classified as an international card

When both conditions are true, the system automatically flags the transaction and places it on HOLD for manual review. This prevents potentially fraudulent high-value cross-border transactions from being processed immediately, giving the fraud team time to verify the transaction''s legitimacy.' 
WHERE id = 1;

-- Rule ID 2: Multiple Int'l card, low value (Cat A)
UPDATE risk_rules SET description = 'This rule identifies potential card testing or credential stuffing attacks by monitoring transaction patterns within a specific time window.

It triggers when ALL of the following conditions are met:
1. Same card is used for multiple transactions
2. Each individual transaction amount is between AED 2,000 and AED 5,000
3. Two or more qualifying transactions occur within 60 minutes
4. The card is classified as an international card

This pattern is commonly associated with fraudsters testing stolen card credentials using small amounts before attempting larger fraudulent purchases. The system places these transactions on HOLD to prevent progressive fraud attempts.' 
WHERE id = 2;

-- Rule ID 3: Abnormal Time transaction (Cat A)
UPDATE risk_rules SET description = 'This rule flags transactions occurring during unusual business hours when legitimate activity is typically lower, making fraudulent transactions easier to hide.

The rule triggers when:
1. A transaction occurs between 12:00 AM (midnight) and 7:00 AM
2. The merchant is NOT in an excluded category (24-hour operations):
   - MCC 8062: Hospitals
   - MCC 7011: Hotels and Lodging
   - MCC 5542: Automated Fuel Dispensers  
   - MCC 5812: Eating Places and Restaurants

Transactions meeting these criteria are placed on HOLD for review, as late-night transactions outside of expected business types often indicate unauthorized terminal access or compromised cards being used when detection risk is lower.' 
WHERE id = 3;

-- Rule ID 4: Split transaction (Cat A)
UPDATE risk_rules SET description = 'This rule detects deliberate transaction splitting designed to evade detection thresholds or regulatory reporting requirements.

The system monitors for:
1. Same card number used at the same terminal and location
2. Multiple transactions occur within a 10-minute window
3. The sum of all qualifying transactions equals or exceeds AED 10,000

This pattern indicates an attempt to break up a large purchase into smaller amounts to avoid automatic holds or reporting triggers. Structuring transactions in this manner is a common fraud and money laundering technique. All matching transactions are placed on HOLD for investigation.' 
WHERE id = 4;

-- Rule ID 5: Duplicate transaction (Cat A)
UPDATE risk_rules SET description = 'This rule identifies suspicious duplicate transactions that may indicate replay attacks, terminal malfunction exploitation, or deliberate double-charging fraud.

Triggers when the system detects:
1. Same card number, terminal ID, and exact transaction amount
2. Multiple identical transactions within 10 minutes
3. Combined total of duplicates reaches or exceeds AED 10,000

While occasional legitimate duplicates can occur from customer confusion or network retries, this pattern—especially with high values—often indicates fraud. The rule places these transactions on HOLD to prevent duplicate charges and verify legitimacy with the cardholder.' 
WHERE id = 5;

-- Rule ID 6: High Velocity transaction (Cat A)
UPDATE risk_rules SET description = 'This rule detects abnormally rapid transaction processing at a single terminal, which is physically impossible for normal customer activity.

The system flags when:
1. A terminal processes transactions with an elapsed time of 2 minutes or less between them
2. Each of these rapid transactions is AED 500 or higher
3. The same terminal shows this pattern repeatedly

This velocity is impossible for legitimate card-present transactions due to physical constraints (card insertion, PIN entry, receipt printing). Such patterns indicate automated fraud tools, compromised terminals running batch transactions, or card skimming operations. Transactions are immediately placed on HOLD.' 
WHERE id = 6;

-- Rule ID 7: Above-average ticket size (Cat A)
UPDATE risk_rules SET description = 'This rule identifies transactions that are significantly higher than a merchant''s normal ticket Average, indicating potential fraud or account takeover.

The system analyzes:
1. The merchant''s rolling 30-day average transaction amount
2. Current transaction compared against this baseline
3. Specific focus on high-risk MCC codes:
   - 4812: Telecommunications
   - 5732: Electronics Stores
   - 5733: Music Stores
   - 5541: Service Stations

When a transaction is 4x or more above the merchant''s historical average for these categories, it triggers a HOLD. This catches fraudsters who gain access to merchant accounts and process unusually large fraudulent transactions that fall outside normal business patterns.' 
WHERE id = 7;

-- Rule ID 8: Dormant Merchant (Cat A)
UPDATE risk_rules SET description = 'This rule detects potentially compromised merchant accounts that have been inactive and suddenly process transactions after extended dormancy.

