d_d4a18cc9
INTERVENE2026-08-09 11:44:33 UTC · partner demo · threshold profile balanced · source live
Reasoning
The core real-time coaching pattern is fully present — repeated long idle gaps, tab switching, and a pasted destination address — meaning someone is very likely walking the user through this checkout live. It is compounded by a textbook bait escalation (200 to 1000 to 4800) into a brand-new one-off wallet that empties within minutes, which matches an investment-scam shape.
Signal vector, as received
| Signal | Value | Contributed |
|---|---|---|
| account_age_days | 3 | — |
| is_first_purchase | true | — |
| amount_eur | 4800 | — |
| amount_vs_median | null | — |
| funding_method | card | — |
| minutes_to_outbound | 6 | yes |
| destination_first_seen_days | 2 | — |
| destination_type | fresh_eoa | — |
| declined_attempts | 0 | — |
| address_entry_method | pasted | — |
| idle_gaps_over_60s | 4 | yes |
| tab_switches | 3 | yes |
| deposit_escalation | [200, 1000, 4800] | yes |
| kyc_retries | 0 | — |
| merchant_verified | null | — |
Probe transcript
Can you tell me what's going on with this transfer?
“I met someone on a dating app about two months ago. We talked every day, and he told me about this investment platform his uncle runs — it's how he gets early access to good entry prices.”
When it came time to send, where did the wallet address itself come from - did he give it to you, or did it come from the platform his uncle runs?
“The address was sent to me directly in our chat, I just copied and pasted it in.”
Since you started with him, has anything happened along the way - a smaller amount going through fine, a window closing, an entry price about to move - that's made this one feel more pressing?
“The address was sent to me directly in our chat, I just copied and pasted it in.”
Last thing: has he asked you to keep this between the two of you, or told you what to say if your bank or someone in your family asked what the money was for?
“The address was sent to me directly in our chat, I just copied and pasted it in.”
Pattern shown to the user
This is a shape we see fairly often: a relationship that builds daily over weeks online, an investment described as coming through a family member with early access, and then the destination arriving as text in that same private chat rather than from any platform you signed into yourself. When the same sentence comes back for questions about pressure and about what to tell family, that is usually a sign the conversation has been steered somewhere safe rather than answered. None of this says anything about him as a person. It is just worth noticing that everything you know about the money's destination has come through one channel.