# Runbook: Transaction Investigation

**Service:** WalletWeb Admin Console
**Owner:** Operations Team
**Escalation:** Ops Supervisor → Compliance → Audit Team

---

## Overview
Procedure for investigating customer transaction disputes, suspicious activity, or audit inquiries.

## Prerequisites
- Admin console access with `ops_agent`, `ops_supervisor`, or `compliance_officer` role
- Transaction ID, user ID, or reference number
- Incident/support ticket ID

## Procedure

### 1. Locate Transaction

#### Option A: Search by Transaction ID
- Navigate to `/admin/transactions`
- Enter transfer_id in search box (format: `txn_...`)
- Click search

#### Option B: Search by User
- Navigate to `/admin/users`
- Search for customer by account ID or email
- Click customer record → "View Transactions" tab

#### Option C: Search by Reference
- Navigate to `/admin/transactions`
- Enter customer-provided reference in search box
- Filter by date range if needed

### 2. Review Transaction Details

Transaction details panel shows:
- **Transfer ID**: Unique transaction identifier
- **Status**: `initiated`, `completed`, `failed`, `canceled`
- **Amount & Currency**: Transaction value
- **Type**: `internal`, `p2p`, `external`
- **From/To Account IDs**: Source and destination
- **Reference**: Customer-provided reference text
- **Timestamps**:
  - `initiated_at`: When transaction was created
  - `completed_at`: When transaction was settled
- **Failure Reason**: If status is `failed`

### 3. Trace Transaction Lifecycle

Click "View Audit Trail" to see:
- All domain events emitted for this transfer
- Actor IDs for each action
- Correlation ID for end-to-end trace
- Related ledger entries (if completed)

### 4. Check Related Entities

For Investigation, cross-check:
1. **Ledger Entries** (via correlation_id)
   - Verify double-entry debit/credit pair exists
   - Check balances reconcile
2. **Settlement Batch** (if external transfer)
   - Navigate to `/admin/settlement`
   - Search by transfer_id or date range
   - Verify batch status
3. **AML Alerts** (if fraud suspected)
   - Navigate to `/admin/compliance/aml`
   - Search by user_id or transaction amount/pattern
   - Check for matching alerts

### 5. Document Findings

Update support/incident ticket with:
- Transaction ID and status
- Root cause (if failure)
- Remediation action taken (if any)
- Escalation (if needed)

### 6. Resolution Actions

Based on findings:

#### Transaction Failed (Legitimate)
- Explain failure reason to customer
- Advise retry or alternative action
- No admin action needed

#### Transaction Stuck (Initiated but not Completed)
- **Escalate to Platform Team** for manual reconciliation
- Do NOT attempt manual status override
- Document correlation_id in escalation ticket

#### Suspected Fraud
- **Escalate to Compliance immediately**
- Do NOT notify customer yet
- Follow [Fraud Investigation Runbook](./fraud-investigation.md)

#### Customer Dispute (Transaction Completed, Customer Claims Error)
- Verify transaction details match customer report
- Check recipient account details
- If error confirmed:
  - Escalate to Ops Supervisor for reversal authorization
  - Reversal requires manual journal entry (SRE task)

---

## Troubleshooting

### Cannot Find Transaction
- **Check**: Verify transaction ID format (should start with `txn_`)
- **Check**: Try searching by user ID instead
- **Check**: Expand date range filter (default: last 30 days)

### Audit Trail Empty
- **Possible Cause**: Transaction predates observability rollout
- **Action**: Check legacy logs via SIEM (Splunk/ELK)

### Settlement Batch Not Found
- **Check**: External transfers only; internal P2P do not use settlement batches
- **Check**: Settlement runs daily at 00:00 UTC; recent transactions may be in pending batch

---

## Audit and Compliance
- All transaction lookups by ops/compliance roles are logged
- Excessive lookups trigger automated review (threshold: >50/day per admin)
- Monthly access audit by Security team

---

## Related Runbooks
- [User Account Block and Unblock](./user-block-unblock.md)
- [Service Health Check](./service-health-check.md)
- Fraud Investigation (Compliance runbook - restricted access)