Flags transactions occurring between 12:00 AM and 7:00 AM, excluding 24-hour businesses (hospitals, hotels, fuel stations, restaurants). Late-night activity outside expected business types often indicates unauthorized terminal access or compromised cards.