This rule identifies transactions that are significantly higher than a merchant's normal ticket Average, indicating potential fraud or account takeover.

The system analyzes:
1. The merchant's rolling 30-day average transaction amount
2. Current transaction compared against this baseline
3. Specific focus on high-risk MCC codes:
   - 4812: Telecommunications
   - 5732: Electronics Stores
   - 5733: Music Stores
   - 5541: Service Stations

When a transaction is 4x or more above the merchant's historical average for these categories, it triggers a HOLD. This catches fraudsters who gain access to merchant accounts and process unusually large fraudulent transactions that fall outside normal business patterns.