Mysteries
Real business anomalies. SQL is your only tool. Pick a case to see what you'd be investigating.
Your First Investigation
Revenue for mid-March looks wrong. Finance says some orders came through but collected nothing. You have one table: orders. Start with SELECT * FROM orders LIMIT 20 and see what you find.
The Missing Employee
A critical board meeting happened yesterday. Security flagged that one employee never badged in — but was seen in the building on camera. Find who it was and why their record is clean.
The Tuesday Anomaly
Revenue drops roughly 60% every Tuesday for the past four weeks. Engineering says no deployments happened. Marketing says no campaign changes. Find out why.
The Padded Expense Report
Finance flagged one department's expense claims. Every single submission is a round number. Hundreds of them. Real spending is never this tidy. Find the pattern and who's responsible.
The Ghost Order
847 orders in the system reference customer IDs that don't exist in the customers table. They have valid products, real payment amounts, but no matching customer. Who placed them?
The Unread Alert
Customers are escalating to social media saying their support tickets were never answered. The dashboard shows 98% response rate. Someone is lying — the data or the customers.
The Duplicate Customer
The new-customer discount is being redeemed far more than acquisition numbers justify. Someone — or many someones — is claiming it multiple times. Find how.
The Impossible Refund
Twelve refunds in the system have a refund date that's earlier than the original purchase date. Time travel doesn't exist. Find who processed them and why.
The Vanishing Inventory
Five products show zero stock in the system. The warehouse team insists they're physically there. The system and reality disagree. Find which record is lying.
The Overtime Claim
Payroll noticed that one team claims overtime every single week — always exactly 8 hours per person, always submitted within the last hour of the payroll window. Seven people, perfect synchrony.
The Slow Table
The restaurant owner believes the "Classic Burger" is dragging down the menu. It's always last in the weekly sales report. But the accountant disagrees. Who's right?
The Perfect Score
Player "GhostRunner99" appeared on the leaderboard with all 15 achievements in the game — three days after account creation. Some of those achievements require 30 days of play. Investigate.
The Silent Region
APAC has missed quota every quarter for 18 months. It never appears in escalation reports. Every quarter ends with 8 deals in "negotiation" that never close. Figure out why nobody noticed.
The Invisible Churn
Dashboard shows 3.2% monthly churn. Revenue growth has slowed despite the same acquisition rate. The number is technically correct — but it's hiding something. Find what.
The Healthy P&L
The P&L statement says the company is profitable. The bank account says payroll will be missed next week. Explain how both can be true at the same time.
The Rising Star
Marcus closed 3x more deals than anyone else this quarter. He's up for VP of Sales. Before the announcement, someone in finance asks you to double-check the numbers.
The Silent Majority
Product survey shows 87% satisfaction. The head of product is planning a major celebration. You notice the survey response rate. Pull on that thread.
The Promotion Paradox
Promo A is profitable. Promo B is profitable. Both are running simultaneously. CFO says margins are collapsing. Marketing says both promos are fine. Someone is right.
The Cohort Cliff
Month-3 retention for most cohorts runs 60-70%. Except March 2024 — it's 0%. Something specific happened to users who signed up that month.
The Referral Rabbit
The referral bonus program paid out ₹40,000 last month to 8 users. Marketing is thrilled about organic growth. Finance noticed these 8 users all referred each other in a circle.
The Department That Never Hires
Engineering has had 5 open roles for 8 months. 847 applications received. 2 interviews conducted. The roles are still open. The hiring manager says the pipeline is "active."
The Budget Shuffle
Q4 finance review: all 5 departments are under budget. CFO is happy. But total capex spend is ₹21.1L over plan and opex is ₹93.2L under. The department view and the category view tell completely different stories.
The Discount Splitter
VOL12 wholesale discount payouts have been climbing steadily, but the order pattern behind them looks off — a cluster of same-day orders from the same customers that never quite reach a round wholesale number. Figure out what's driving it.
The Phantom Responder
P1 incident SLA compliance is 98.7% — the team celebrates. But 19 P1 incidents were resolved in under 90 seconds with no resolution notes. Something is closing tickets that no human touched.
The Carrier Blindspot
Ops dashboard shows 3.4-day average delivery time — within SLA. Customer support tickets about late orders are up 340% over the last 6 weeks. Ops says the metrics look fine. Either the customers are wrong or the metrics are. One of them is.
