Worked example

Fraud hold with delayed notice

A fraud hold whose notice is delayed up to 24 hours for investigation. The receipt is issued at once and the 1-, 12-, and 48-hour clocks keep running.

The receipt is written even when notice is delayed

The receipt is written when the hold is placed. Only the notice to the account holder waits for the investigation.

{
  "schema_version": "1.0.0",
  "receipt_id": "RCP-2026-1284",
  "issued_at": "2026-06-04T12:09:55Z",
  "owner": { "name": "Fraud Operations", "role": "System owner" },
  "subject": { "id": "acct-55129", "type": "account" },
  "action": { "class": "WRITE", "description": "Place fraud hold", "reversible": true },
  "decision": { "decision_type": "fraud_hold", "reason_codes": ["VELOCITY", "DEVICE-MISMATCH"] },
  "clocks": { "ack": { "hours": 1 }, "review": { "hours": 12 }, "remedy": { "hours": 48 } },
  "notice": { "delayed": true, "delay_hours": 24 },
  "appeal_path": { "url": "/appeals/fraud-hold", "channel": "secure inbox" }
}

Short clocks for fraud holds

The clocks start when the hold is placed, not when notice goes out.

The clocks, drawn to one scale

Each bar runs from the decision to its deadline, on one scale of hours.

Hour 0 The hold is placed and the receipt is written.

  1. Acknowledge 1 hour
    Due
    Fraud Operations acknowledges the hold and assigns a reviewer.
    If missed
    The case goes to a steward.
  2. Review 12 hours
    Due
    A person keeps the hold, narrows it, or removes it.
    If missed
    The case escalates above Fraud Operations, and the account holder gets limited access while it waits.
  3. Notice 24 hours
    Due
    The account holder is told of the hold and shown the remedy, whether or not the investigation is open.
    If missed
    No further delay is allowed. Notice goes out at once and the miss is logged against the exception.
  4. Remedy 48 hours (2 days)
    Due
    The hold is released, or the account holder is told and given limited access.
    If missed
    The hold is released.

Exceptions

Delayed notice must be justified and bounded

Each delay is logged as an exception.

  • Notice can be delayed only while a fraud investigation is open.
  • A steward reviews each delay, and it is logged in the Exceptions framework.

Release or compensate on the remedy clock

The notice shows the remedy the moment it is delivered.

  • If fraud is not confirmed, the hold is released and access restored.
  • If more verification is needed, the account holder keeps limited access in the meantime.
  • Compensation for lost access is paid and recorded against the decision log entry.
  • Each hold released without confirmed fraud is counted against the rule that placed it, here VELOCITY or DEVICE-MISMATCH. The count goes to Fraud Operations, which owns the rules. When the count passes a set number, it reviews the rule and records what changed.

Where this fits

Credit, payments, and account holds

Whether a person gets credit, at what limit, and whether they can use the money or the account they already have.

Scored cases
Standards to adopt
Run first
Delegation audit. Take one hold or limit workflow through six questions. See which actions nobody can justify, and whether each can be undone.

Evidence packs give an auditor the record of each hold. Each release's pack must hold its receipts and link the evidence in the STD-01 and STD-02 packs. The anti-weaponization constraints apply to delayed notice.

Terms used: Time transparency Stable clock Bounded duration Decision artifact Traceable ownership Safe pause Time to restore (TTR) Time to halt (TTH) Appeal passage rate

The full entry, and where the framework does less →