Deposit-Flight & Fraud Guardian · Brief 01
Suspicious FD breaks · Branch 07
Affluent-uninsured · behaviour → money → book
The one line you configure
Which branches show FD breaks and outbound transfers running out of band, and is it rate-driven flight or theft? Trace it across the three books.
In a nutshell
Branch 07 carries all of it, and it reads as suspicious money movement, not pricing or service. Premature-broken FD jumped to $306.8K vs $31.4K expected, with 5 ticketless breaks where 0 were expected; CASA net flow fell to −$169.9K as outflow hit $476.7K, with $296.0K going to first-time payees and $149.2K over instant rails. Rate-shopping stayed low and complaints stayed at zero, ruling out yield-chase and service attrition. It is one pocket, not the franchise: affluent-uninsured, high-flight-risk deposits.
At a glance
Connected signals — what else moved (across all three books)
Engagement (contact-changes, micro-tests) and CASA (instant-rail) moved with the FD-break — the cross-book corroboration; complaints and rate-shopping stayed flat, the discriminators that name it theft.
FD Premature Broken — actual vs expected band
Behaviour → funds → outflow → destination
Behaviour leads; FD liquidation plus a balance draw fund a $476.7K outflow, and $149.2K of it moved on instant rails. The two destinations look comparable in width but they are not: established payees are only $21.5K above their normal week, while first-time payees are $290.1K above. Nearly all of the abnormal money went to people we have never paid.
Where the extra $311.6K came from — expected $165.1K → actual $476.7K
These bars are the increase over expected, not the totals — same $476.7K as the flow above, split a different way. Of the $311.6K over baseline, first-time payees are $290.1K of it: $296.0K actual against $5.9K expected, a 50× jump. Established payees, the ones we have paid before, added just $21.5K on top of their usual $159.2K. Outflow finished at 2.9× its baseline.
What the connected view adds
Each dataset alone looked ordinary; only stitching engagement + CASA + FD on the same Branch 07 / affluent slice surfaces the break-to-extraction chain on day one — the window a periodic review misses.
So what
Read together, the three books tell one story: behaviour signals lead (contact-changes, micro-tests), the FD book is liquidated ($306.8K broken, ~10× normal), and the cash leaves as a $476.7K outflow — $296.0K to first-time payees, $149.2K on instant rails. Rate-shopping low and complaints at zero rule out price and service. Caught on day one at Branch 07, in the affluent-uninsured, high-flight-risk pocket.
The points that matter
Lead with the amount, not the rate
$306.8K broken vs $31.4K expected, with 5 ticketless breaks where 0 were expected.
$306.8KFD brokenThe money left to strangers, fast
$296.0K to first-time payees (vs ~$6K normal) and $149.2K on instant rails — money being taken out, not a deposit maturing.
$296.0Kfirst-payeeThe flat signals name it theft
Rate-shopping low and complaints at zero rule out yield-chase and service; only the break-rate and fraud tells moved.
0complaintsOne pocket, not the franchise
Concentrated in affluent-uninsured, high-flight-risk deposits at Branch 07; the region only mirrored the branch-led spike.
Branch 07affluent · high-riskRecommendation
Route Branch 07's first-payee and instant-rail destinations to fraud investigations and hold the linked beneficiaries; make the behaviour → money → book chain a standing daily cross-branch watch. DataGenie surfaces and explains — the freeze / return decision stays with your fraud desk.
Questions it already answers
Have these same payees received money from any other branch?
How much more sits in the affluent-uninsured pocket at Branch 07?