The Stale Pipeline
Sales pipeline shows ₹34.1Cr in "active" qualified deals. The VP of Sales is presenting it to investors next week. You notice the last activity timestamps. Start there.
The Double Allocation
Q3 bonus payouts just landed. Per-project, the numbers look right. Total company bonus spend is ₹6L over the approved budget. Finance says the approval amounts were correct. HR says the payouts were correct. Both can't be telling the full story.
The Gateway Gap
Refund rate is 5.9% — within policy. The payments team says everything is normal. But in the last 30 days, hundreds of refunds were initiated with the same reason: "delivery confirmation failed — auto refund." That's not a customer behaviour. That's a system behaviour. Find the pattern.
The Notification Black Hole
Churn is up and retention emails are supposedly catching at-risk users before they leave. The retention team swears the "we miss you" campaigns are running. Pull the email delivery logs and find out who actually received them.
The Open Rate Fraud
October email campaign hit 51% open rate — best ever. The marketing team is writing it into the board deck. Someone in growth notices the click-through rate dropped to 0.4%. Run the numbers.
The Approval Trap
Purchase order approval averages 9.6 days across the company. Operations says that's acceptable. But several high-value POs have been stuck for weeks waiting on one specific approver. Find where the bottleneck is.
The Coupon Cascade
Finance spots ~₹4.18L in unplanned coupon discounts from code BETA30. It was issued to 12 beta testers. The redemption log shows 430 uses. Something is very wrong.
The Timezone Ghost
Revenue dashboard shows Monday mornings spike hard every single week. Finance suspects a batch process or fraud. The data says organic Sunday and Monday traffic are identical. So where is the Monday spike actually coming from?
The Headcount Mirage
The board deck says headcount grew from 176 to 214 this quarter — strong momentum. HR ran the numbers from the HRIS export. The payroll team says their budget is off by 22%. These two facts are connected.
The Margin Thief
Premium Electronics just posted 46.6% gross margin — best in the business unit. Input costs rose 12% this quarter. The category manager is up for a performance bonus. The CFO forwarded the report to you with one word: "how?"
The Loyalty Cliff
Loyalty point redemptions spiked 9x in the last two weeks of November. Marketing thinks it's a sign of high engagement and wants to double the points program budget. Finance has a different read. (Points redeem at ₹1 each.)
The Loyal Fraudster
Return rate jumped from a ~6% baseline to 23% overall. The highest-volume returners have perfect review scores and years of purchase history. They don't look like fraudsters. Look harder.
The Successful Failure
A/B test showed ~8% better 7-day activation. You shipped to 100% of users. Three months later, 30-day revenue per user is down ~60%. The test said ship it. Why is it failing?
The Disappearing Engineer
Six engineers from the payments team resigned within 10 days of each other. No counter-offers were made. HR says it's coincidence. The git history disagrees.
The Vendor Ghost
₹85 lakh paid to TechParts Ltd over roughly 4.5 months. Purchase orders raised, payments cleared. But no delivery records exist and inventory never received the goods. Find the money.
The Feature Nobody Uses
Product report shows "AI Assistant" has 89% adoption. The engineering team celebrated. But support tickets mentioning "useless AI" are up 400%. Reconcile this.
The Referral Loop
12 accounts earned ₹1.2 lakh in referral bonuses last month. Each account has a different phone, email, and name. Finance noticed all bonus payouts went to the same bank account.
The Midnight Spike
SEA region shows a dramatic engagement spike every night between 11pm and 2am. The growth team is excited. The infrastructure team is suspicious.
The Compliant Fraud
Every individual claim Dr. Rodriguez submits is valid and within policy limits. Auto-approval threshold is ₹5,000. His claims are always ₹4,999. Insurance flagged it. Prove it.
The Ad That Prints Money (On Paper)
Campaign ROAS is 2.4x. The marketing team wants to 10x the budget. You notice the attribution model. This changes everything.
The Seasonal Employee
Store #7 has the best numbers in the region. Regional manager is showcasing it as a model. Three contract employees left two months ago. Nobody looked at what happened after.
The Double Dipper
Two people appear in both the permanent payroll and the contractor invoice system for the same months. Different bank accounts. Same PAN numbers.
