Counterfactual replay

Replay with changed facts

Open audit trail

Suspicious scenario

Original investigation

RecipientNew recipient

ContactUnknown caller initiated

InstructionSafe-account instruction

OutcomePAUSE_AND_ESCALATE

Risk100/100

Investigation demo-case

Authenticated customer

Customer is correctly signed in

Everyday Checking •••• 2841

$12,240 available

$4,800 same-day transfer

Purpose: Account protection

Secure Holdings LLC

Added 8 minutes ago

New recipient

+18 risk

Added 8 minutes ago

Amount 4.3x normal

+14 risk

$4,800 exceeds fictional normal transfer size

No independent verification

No known relationship outside caller instruction

Unknown caller initiated contact

Someone contacted customer first

+12 risk

React Flow

Legitimate scenario

Changed explanation

RecipientPaid monthly for 18 months

ContactCustomer initiated independently

InstructionNo safe-account instruction

OutcomeRELEASE

Risk0/100

Investigation demo-case

Authenticated customer

Customer is correctly signed in

Everyday Checking •••• 2841

$12,240 available

$4,800 same-day transfer

Purpose: Account protection

Secure Holdings LLC

Added 8 minutes ago

Amount 4.3x normal

+14 risk

$4,800 exceeds fictional normal transfer size

Paid monthly for 18 months

-30 risk

Established recurring recipient

Customer initiated payment

Customer initiated independently

-15 risk

Skeptic Agent challenge

Independent facts support a legitimate explanation, lowering the risk score.

React Flow

Changed facts

Recipient relationship: paid monthly for 18 months

External contact: customer initiated independently

Agents reran

Relationship Investigator

Manipulation Investigator

Pattern Matcher

Skeptic Agent

Safety Gate

Audit Agent

Unchanged findings

Transfer amount remains $4,800

Same-day speed remains unchanged