Connect the signals.
Give risk teams the evidence.
Risk case R-318 shows a burst of declined authorizations. Can you investigate whether other merchants saw the same pattern?
I’ll trace the authorization activity and related merchant signals, then prepare a review packet.
Read the velocity alert
Checked authorization outcomes
Compared tokenized activity
Prepared the risk findings5 tool calls · related activity foundThree merchants show a similar burst of low-value declined authorizations. The pattern warrants a card-testing review, but the records alone do not confirm fraud. I attached the queries and affected accounts. No blocks or rules were changed.
Trusted by teams running mission-critical operations.
Turn scattered signals into an investigation.
Put specialized agents on the pattern checks and evidence collection behind your fraud and risk reviews.
Trace the activity
Follow the transactions behind an alert across time, payment outcomes, and affected accounts.
Find related patterns
Compare approved device, merchant, and transaction attributes to identify links worth reviewing.
Prepare the response
Give analysts the findings, uncertainty, and proposed next steps before account or payment controls change.
From the first alert to the wider pattern.
Investigate beyond the single event
Correlate the alert with recent authorizations, merchant activity, and prior investigations using scoped records.
SardineMarqetaSnowflakeEvidence before enforcement
Prepare recommendations for your analysts. Blocks, limit changes, and monitoring-rule updates require the authority you define.
Unit21
SlackPossible card-testing activity for review
Risk case R-318 · 3 merchant accounts linked by observed activity
Connect risk signals with transaction context.
Work from your existing fraud stack and approved payment records, with a reviewable trail across the investigation. Systems shown are examples; connector availability, API access, and permissions are confirmed during setup.
Where the review begins
Read alerts, merchant signals, and relevant payment events from your permitted monitoring sources.
SardineUnit21
ChainalysisMarqetaWhere patterns become visible
Compare activity with your internal history and return findings to the team’s existing workspace.
StripeSnowflakeSlackHow Runtime works
Start with a known alert type and define the research an agent should perform before your analysts decide.
Create a risk agent
Add the investigation playbook, permitted comparisons, and escalation rules.
Connect the evidence
Scope access to alerts, merchant records, and tokenized transaction data.
Trace the pattern
Investigate the event and related activity, recording queries and source references.
Review the response
Approve any enforcement action or rule change through your existing risk process.
Risk research with bounded authority.
Read about our securityScoped transaction data
Use restricted account views and tokenized identifiers where available. Apply PII and cardholder-data controls.
Human-led enforcement
Separate research permissions from account blocks, payment controls, and rule changes.
Evidence you can revisit
Keep the queried records, observed patterns, recommendations, and approved next steps linked to the run.
Fraud and risk review: common questions
01Can agents investigate possible card-testing attacks?
02Can we use the monitoring rules we already have?
03Can an agent automatically block a merchant?
04How are linked merchants or accounts identified?
05Can reviews run on a schedule?
06What should we measure in a pilot?
Explore more financial operations
See a risk investigation in action.
Watch an agent trace an alert across transaction history and prepare the findings for your risk team.