The Slow Leak
API rate limit alerts trigger nightly between 3am and 5am. 40,000 requests. All authenticated. The sessions look legitimate. They are not.
The Menu Illusion
The restaurant promotes its Truffle Pasta and Wagyu Burger as signature items — they're the most-ordered dishes. The restaurant is profitable despite these items, not because of them.
The Phantom Subscriber
Subscriber count grew 40% in Q1. Investor deck went out. Total watch time across those new subscribers is essentially flat. Something doesn't add up.
The Coordinated Walkout
Six engineers from the payments team resigned within 10 days. HR says it's a coincidence. You have access to calendar data, git history, and org structure. Build the full picture.
The Shadow Discount
~₹19.5 lakh in manual order discounts applied over 3 months. All between 9pm and 11pm. All by the same operator account. All to 23 specific customer accounts. Find the full picture.
The Acquisition Illusion
Revenue is up 30% YoY. New user numbers are strong. The board is happy. The CFO quietly asks you to check one thing: what happens to those users after 90 days.
The Sleeper Account
An account dormant for 3 years suddenly received ₹47 lakh and transferred it out within 48 hours. KYC was updated 2 days before. New beneficiary added the morning of the transfer.
The Algorithm That Forgot
The recommendation engine stopped serving content to users aged 45 and above. Their CTR dropped to zero. No one filed a bug report. The algorithm was retrained 6 weeks ago.
The Quiet Cartel
Four vendors always win procurement contracts in rotation. Their bids are always within 2% of each other. Vendor A wins 48% of contracts. The same procurement officer approves all.
The Metric That Moved
DAU jumped 40% overnight. No product changes shipped. Six teams are claiming credit. The number didn't grow — it was redefined.
The Year-End Magic
Every December for three consecutive years, 15 deals close in the final 3 days of the month. In January, an average of 9 are reversed. Bonuses were paid on the December numbers.
The Phantom Conversion
A/B test shows treatment beating control by a 16% relative lift. Engineering wants to ship immediately. But the experiment ran for 30 days and something feels off — the numbers are too clean. Before you declare victory, check who was actually in each arm.
The Long Weekend
HR flagged Customer Success for high sick leave — 74% of company-wide sick days from 19% of headcount. An August flu outbreak is the obvious explanation. But the flu only explains some of it. Look at the calendar.
The Generous Refund
Clothing refunds are averaging ₹347 more than the order value. Finance thought it was a data entry glitch. It isn't. Someone is consistently approving refunds that include a charge customers were never billed for.
The Split Invoice
Accounts payable processed 31 invoices from Nexus Infra Solutions in Q3 — all for "infrastructure work". All approved at manager level. CFO never saw any of them. Pull the amounts.
The Borrowed Key
One Pro account is making 9,847 API calls this month — just under the 10,000 limit. Usage looks fine on paper. But something in the access pattern is very wrong. Look at where the calls are coming from.
The Audit Effect
Store #7 (Whitefield) has strong sales numbers. Management likes the manager. But a curious pattern emerged in the data: their best days don't line up with weekends, holidays, or promotions. They line up with something else entirely.
The Slow Ramp
Some Data team hires are taking ~5.2 months to hit their first performance checkpoint vs 2.1 months company-wide. The team lead says it's because data roles are more complex. The numbers disagree with that explanation — but only if you know where to look.
The Carrier Tax
Finance noticed shipping fees collected in Oct are ₹1.68L higher than the shipping rules should allow. The rules were updated in September. No one can explain the gap. Look at which orders were charged and when.
The Escalation Funnel
Enterprise tier has a 3x worse escalation rate than Pro. Customer Success wants to hire more Senior support agents for Enterprise. But the escalation rate metric might be telling a different story than it looks.
The FX Slip
Treasury settled ₹42.7L less than expected on USD receivables in Q3. The CFO thinks it's rupee appreciation. Finance says the rates look correct. They're both partly right — but neither has noticed the 2-day lag.
The Last Click Lie
Email is getting 100% of conversion credit under last-click attribution. Paid Search budget just got cut by 40%. The attribution model says Email is doing the work. The touchpoint data says something else.
The Onboarding Fingerprint
Priya Acharya closed the most deals this quarter. Everyone's impressed. But the retention team has flagged something — customers she onboarded are churning at 3x the rate of everyone else's customers.
