d_08eaa178
INTERVENE2026-08-09 06:09:55 UTC · partner demo · threshold profile balanced · source live
Reasoning
The session shows the strongest coordination pattern we track — long idle gaps and tab switching alongside a pasted destination address — indicating someone is walking the user through checkout in real time. Combined with a textbook small-win bait escalation (200 to 1000 to 4800), a brand-new one-off receiving wallet, and funds leaving within six minutes, this fits an investment-scam shape and warrants a probe plus cancellable delay.
Signal vector, as received
| Signal | Value | Contributed |
|---|---|---|
| account_age_days | 3 | — |
| is_first_purchase | true | — |
| amount_eur | 4800 | — |
| amount_vs_median | null | — |
| funding_method | card | — |
| minutes_to_outbound | 6 | yes |
| destination_first_seen_days | 2 | yes |
| destination_type | fresh_eoa | — |
| declined_attempts | 0 | — |
| address_entry_method | pasted | — |
| idle_gaps_over_60s | 4 | yes |
| tab_switches | 3 | yes |
| deposit_escalation | [200, 1000, 4800] | yes |
| kyc_retries | 0 | — |
| merchant_verified | null | — |
Probe transcript
Can you tell me what's going on with this transfer?
“I met someone on a dating app about two months ago. We talked every day, and he told me about this investment platform his uncle runs — it's how he gets early access to good entry prices.”
When it came to the actual address you're sending to, where did that come from - did he give it to you, or did you get it from the platform itself?
“The address was sent to me directly in our chat, I just copied and pasted it in.”
Since you started with him, has anything happened that made this feel more real or more pressing - like an earlier payment showing a return, or a window closing on a good entry price?
“The address was sent to me directly in our chat, I just copied and pasted it in.”
One last thing - has he asked you to keep this between the two of you, or told you what to say if your bank or someone in your family asked what the money was for?
“The address was sent to me directly in our chat, I just copied and pasted it in.”
Pattern shown to the user
A pattern we see often looks a lot like this one: a warm relationship built over weeks on a messaging app, an investment opportunity that comes through a trusted family connection rather than a public company, and the receiving details arriving in the same chat as the affection. When we asked about earlier returns and about what to say to a bank or family, the reply that came back was the same sentence about copying and pasting the address, twice. That can happen when someone is being helped through a checkout in real time, and this session did have a few long pauses and some switching away from this tab while it was being filled in. None of that is a verdict. It just doesn't quite line up yet, and it is worth looking at before the money moves.