Triggers when:
1. A merchant has had ZERO transaction activity for 30+ consecutive days
2. Sudden transaction processing resumes after this dormancy period

Inactive merchant accounts are high-value targets for fraudsters because:
- Monitoring is typically reduced
- Sudden activity may not trigger immediate attention
- Account credentials may be outdated/forgotten by legitimate owners

The system places these resurrection transactions on HOLD to verify the merchant account has not been compromised and the business owner authorized the resumption of processing.' 
WHERE id = 8;

-- Rule ID 9: High Value Transaction (Cat A)
UPDATE risk_rules SET description = 'This rule implements threshold-based monitoring for unusually large individual transactions that carry elevated fraud risk due to their significant impact.

Triggers when:
1. A single transaction amount equals or exceeds AED 10,000
2. The currency is AED (United Arab Emirates Dirham)

High-value transactions are placed on HOLD because:
- Greater financial impact if fraud occurs
- Higher likelihood of fraud attempts (fraudsters prefer maximum gain per transaction)
- Regulatory compliance requirements for large transactions
- Increased chargeback risk for the acquiring bank

The HOLD allows fraud analysts to perform enhanced verification including merchant contact, cardholder authentication, and comparison against typical transaction patterns before authorizing release.' 
WHERE id = 9;

-- Rule ID 10: High Frequency Chargeback Merchant (Cat A)
UPDATE risk_rules SET description = 'This rule monitors merchant chargeback patterns to identify businesses with elevated fraud levels or poor business practices.

System flags when:
1. A single merchant receives 2 or more chargebacks within a 30-day period
2. This threshold indicates above-normal dispute frequency

Merchants with high chargeback rates pose multiple risks:
- May be experiencing breach or fraud attack
- Could be engaging in questionable business practices (delivery failures, unauthorized charges)
- Represent financial risk to the acquiring bank (chargeback fees and liability)
- May indicate friendly fraud environment (customers disputing legitimate charges)

New transactions from flagged merchants are placed on HOLD to enable enhanced monitoring and fraud screening before processing.' 
WHERE id = 10;

-- Rule ID 11: Excessive Refunds/Reversals (Cat A)
UPDATE risk_rules SET description = 'This rule identifies abnormal refund patterns that may indicate merchant fraud schemes, money laundering, or processing abuse.

System alerts when:
1. A merchant''s refund/reversal rate exceeds 10% of total transactions
2. Calculated over a rolling 30-day window

Excessive refunds can indicate several fraud scenarios:
- Return fraud: Processing fake returns for cash/credit
- Money laundering: Using refunds to layer and move illicit funds
- Merchant collusion: Issuing fraudulent refunds to confederates
- Processing errors: Terminal misconfiguration or operator error
- Friendly fraud environment: Customers exploiting lenient return policies

This rule generates an ALERT (not automatic hold) to enable fraud analyst review while maintaining transaction flow for further investigation.' 
WHERE id = 11;

-- Rule ID 12: Out-of-Profile Geographic (Cat A)
UPDATE risk_rules SET description = 'This rule uses behavioral analysis to detect card usage in geographically abnormal locations that deviate from established spending patterns.

Analysis performed:
1. System builds a 30-day geographic profile for each card
2. Identifies the cardholder''s typical transaction locations
3. Calculates statistical deviation of current transaction location
4. Flags when location is 3+ standard deviations from normal pattern

Geographic anomalies often indicate:
- Card theft with usage far from owner''s location
- Account compromise with fraudulent online purchases shipped to alternate addresses
- Card number theft with usage in different region/country
- Insider fraud where card data is sold and used remotely

Suspicious geographic transactions are placed on HOLD for cardholder verification before processing.' 
WHERE id = 12;

-- Rule ID 13: Machines of High Value Fallback Transactions (Cat A)
UPDATE risk_rules SET description = 'This rule detects potential compromise of chip-based EMV cards being used with degraded security modes that bypass chip authentication.