The Shrink Report
Warehouse 3 reports 11.8% inventory shrinkage. Every other warehouse is under 3%. Management wants to fire the warehouse team. But there's an annual external audit buried in the data. Check what the auditors found.
The Carry-Forward Bug
47 employees are complaining their carry-forward leave balance is wrong — they show 0 carry-over when they should have had 4-10 days. HR says the system is fine. The system is not fine.
The Weekend Approver
43 purchase orders were approved between 1 AM and 4:30 AM on weekends. The approval system is supposed to be in maintenance mode during those hours. Someone got in anyway.
The Referral Paradox
Affiliate commission spend jumped 23% last quarter. Conversions are up too, so it looked fine. But someone in fraud noticed something strange about the timing between when referral links get clicked and when orders get placed.
The Rate Drift
Finance sent a support ticket: 89 Growth-tier customers are disputing their invoices. They say they were promised ₹0.12/call but were billed ₹0.15. Sales has no record of promising the wrong rate. The pricing table shows ₹0.12. So where is ₹0.15 coming from?
The OT Shortfall
Three permanent employees filed a formal complaint: they were paid 1.5x for overtime instead of the 2x rate in their contracts. Payroll says the system applied the correct multiplier. Pull the overtime records and check.
The Threshold Game
Petty cash reimbursements are up 34% this quarter. The amounts look reasonable — mostly team lunches, office supplies, courier runs. Nothing above ₹5,000. But the distribution of amounts is not what you'd expect from random expense events.
The Gift Card Loop
One account has ₹46,200 in orders. ₹5,500 of it was covered by gift cards that trace back to a referral program that should never have paid out. Gift cards were involved. And then it just kept going.
The Trial Loop
14-day Pro trial. Free. One per organization. Reasonable policy. But trial consumption is 40% above projections and conversion rate is fine. Something is burning through trial capacity that isn't converting. Check who's signing up.
The Promo Gap
Diwali Sale ran Oct 1–31. 20% off all orders. Customer complaints started Oct 3: "I checked out during the sale but got no discount." Support says the promo was applied correctly. It wasn't — for 1,247 orders.
The Rating Inflation
Compensation review time. One team is getting 71% higher raises than average — justified by their performance scores. But another dataset exists that measures what those scores are supposed to reflect. It tells a different story.
The Wire Fee Waiver
Bank audit found ₹1,86,900 in wire fees that should have been waived. The bank agreement is clear: transfers over $50,000 are free. Treasury says they ran the check. They did — but they checked the wrong number.
The Incentivized Review
Product ratings on the platform average 3.0★. But three categories suddenly jumped to 4.5★. Marketing wants to feature those products. Before you do, check whether the recent reviewers bought differently from the rest.
The Seat Shuffle
A customer calls to complain their account is over the seat limit and they're getting throttled. IT checked: 25 seats licensed, 47 human users. But seat count showed 25. Something in the system isn't counting right.
The Grandfather Clause
RevOps flagged a pricing anomaly: 23 accounts are on the ₹999/month grandfathered rate — but they signed up after the April 2023 price increase. Someone set those rates manually. Figure out who and when.
The Credit Phantom
Month-end AP reconciliation balances perfectly. Finance is happy. But someone in the vendor relations team noticed ₹27.2L in return credits that seem to have come back twice. The summary numbers hide it. The detail doesn't.
The Eternal Session
Security flagged 18 user sessions lasting exactly 16 hours. The app auto-logs out at 8 hours. Engineering says there's no bypass. They're right — there isn't. But there is a timezone.
The Meeting Ghost
Arjun Kapoor is at 131% of quota and filed ₹1,95,500 in Delhi travel claims for Q3 client meetings. The amounts look right. But cross-referencing two other data sources reveals 11 of his 23 travel dates have a problem.
The Double Charge
Zenith IT Services is a reliable vendor — 4 years, never an issue. Finance signed off on 41 "revised" invoices last quarter. The originals were also paid. Both sets are in the payment table. ₹1.48 Cr went out twice.
The Pick Error
SKU WH-ELEC-0247 has a 31.6% pick error rate. Every other SKU in the warehouse is under 3%. The exception log says it's a "timeout" issue. It isn't. The timeout classification is the problem.
