# Chapter 3 — Cases and Investigations

## Purpose

This chapter explains how investigators review and resolve fraud cases that are created by rules, model outcomes, or workflow actions.

## What the Cases experience is for

The Cases area is where analysts move from an alert or decision into a human review workflow. It is used to:

- review transactions that need manual attention;
- understand why the case was opened;
- inspect the evidence and related activity;
- update the case status and leave an audit trail.

## What each option and section is used for

- Case list: this is the work queue for open investigations. Example: if your team is handling a spike in declines, start here to see all active cases.
- Case detail view: this shows the context of a specific investigation, including the transaction and the reason the case was generated.
- Status field: this controls the current state of the case. Example: move a case to Review if more evidence is needed.
- Notes or comments: use these to document evidence or next steps so other analysts understand the history.
- Related score or rule context: use this to connect the case to the original decision logic.

## Typical investigation flow

1. Open the Cases screen from the Fraud & AML navigation.
2. Select a case to inspect its detail view.
3. Review the transaction information, fired activations, and any available case notes or history.
4. If the interface opens a slide-in or modal, use it to inspect the full context without leaving the list view.
5. Decide whether the case should be approved, reviewed further, or closed.
6. Record the outcome clearly so the next analyst or reviewer can understand the decision.

## What to review in a case

When you open a case, look for:

- the reason the case was created;
- the relevant transaction context;
- any alert, rule, or model signal that triggered the investigation;
- the current status and previous activity.

## Recommended practice

- review the trigger before changing status;
- preserve a clear note for each action taken;
- use the workflow status consistently so the investigation remains auditable;
- connect with the Scores or Rules areas when you need the underlying decision context.

## Screen walkthrough

### 1. Open the Cases page

Navigate to http://demo.ctrmv.com:4010/admin/fraud/cases to reach the case workspace.

### 2. Review a case

Select a case from the list and read the detail view to understand the reason it was created and what evidence is available.

### 3. Resolve the investigation

Once the investigation is complete, update the case status and record the decision so the workflow remains clear for future review.

## Screenshot reference

The relevant screen is:

- Cases: http://demo.ctrmv.com:4010/admin/fraud/cases

## Notes

The case experience is one of the most important parts of the fraud workflow because it connects the decisioning engine with human review.