System alerts when:
1. Transaction amount exceeds AED 50
2. The entry mode is either:
   - Code 80: Fallback (chip read failed, fell back to magstripe)
   - Code 90: Magstripe (bypassed chip entirely)
3. Card should have chip capability but isn''t using it

This combination is suspicious because:
- High-value fallback transactions are uncommon (most chips work reliably)
- Fraudsters deliberately damage chips to force fallback to less secure magstripe
- Counterfeit cards may fail chip authentication but work via magstripe
- Compromised terminals may force fallback mode to avoid chip security

Generates an ALERT for analyst review while allowing transaction to proceed under enhanced monitoring.' 
WHERE id = 13;

-- Rule ID 14: Decline Transaction Monitoring (Cat A)
UPDATE risk_rules SET description = 'This rule identifies credential testing attacks where fraudsters attempt to validate stolen card numbers through rapid authorization attempts.

Triggers when:
1. More than 10 declined transactions occur at the same merchant
2. All declines occur within a 20-minute window
3. Pattern indicates systematic validation testing

This attack pattern indicates:
- Fraudster has batch of stolen card numbers
- Testing which cards are still active/valid
- Attempting different amounts to find authorization threshold
- Using compromised terminal or merchant account for testing
- Classic carding operation behavior

System generates an ALERT to enable:
- Merchant account verification
- Terminal security check
- Pattern analysis for fraud ring identification
- Potential law enforcement notification for organized fraud activity' 
WHERE id = 14;

-- Rule ID 15: New Onboarded Merchant High Decline (Cat A)
UPDATE risk_rules SET description = 'This rule monitors newly established merchant accounts for abnormal decline patterns that may indicate fraudulent merchant applications or compromised new accounts.

Flags when ALL conditions met:
1. Merchant account age is less than 90 days
2. More than 5 declined transactions occur within 20 minutes
3. Decline rate is increasing (trending upward)

New merchants with high declines indicate potential fraud scenarios:
- Fraudulent merchant application (using stolen/fake business identity)
- Money laundering setup (testing before large illicit transaction volume)
- Friendly merchants providing testing platform for fraud rings
- Inexperienced merchant with poor transaction validation processes
- Compromised new account being exploited before owner notices

Generates an ALERT for enhanced merchant screening and business validation without disrupting legitimate new merchant operations.' 
WHERE id = 15;

-- Rule ID 16: MI - Local Transaction Higher than 500K (Cat A)
UPDATE risk_rules SET description = 'This rule implements specialized monitoring for extraordinarily high-value transactions using locally-issued cards.

Triggers when:
1. Single transaction amount exceeds AED 500,000
2. Card is classified as a domestic/local card (issued within UAE)
3. Amount represents significant financial exposure

Transactions at this level require enhanced validation because:
- Represents major financial risk if fraudulent
- Uncommon even for high-value legitimate business purchases
- Could indicate business email compromise leading to fraudulent payment authorization
- May involve insider fraud or collusion
- Requires executive approval in most legitimate business contexts
- High potential for dispute/chargeback due to buyer remorse or fraud discovery

Transaction placed on HOLD for:
- Multi-level verification
- Merchant contact to confirm legitimacy
- Cardholder authentication
- Executive authorization review' 
WHERE id = 16;

-- Rule ID 17: MI - Regional Transaction Higher than 1500K (Cat A)
UPDATE risk_rules SET description = 'This rule provides tiered monitoring for ultra-high-value transactions using regionally-issued cards (GCC region), with category-specific responses.

System behavior:
1. Flags any transaction exceeding AED 1,500,000
2. Card must be regional issue (Gulf Cooperation Council countries)
3. Cat A merchants: Generate ALERT only (monitoring without hold)
4. Cat B/C/D merchants: Automatic HOLD for review

Rationale for tiered response:
- Cat A (Enterprise): Established businesses with verified high-value transaction patterns
- Cat B/C/D: Additional verification needed due to unusual transaction size for merchant tier
- Regional cards have moderate fraud risk (lower than international, higher than local)
- Amount requires enhanced validation but relationship tier matters

HOLD enables comprehensive verification including corporate authorization confirmation and business validation before releasing funds.' 
WHERE id = 17;

-- Rule ID 18: MI - Local Transaction Higher than 400K (Cat A)
UPDATE risk_rules SET description = 'This rule monitors substantial high-value local card transactions with category-based exemptions for established enterprise merchants.