The Invisible Promotion
The Q2 email campaign is being celebrated as a success — orders up 34%. Marketing wants to double the budget. Before you do: 89% of the "converts" had already ordered in the 30 days before the email went out.
The Star Agent
AGT-0077 has the highest CSAT on the team — 4.9 stars. Leadership wants to use them as a model for the others. Nobody has looked at what happens to their tickets after they mark them resolved.
The Healthy Cohort
Retention is 54% and the board is happy. The VP of Growth is pitching SMB expansion. One thing worth checking before you spin up a new sales motion: where exactly is that 54% coming from?
The Bonus Cliff
Five reps, four quarters, 100% quota attainment every time. Sales leadership calls it a well-oiled machine. Finance noticed that 6-month churn is spiking. Pull the deal data and tell them why.
The Silent Migration
The v2 API shipped March 1st. Error rate: 2.0% — identical to v1. SLA is green. Platform team is moving on. Someone in mobile support sent a note saying users are complaining about the app "freezing". Investigate.
The Shrinking Box
Natura Oats has held 41% gross margin for six straight quarters despite raw material costs rising 28%. The CFO sent a congratulations email to the ops team. The ops team knows something the CFO doesn't.
The Training Bounce
Two months after the support team's new classification training, "support" tickets are down 34% and leadership is calling it a win. The team leads who ran the training are up for promotion. Look at who changed what.
The Partner Trap
Partner-sourced deals are closing in 16.5 days. Direct deals take 31.5. The channel team wants to double down on partners. Finance asked you to check the cohort data before the board meeting tomorrow.
The Happy Survey
NPS jumped from 34 to 73 after switching to a new survey tool in March. The product team is planning a case study. Engineering hasn't shipped anything major since February. Something changed — figure out what.
Zero Net
Inventory accuracy is 99.1% across the warehouse. The electronics team lead is proud of it. The external auditors flagged "unusual adjustment patterns" in their exit interview. Nobody followed up.
The Quiet Outage
Weekly uptime: 99.93%. SLA is green. The on-call engineer got a perfect score last month. Three customers emailed on Monday morning saying the app was broken "all weekend." Pull the logs and find out who's right.
The Locked-Out Login
Three employees were terminated months ago. Their system accounts were never deactivated. Someone is logging in using their credentials — after hours, from unknown devices. Find who.
The One Customer
Revenue is up 16% year-over-year. The growth deck is ready. Before it goes to investors, someone on the finance team quietly asked: "What does the number look like if you strip out DIST-00041?"
The Zero-Price Product
312 orders were placed for a product with no price set. Every order total is NULL. Hundreds of units shipped, zero revenue recorded. The product is listed as active.
The Velocity Mirage
Sprint velocity is up 150% since Sprint 12 and the PM is getting credit for "unblocking the team." Engineering throughput feels exactly the same to the engineers. The data will settle this.
The Midnight Manager
One procurement manager has approved 89 purchase orders. All of them between 10pm and 2am. Not a single approval during business hours. Finance wants an explanation.
The Same IP Address
14 different customer accounts all placed their first order from the same IP address and all claimed the new-customer discount. Someone found a loophole.
The Expired Contract
One vendor's contract expired 8 months ago. No renewal was signed. The payments kept going out anyway — 23 invoices totalling over ₹14 lakh. Nobody flagged it.
The Invisible Discount
189 customers were shown a 10% discount at checkout and clicked "Apply". The system confirmed it. But every single one of them paid full price. The discount vanished.
The Weekend Approvals
47 payment approvals are timestamped on Sundays. The company doesn't operate on weekends. All 47 were processed by the same person. The payments went out the following Monday.
The Serial Returner
One customer placed 23 orders over four months and returned 21 of them for full refunds. They always return on day 27-29 of the 30-day window. Near-zero net revenue, 91% return rate.
The Negative Stock
Eight products show negative quantities in the warehouse system. The stock went below zero. Someone processed returns but the counts moved in the wrong direction.
The Orphan Tickets
203 open support tickets are assigned to an agent who resigned three months ago. They sit there. Customers are waiting. No one reassigned them because no one noticed.
The Free Shipping Bug
Free shipping kicks in at ₹500. But 312 orders between ₹450 and ₹499 also got free shipping. The threshold in code was set to ₹450 instead of ₹500. It's been live for weeks.
