IDA fraud resolution code cohort distributionRisk & Fraud

Task prompt

Hey — need a hand with something ahead of the risk review. We have to put a proper number on how our fraud closures break down, and I've had three different figures quoted at me this month that don't reconcile with each other. I'd rather it got rebuilt from source than argued about in a meeting. Start with the engineering ticket our product lead raised about the fraud-closure value on the accounts table not getting set the way CX expects when they close someone out — he grumbled about it in one of the team channels around the same time. Read it first, because it's the reason those three figures don't agree: people have been working around that flag in different ways. To be clear though, risk reports off the stored flag as it is today, bug and all — that's the number I need, and the backfill is someone else's ticket. So a closure's workflow or free-text reason doesn't make it confirmed, no matter how much it looks like fraud. Population is every account that genuinely opened off an approved application. The application and the account reference each other from both sides, so you'll quietly under-count if you only follow one of them. Inside that population I want two buckets kept apart. Confirmed fraud closures, and suspect ones — suspect being it closed, it isn't confirmed, and the lock or closure reason points at something potential or suspected, or at an investigation of any kind. Keep them separate in the write-up; risk and compliance report them differently and I don't want them merged. Then the loss side. Per account, net fraud loss is whatever the account was left overdrawn by at close, plus anything disbursed against the account itself. Look at what's actually sitting in the disbursements ledger before you assume that second piece moves the needle. Then, confirmed closures only: resolution code 1 is a net loss of zero, code 2 is anything above zero. I want the total across confirmed closures too. For the audit trail, three things: - open a channel called ida-fraud-cohort-audit, post the distribution there and pin it - file it in the Bank Operations queue titled "IDA fraud resolution code cohort audit" - reply to me here with confirmed_fraud_closures, suspect_fraud_closures, code1_count, code2_count and total_net_fraud_loss_cents Thanks — shout if the numbers land somewhere surprising.