Working an alert

Every alert has a reason: a rule or model detected something. Read the alert reason first, then locate the activity it is referring to. Your review must address that reason, even if you identify other concerns along the way.

Next, build a profile of the customer: their occupation or business, the length of the relationship, the stated purpose of the account, and their expected activity. Suspicion arises from activity that is inconsistent with the customer's profile.