The Phantom Department
18 employees are assigned to a department that doesn't exist in the system. They've been on payroll for months. No manager. No budget. No record. Just the salary going out.
The Rating Farm
A seller appeared on the platform 3 weeks ago and already has 412 five-star reviews. Every review was posted between 2am and 3:30am. All reviewer accounts were created within the same 3-day window.
The Negative Cart
17 orders have a negative total amount. The store effectively paid these customers. A coupon was stacked on top of a bundle discount — combined they exceed 100% off.
The Ghost Subscription
Five customers cancelled their subscriptions. The cancellations were confirmed. But payments kept being taken from their cards every month after that. The billing system never got the memo.
The Budget Hijack
Travel is underspent by ₹2.6 lakh. Office supplies is ~2x over budget. Finance is confused — the same team is responsible for both lines. The numbers don't add up until you look at who filed what.
The Stuck Shipment
38 customer orders have been "in transit" for over 45 days. Same carrier, all of them. The carrier's tracking portal stopped updating 6 weeks ago. The packages are missing.
The Future Invoice
16 invoices have due dates in 2025 when they were issued in early 2024. Standard terms are net-30 to net-90. Someone entered the wrong year. These will never trigger on-time payment alerts.
The Dead Promo Still Working
A 50% off promo code was deactivated 3 months ago. It was deactivated in the right table. But it's been used 67 times since. The checkout system reads from a different table — and nobody updated that one.
The Wrong Quarter
The dashboard says Q2 was the best quarter and Q4 was the worst. But when you calculate revenue from actual order dates, you get the opposite result. The quarter labels are wrong.
The Double Salary
Two months in a row, one employee's salary was paid twice — once by the regular payroll run and once via a manual "correction" entry. Net overpayment: ₹2,14,000. Find who, when, and confirm another payment that looks suspicious but is actually legitimate.
The Unmanaged 27
27 employees have no manager assigned. They are not department heads. They were supposed to be assigned to MGR-005 (Pradeep Kumar) during onboarding, but the script silently skipped NULL manager assignments. Leaves, expenses, and performance reviews are going unreviewed.
The Future Birthday
11 patient records have a date of birth set in the future. A migration script accidentally copied the registration date into the DOB field for a batch of new patients. These patients cannot be age-verified and are blocked from age-gated treatments.
The Tax-Free Vendors Who Aren't
34 invoices for standard taxable vendors were coded GST_EXEMPT and collected zero tax on ₹27.6L of revenue. The tax code was incorrectly copied from a test vendor during a bulk data import. One vendor really is exempt — don't flag them.
The Refund Without an Order
19 refunds in the system reference order IDs that don't exist anywhere in the orders table. Total: ₹91,770 paid out. A customer service agent exploited a validation gap — the refund API accepted any order_id string without checking existence.
The Backdated Leave
Company policy requires leave to be applied at least 1 day before it starts. 22 leave requests were submitted after the leave had already begun. One employee accounts for 18 of them. A handful of same-day sick leaves are allowed — those are fine.
The Wrong Unit of Measure
A product stocked and sold in cartons has 47 purchase orders recorded in "units" instead. The warehouse received cartons regardless, so physical inventory is 12x what the system believes. Over 3,000 units are sitting in the warehouse, untracked.
The Test Users in Production
9 test and fake accounts are in the production users table. Three of them have active paid subscriptions — real billing events tied to non-real accounts. One legitimate demo account is intentionally in production; make sure you distinguish it.
The Wrong Currency
26 orders from US customers show currency=INR but the amounts are in USD. The 83x exchange rate was never applied — revenue from these orders is understated by ~₹1.24 crore. Singapore orders with SGD amounts are correct and should not be flagged.
The Ghost Catalog
4 products were deactivated in December 2023 but kept appearing in the storefront because the cache was never purged. 156 orders came in on deactivated products in January 2024. One product was deactivated correctly and should show zero post-deactivation sales.
The Suspended Seller
Seven seller accounts were suspended for policy violations in Feb–March 2024, but 43 orders kept coming through on those accounts after suspension. The checkout API was reading from a stale seller-status cache. One suspended seller (ClearCache Store) has zero post-suspension orders — it was blocked correctly when ops manually flushed that cache entry.
