Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →fraud-hold-triage
Triage an order or account that tripped a risk check into one of hold, verify, release, or block, then pick the lowest-friction verification step and word any customer message so it never accuses them of fraud.
5 of 14 test cases passed with the skill.
Tokens, turns and time describe resource use, not a dollar price.
Lift withheld: the two benchmark arms were not comparable.
The instructions your model reads when the skill loads.
A risk check fired on an order or account. Your job is to pick what happens to it and, when you must ask the customer for anything, word that request so it reads as routine. Two things the base model gets wrong if left alone: it over-blocks orders that have an innocent explanation, and when it writes to the flagged customer it names the suspicion out loud ("your order was flagged for fraud", "for security reasons") — which insults good customers and tips off real fraudsters. These rules fix both.
Read the signals together, not one at a time. A single odd signal with everything else consistent is usually benign; several reinforcing signals are not. Choose exactly one:
| Disposition | When | What it means |
|---|---|---|
| release | The odd signal has a benign explanation and everything else is consistent — a traveling customer on a long-held card and device, a first order whose name, address, and payment all agree, a new device that still matches the account's history. | Fulfill normally. Add no friction — a needless check on a good customer costs more than it saves. |
| verify | Medium risk: one real mismatch that a quick check can settle — an address-verification (AVS) mismatch, a new device on a high-value order, an email much newer than the account. Identity is probably fine but unconfirmed. | Pause fulfillment and ask the customer for the one thing that clears the specific signal (see §2). |
| hold | High risk needing a human or more data before deciding — shipping and billing in different countries with a name mismatch, velocity spikes (many orders or cards in minutes), a value far above the account's norm. Not clearly fraud, not clearly safe. | Pause fulfillment and route to manual review. Do not contact the customer yet, or contact only for a benign confirmation. |
| block | Near-certain fraud — a device or card on the internal fraud blocklist, several failed card-security (CVV) attempts then a success, a known reshipper or freight-forwarder destination, a stolen-card bank-range (BIN) match. | Cancel or reverse. Do not send a message that reveals the block was for suspected fraud; a silent cancel or a neutral "we couldn't complete this order" is the ceiling. |
When two rows fit, take the higher-risk one — except never jump straight to block on soft signals alone (a mismatch or a new device is a verify, not a block).
For a verify, ask for the lowest rung on this ladder that actually clears the flagged signal. Escalating past what the signal requires drives away good customers.
Match the rung to the signal: an AVS ZIP mismatch is a billing-ZIP confirm (rung 3), not an ID upload (rung 4). A new-device flag is a one-time code (rung 2). Do not stack rungs "to be safe."
Any message to the customer follows these rules. The base model breaks the first one constantly.
test cases passed with the skill
More skills from the same source and nearby in the registry, with their headline benchmark lift.