Triggers when:
1. Transaction exceeds AED 400,000
2. Card is locally-issued (UAE)
3. Merchant is NOT categorized as Cat A (Enterprise excluded from this rule)

The category exclusion is significant:
- Cat A merchants have proven track records with high-value legitimate transactions
- Cat B/C/D merchants rarely process transactions at this level legitimately
- Sudden high-value on lower-tier merchant indicates potential:
  * Account compromise
  * Business email compromise fraud
  * Unauthorized employee transactions
  * Money laundering attempt

Transaction placed on HOLD for thorough verification:
- Merchant contact for authorization confirmation
- Review of merchant transaction history
- Validation that amount aligns with business type
- Cardholder verification if necessary' 
WHERE id = 18;

-- Rule ID 19: MI - International Transaction Higher than 100K (Cat A)
UPDATE risk_rules SET description = 'This rule implements stringent monitoring for high-value cross-border transactions that carry elevated fraud risk.

System flags when:
1. Single transaction exceeds AED 100,000
2. Card is international (issued outside UAE)
3. Cross-border nature increases complexity and fraud risk

International high-value transactions require enhanced scrutiny because:
- Greater difficulty verifying cardholder identity across borders
- Increased chargeback risk due to jurisdictional complexities
- Common target for business email compromise fraud
- Challenging to recover funds if fraud detected after processing
- May involve currency conversion exploitation
- Higher likelihood of shipping fraud or goods never delivery disputes

Transaction placed on HOLD requiring:
- Cardholder contact via issuing bank
- Merchant verification of goods/services legitimacy
- Cross-border compliance verification
- Enhanced fraud screening before authorization' 
WHERE id = 19;

-- Rule ID 20: MI - International Transaction Higher than 25K (Cat A)
UPDATE risk_rules SET description = 'This rule provides monitoring alerting layer for elevated international transactions that warrant analyst attention without automatic holds.

Generates ALERT when:
1. Transaction amount exceeds AED 25,000
2. Card is international (foreign-issued)
3. Value is substantial but below critical HOLD threshold

Alert-only approach appropriate because:
- Amount is significant but not catastrophic if fraud occurs
- Many legitimate international business transactions fall in this range
- Auto-holding risks disrupting valid cross-border commerce
- Analyst can monitor in real-time and escalate if needed
- Enables pattern detection without transaction friction

Fraud analyst reviews for:
- Merchant type appropriateness for amount
- Card usage patterns and geographic consistency
- Known fraud indicators or blacklist matches
- Can escalate to HOLD if investigation raises red flags' 
WHERE id = 20;

-- Rule ID 21: MV - 10 Cards Same BIN (Cat A)
UPDATE risk_rules SET description = 'This rule detects organized card fraud attacks where multiple cards from the same issuing bank are used in concentrated patterns.

System alerts when:
1. 10 or more different card numbers used at same merchant
2. All cards share the same BIN (Bank Identification Number - first 6 digits)
3. All transactions occur within a 30-minute window

This pattern indicates several possible fraud scenarios:
- Batch of stolen cards from same issuing bank being monetized
- Data breach targeting specific card issuer
- Skimming operation harvesting cards from single bank''s customers
- Compromised merchant testing multiple cards before detection
- Organized fraud ring with cards from same source

Generates ALERT to enable:
- Issuing bank notification of potential batch compromise
- Merchant account security review
- Pattern analysis for broader fraud ring activity
- Terminal compromise investigation' 
WHERE id = 21;

-- Rule ID 22: MH - 20 Cards Same BIN (Cat A)
UPDATE risk_rules SET description = 'This rule detects high-volume coordinated card fraud attacks using large batches of cards from the same issuing institution.

Triggers when:
1. 20 or more unique card numbers used at single merchant
2. All cards have identical BIN (first 6 digits)
3. Concentrated within 30-minute time window

This elevated threshold indicates major fraud activity:
- Large-scale data breach monetization
- Professional fraud ring operation with significant card inventory
- Compromised POS system being used for rapid bulk processing
- Money laundering operation using multiple accounts
- Merchant collusion with organized crime

Volume of 20+ cards suggests:
- Immediate law enforcement notification warranted
- Critical issuing bank alert needed
- Merchant account suspension consideration
- Pattern likely indicates ongoing criminal enterprise

System generates high-priority ALERT requiring immediate fraud team intervention and potential emergency merchant/terminal lockdown.' 
WHERE id = 22;

-- Rule ID 23: MI - Daily Amount Limit Per Card (Cat A)
UPDATE risk_rules SET description = 'This rule enforces daily velocity limits on individual card usage to prevent large-scale fraud when cards are compromised.

