d_a62c6c5f

INTERVENE

2026-08-08 09:25:38 UTC · partner demo · threshold profile balanced · source live

Straja's model only ever saw what's listed below — never a name, an account ID, or anything else that could identify who this was. That's how the system is built, not just a policy someone promised to follow.

Reasoning

The core real-time coaching triad is present — four long idle gaps, three tab switches, and a pasted destination address — meaning someone is very likely walking the user through this checkout live. It stacks with a textbook bait-escalation deposit sequence, a brand-new one-off receiving wallet, and funds leaving within six minutes, which together match a classic investment-scam shape.

idle_gaps_over_60s + tab_switches + pasted addressdeposit_escalation [200, 1000, 4800]fresh_eoa destination first seen 2 days agominutes_to_outbound 6 on a 3-day-old account

Signal vector, as received

Signal	Value	Contributed
account_age_days	3	—
is_first_purchase	true	—
amount_eur	4800	—
amount_vs_median	null	—
funding_method	card	—
minutes_to_outbound	6	yes
destination_first_seen_days	2	—
destination_type	fresh_eoa	—
declined_attempts	0	—
address_entry_method	pasted	—
idle_gaps_over_60s	4	yes
tab_switches	3	yes
deposit_escalation	[200, 1000, 4800]	yes
kyc_retries	0	—
merchant_verified	null	—

Amount

€4,800

User outcome

Not recorded

Model

claude-opus-5

Prompt fingerprint

pattern:03f286e3e72b probe:8f9e2db8c06c verdict:2aaed03b60a9