What is the ACH hold queue today?
25 held credits, $109,070, received Friday through Sunday. By the rule that held them:
| Rule | Held | Total |
|---|---|---|
| One originator paying many members | 11 | $21,770 |
| 4 or more from one source in 14 days, over $5K | 7 | $21,500 |
| Over 60, 2 standard deviations above normal | 6 | $56,200 |
| 72-hour volume over +200% of normal | 1 | $9,600 |
Who are the originators on the 11?
| Originator | Held | Members paid in the last 10 days |
|---|---|---|
| IRS TREAS 310 TAX REF | 10 | 412 |
| NORTHGATE STAFFING SVC | 1 | 3 |
Before I go further, check the receiver name on every entry against the account holder. All 25.
24 match. One doesn't:
| Originator | Amount | Entry type | Receiver name | Account holder |
|---|---|---|---|---|
| NORTHGATE STAFFING SVC | $2,840 | Payroll | Daniel Ortiz | Kevin Marsh |
Leave that one. On the IRS ones, did these members get a refund last year?
8 of 10 did, from Treasury, within 30% of this year's amount. The other 2 had no refund here last year.
How old are those two accounts?
14 months and 3 years. Both are joint accounts, and the refund names both owners.
It's extension season. Release the 10.
Released 10 ($18,930).
- Note on each: “IRS refund, Treasury originator, receiver name matches.”
- Prior-year refund added for 8; the account age and joint owners for the other 2.
Today 8:47 AM
Back to Northgate. What can you find on them?
I found no state business registration under that name and no website. Its ACH company ID has paid 3 members here, all in the last 10 days, all as payroll.
Who are the other two?
Neither account has any other activity.
| Member | Account opened | Credit | Released | What happened next |
|---|---|---|---|---|
| Andre Wilkes | Sep 14 | $2,610, Oct 2 | Oct 2 | Out by Zelle within 3 hours |
| Lena Park | Sep 20 | $2,900, Oct 6 | Oct 6 | Out by Zelle within 2 hours |
And Marsh?
The account was opened Sep 21. Deposits since then: $40 at opening. Nothing else.
Return it. Open an investigation with all three as subjects and Northgate as the counterparty.
Returned. Opened the investigation with Marsh, Wilkes and Park as subjects. The three credits, the name mismatch, both Zelle trails and the search for Northgate are attached. It's assigned to you.
Northgate Staffing — payroll to new accountsAML investigation · 3 subjects · credit returnedToday 8:52 AM
What's left in the ACH queue?
14 held credits, $87,300:
| Rule | Held | Total |
|---|---|---|
| 4 or more from one source in 14 days, over $5K | 7 | $21,500 |
| Over 60, 2 standard deviations above normal | 6 | $56,200 |
| 72-hour volume over +200% of normal | 1 | $9,600 |
The 7 transfers. Have these sources funded these accounts before?
All 7 have. The first transfer from each source was between 4 and 26 months ago. None of the earlier transfers raised an alert.
Some of these are even amounts. What are they?
Three members are receiving $2,500 pieces, all from the same brokerage. Their earlier transfers from that brokerage were also $2,500 each.
Check if that's the brokerage's per-transfer limit. Here is their Account Agreement. Tell me which section of the Agreement contains the transfer limit.
Reviewed the brokerage's Account Agreement and confirmed the transfer limit is $2,500 per transaction. The transfer limit is found in section 9.
Release the 7.
Released 7 ($21,500).
Today 8:55 AM
The over-60s. Did each one get this same payment last year?
5 of 6 did, from the same originator in the same month, within 5%. One didn't:
| Member | Age | Member since | Originator | Amount | Entry type | Prior credits from originator | Usual monthly deposits |
|---|---|---|---|---|---|---|---|
| Margaret Ellis | 74 | 22 years | SUMMIT RIDGE CAPITAL | $18,000 | Business | None | ~$2,100 |
Any changes to contact info or address on all six, last 90 days?
None on 5. On Ellis: her phone number and email were both changed online on Oct 8 at 11:52 PM.
Release the 5. Keep Ellis held. What was her phone number before the change?
Released 5 ($38,200). Ellis stays held. Her previous number was 555-0148.
I'll call her at that number. Remind me at 2.
Opened a fraud investigation with the held credit, last year's payments and the change log attached. The call is on it for 2:00 PM, with the old number.
Margaret Ellis — $18,000 from Summit Ridge CapitalFraud investigation · credit held · call at 2:00 PMToday 8:58 AM
Last one. The spike.
| Member | Account opened | Originator | Amount | Entity type | Receiver name | Largest earlier deposit |
|---|---|---|---|---|---|---|
| Tyler Brooks | 2 months ago | HARMON BUILD GROUP LLC | $9,600 | Business | Matches | $780 |
Who's Harmon?
A state-registered LLC in construction, active since 2019. It has a website, and its Google reviews average 4.4 across 61 reviews.
What does his profile say?
His occupation is listed as “Student.” His stated income is under $25K.
Could be contractor work. Draft a message asking him what it's for. Don't say it's flagged.
Draft:
Hi Tyler, we received a $9,600 deposit from Harmon Build Group LLC. Can you tell us what it's for? We'll make it available once we hear back.
Send.
Sent. Opened an investigation with the held credit, the research on Harmon and the message. It comes back to you when he replies.
Tyler Brooks — $9,600 from Harmon Build GroupAML investigation · credit held · waiting on his reply