System alerts when card accumulates:
EITHER:
1. Total daily transaction volume of AED 100,000 or more
OR:
2. Alternative threshold of AED 200,000 (category-specific)

Daily limits are critical controls because:
- Compromised cards can process multiple transactions before owner notices
- Fraudsters often "max out" stolen cards within 24 hours
- Early detection limits total fraud exposure
- Prevents total account drainage before cardholder intervention
- Reduces chargeback liability for acquiring bank

Alert generated (not auto-HOLD) to enable:
- Real-time fraud analyst review
- Cardholder contact if pattern suspicious
- Velocity monitoring to catch fraud early
- Can escalate to card blocking if confirmed fraudulent
- Balances fraud prevention with legitimate high-volume customer needs' 
WHERE id = 23;

-- Rule ID 24: High Value Transaction on New Merchant (First 90 Days) (Cat A)
UPDATE risk_rules SET description = 'This rule monitors newly onboarded merchants for suspicious high-value transactions during the critical early establishment period.

Generates alert when:
1. Merchant account age is less than 90 days from account opening
2. Transaction amount exceeds AED 25,000
3. Merchant still in probationary/monitoring period

New merchant high-value transactions are flagged because:
- Insufficient transaction history to establish normal patterns
- Fraudulent merchant applications often process large transactions quickly before detection
- Money laundering operations may use new merchant fronts for rapid fund movement
- Business email compromise may target newly onboarded businesses
- Limited relationship history to validate legitimacy

The 90-day window is critical because:
- Establishes baseline merchant behavior patterns
- Allows time to verify business legitimacy
- Enables fraud detection before significant exposure
- Standard risk management probationary period

Alert enables fraud team to conduct enhanced merchant validation without disrupting legitimate new business growth.' 
WHERE id = 24;

-- Rule ID 25: High Value Transaction on New Merchant (Cat A)
UPDATE risk_rules SET description = 'This rule provides ongoing monitoring for high-value transactions at merchants with recent category changes or status updates.

Triggers alert when:
1. Merchant has been newly categorized or recategorized within past 90 days
2. High-value transaction processed (category-specific thresholds apply)
3. Insufficient historical data for new category assignment

Category change monitoring is important because:
- Business model changes may indicate account takeover
- Legitimate business sold to new owners (unknown fraud risk)
- Merchant attempting to abuse category change for fraud
- System recategorization may not reflect actual business operations
- Transaction patterns expected to change during category transition period

90-day monitoring window allows:
- Validation that category change reflects actual business
- Detection of fraudulent category manipulation
- Baseline establishment for new business model
- Early warning if category change was fraud precursor

Alert-based approach enables review without disrupting legitimate businesses undergoing normal evolution or expansion.' 
WHERE id = 25;

-- Rule ID 26: MI - Suspicious International Transaction (High-Risk Countries) (Cat A)
UPDATE risk_rules SET description = 'This rule implements geography-based risk monitoring for transactions originating from countries with elevated fraud threat profiles.

System alerts when:
1. Transaction originates from designated high-risk country:
   - Iraq (IQ)
   - Egypt (EG)
   - Libya (LY)
   - Mozambique (MZ)
2. Transaction amount exceeds AED 5,000

These countries flagged due to:
- Elevated historical fraud rates in payment data
- Documented organized fraud operations
- Challenging cross-border law enforcement coordination
- Known sources of card data compromise
- Political/economic instability increasing fraud incentives

Lower threshold (AED 5,000 vs. standard international threshold) reflects:
- Higher baseline fraud risk from these origins
- Greater difficulty in fraud recovery and investigation
- Potential sanctions or compliance complications
- Need for enhanced transaction scrutiny

Generates ALERT for analyst review to balance:
- Legitimate business from these regions (avoiding discrimination)
- Elevated fraud risk requiring additional validation
- Enhanced due diligence for compliance requirements
- Pattern detection for organized fraud operations' 
WHERE id = 26;
