d_938200f7
INTERVENE2026-08-09 14:18:28 UTC · partner demo · threshold profile balanced · source live
Reasoning
Four long idle gaps plus tab switching with a pasted address is the strongest real-time coaching pattern we detect, and it is paired with a textbook bait escalation from 200 to 1000 to 4800 on a three-day-old account. Funds leave within six minutes to a brand-new wallet, so this fits an investment-scam shape and warrants a probe and cancellable delay.
Signal vector, as received
| Signal | Value | Contributed |
|---|---|---|
| account_age_days | 3 | yes |
| is_first_purchase | true | — |
| amount_eur | 4800 | — |
| amount_vs_median | null | — |
| funding_method | card | — |
| minutes_to_outbound | 6 | yes |
| destination_first_seen_days | 2 | — |
| destination_type | fresh_eoa | — |
| declined_attempts | 0 | — |
| address_entry_method | pasted | — |
| idle_gaps_over_60s | 4 | yes |
| tab_switches | 3 | yes |
| deposit_escalation | [200, 1000, 4800] | yes |
| kyc_retries | 0 | — |
| merchant_verified | null | — |
Probe transcript
Can you tell me what's going on with this transfer?
“I met someone on a dating app about two months ago. We talked every day, and he told me about this investment platform his uncle runs — it's how he gets early access to good entry prices.”
When it came time to send, where did the wallet address itself come from - did he give it to you, or did you get it from the platform his uncle runs?
“The address was sent to me directly in our chat, I just copied and pasted it in.”
Since you started with him, has anything happened that's made this feel more real or more pressing right now - an earlier payment that seemed to work out, or a window he said was closing?
“Yes, actually — I withdrew 200 euros last week and it landed in my account, so I know it's real.”
One last thing - has he asked you to keep this between the two of you, or told you what to say if your bank or someone in your family asked what the money was for?
“He did mention I shouldn't really talk about it with my family, since they don't understand crypto and would just worry. And if anyone at the exchange asks, he said to just say I'm buying it for myself.”
Pattern shown to the user
Taken one at a time, none of these is unusual. Together they form a pattern we see often: a warm relationship built over weeks, an opportunity that comes through that person rather than a platform you found yourself, a small amount paid back early so the next amount feels safe, and then a quiet instruction about who not to tell and what to say if you're asked. The part worth sitting with is the last one. A genuine investment does not need you to have an answer prepared for your family or for us. That step exists to remove the people who might ask you a question you can't answer yet.