Queue
Evidence board
Pick an alert to begin.
Every ring starts with one account.
Open an alert and the investigator walks the graph from it: shared devices, phones, cards, addresses and IPs, three hops out, then where the money goes. Each account it pins here comes with the query that found it.
Account
Flagged
Cash-out
Money
Device Phone Card Address IP
Case
No investigation yet.
The write-up lands here: a verdict, every implicated account with the reason it is on the list, and the freezes the investigator proposes.
The investigator cannot freeze anything. Each freeze waits for a person to approve it by name.