referral-abuse-detection-v2

### Step 1: Investigate Account Details Call the `investigate_account` tool using the `account_id` parameter to retrieve account investigation data. Review the user's account, promotional websites, address validity, email authenticity, business description, account status, and account age. ### Step 2: Analyze Temporal Patterns Call the `analyze_temporal_patterns` tool using the `account_id` parameter to retrieve temporal activity data. Analyze registration timing for coordinated creation, review off-hours activity percentage, detect unusual traffic surges, and cross-reference registration timestamps with connected accounts. ### Step 3: Analyze Traffic and Relations Call the `analyze_traffic_patterns` tool using the `account_id` parameter to retrieve traffic and transaction data. Review key metrics (revenue patterns, click-through rates, page views, device distribution), conduct URL analysis, and perform relationship analysis (connected accounts, shared payment methods). ### Step 4: Retrieve Violation History Call the `get_violation_history` tool using the `account_id` parameter to retrieve detailed violation history. Review the previous violations count, last violation date, warning status, and rehabilitation status. ### Step 5: Determine Financial Impact Call the `get_financial_impact` tool using the `account_id` parameter to retrieve financial metrics. Assess the total lifetime revenue, refund rate percentage, and customer complaint count. ### Step 6: Document Investigation Findings [OPTIONAL] Gather evidence such as screenshots, screen recordings, URLs, and any other relevant information to support the findings. Make a ticket if the total earnings on the account meet thresholds or if the enforcement action may attract Legal, PR, or Brand Safety concerns. ### Step 7: Calculate Violation Indicators and Determine Violation Type Calculate scores based on the gathered data by counting TRUE indicators (ensure boolean values are compared as true/false): 1. Abusive Account Creation Score: - address_validity is false (+1) - email_pattern_suspicious is true (+1) - website_verified is false (+1) - connected_accounts >= 15 (+1) - login_geographic_consistency is false (+1) - registration_burst_detected is true (+2) - account_age_days < 30 (+1) (Score >= 4 → Abusive Account Creation) 2. Misleading Ad Copy Score: - website_verified is false (+1) - referral_source_quality is "Low" or "Medium" (+1) - order_patterns_suspicious is true (+1) - click_through_rate > 0.4 (+1) - activity_spike_detected is true (+1) - customer_complaint_count > 5 (+1) (Score >= 4 → Misleading Ad Copy) 3. Personal Orders Score: - payment_method_shared is true (+1) - connected_accounts > 0 AND connected_accounts < 15 (+1) - order_patterns_suspicious is true (+1) - referral_source_quality is "High" (+1) - off_hours_activity_percentage < 30 (+1) (Score >= 3 → Personal Orders (Related)) 4. Temporal Fraud Score: - registration_burst_detected is true (+2) - off_hours_activity_percentage > 60 (+1) - activity_spike_detected is true (+1) - account_age_days < 30 AND connected_accounts >= 15 (+2) (Score >= 4 → Temporal Fraud Pattern) 5. No Violation Score: - address_validity is true (+1) - email_pattern_suspicious is false (+1) - website_verified is true (+1) - login_geographic_consistency is true (+1) - payment_method_shared is false (+1) - order_patterns_suspicious is false (+1) - registration_burst_detected is false (+1) - off_hours_activity_percentage < 30 (+1) - customer_complaint_count <= 2 (+1) (Score >= 6 → No Violation) Determine violation type based on HIGHEST score. If tied, use priority: Temporal Fraud > Abusive Account Creation > Misleading Ad Copy > Personal Orders. If no score meets its threshold, the result is INCONCLUSIVE. ### Step 8: Calculate Risk Severity Level Calculate Risk Severity for violations (not applicable for "No Violation" or "Inconclusive"): CRITICAL Risk if ANY of: - revenue_amount > 5000 - previous_violations_count >= 2 - (previous_violations_count >= 1 AND warning_issued is true AND last_violation_date within 90 days) - customer_complaint_count > 10 HIGH Risk if ANY of: - revenue_amount > 1000 AND revenue_amount <= 5000 - previous_violations_count == 1 - connected_accounts >= 25 - refund_rate_percentage > 40 MEDIUM Risk if ANY of: - revenue_amount > 100 AND revenue_amount <= 1000 - account_rehabilitation_status is "Probation" - connected_accounts >= 15 AND connected_accounts < 25 LOW Risk: - All other violation cases not meeting above criteria. ### Step 9: Determine Enforcement Action Call the `determine_enforcement_action` tool using the `account_id` parameter, then apply the following enforcement matrix based on the violation type and risk severity: For Abusive Account Creation or Misleading Ad Copy or Temporal Fraud: - CRITICAL Risk → "Permanent Account Closure" - HIGH Risk → "Account Closure" - MEDIUM Risk → "Temporary Suspension" - LOW Risk → "Warning Issued" For Personal Orders (Related): - CRITICAL Risk → "Account Closure" - HIGH Risk → "Temporary Suspension" - MEDIUM Risk → "Warning Issued" - LOW Risk → "No Action" For No Violation: - Always → "No Action" For INCONCLUSIVE: - If previous_violations_count > 0 → "Manual Review Required" - Otherwise → "Inconclusive" [APPROVAL REQUIRED] ### Step 10: Output Final Decision Output the final enforcement decision using the exact value determined in the previous step. Include the `final_decision` value in the complete_step summary using XML tags. Example: <final_decision>Permanent Account Closure</final_decision>