The Invisible Category
The product team is puzzled — 31 products exist in the database and are marked active, but they never show up in any category browse page. A migration last month deleted four legacy categories without first null-ing the category_id on their products. Those products are now effectively invisible to shoppers.
The Underpaid Staff
HR flagged a compliance concern: some part-time staff may be earning below the statutory minimum hourly rate of ₹176. The legacy onboarding portal didn't enforce a rate floor. Find which employees are underpaid — and double-check the one who looks borderline.
The Self-Approver
Procurement policy is clear: no employee can approve their own purchase request above ₹5,000. But a bug in the approval workflow — triggered when a manager was on leave — let the system fall back to self-approval. Find all requests where the same person both raised and approved.
The Impossible Shift
Payroll flagged an issue in the shift records — some employees are being paid for shifts where the end time is before the start time, but they're not marked as overnight. A scheduling tool migration dropped the overnight flag on some records. Find the impossible shifts (end ≤ start, not overnight).
The Overused Coupon
Two promo codes blew past their redemption limits during a high-traffic sale. FLASH50 was capped at 100 uses; WELCOME25 at 500. A race condition in the checkout API skipped the usage check under concurrent load. One other high-volume code (REFER10) looks suspicious but is actually within its limit.
The Phantom Supplier
Eight approved purchase orders totalling ₹4,21,750 reference supplier codes that don't exist in the suppliers table. A junior buyer manually typed them into the ERP during a system cutover, making typos that created phantom codes. There's no matching contract, no KYC, no way to know who gets paid.
The Duplicate Invoice
Accounts payable got a call from a vendor asking why they hadn't been paid. When the team dug in, they found the same invoice number submitted twice — once marked paid, once pending. Three vendors did this; six duplicate pairs in total. The system had no unique constraint on (vendor_id, invoice_number).
The Ignored SLA
The support dashboard reports an 89% SLA compliance rate. But when you calculate actual resolution times from the raw data, the number looks very different. A batch-close script marked 38 tickets as resolved without checking whether the SLA window had passed. The sla_breached flag was never set on them.
The Overloaded Location
Three warehouse bin locations show dozens of inventory items assigned to them — but their capacity is listed as 0. They were decommissioned but never removed from the WMS. A migration job reassigned items to them without checking capacity. The items are physically elsewhere; the system doesn't know where.
The Stale Cart
Customers are calling in about wrong prices — some are being quoted more than the website shows, some less. The cart service stores unit_price at the time of add-to-cart and never refreshes it. 29 active cart items are carrying outdated prices. Seven others have price_locked=TRUE — those are intentional promotional locks, not the problem.
The Lapsed Licence
A customer reported they could still access pro features even though their subscription expired months ago. Turns out a renewal job failed silently and never flipped those licences to expired. 14 licences show status=active but their expiry date is in the past. Nine others are correctly in grace_period — those aren't the problem.
The Unverified Vendor
Finance policy is strict: no vendor gets paid until KYC is approved. But during last month's system cutover, the payment gate check was briefly disabled. Five vendors with kyc_status=pending slipped through and received payments totalling ₹7,13,200. One pending vendor (NewBiz Consultants) was correctly blocked — all its invoices are on_hold.
The Missing Audit Log
Nineteen salary adjustments were modified after creation — updated_at is newer than created_at — but none of them have a corresponding entry in the audit_log. An admin script ran while the audit trigger was temporarily disabled for a "performance fix." Find the adjustments that changed without a trace.
The Loyalty Points Leak
Finance noticed the loyalty liability on the books is lower than it should be. When you compare customer balances against their transaction history, 11 customers show a balance that's lower than their earned points — meaning redemptions happened that were never recorded as debit rows. The endpoint decremented the balance but never inserted the transaction.
The Closed Account Orders
Customer accounts marked as closed should no longer be able to place orders. But 13 orders came through on accounts where the closure date is before the order date — a stale session token persisted past account closure and allowed checkout to complete. One edge case: a same-day order placed before the closure timestamp is legitimate.
The Negative Refund
Nine customers were charged instead of refunded. A sign-flip bug was introduced when the payment gateway switched API versions — the refund processor applied the wrong sign, so instead of ₹899 going back to the customer, ₹899 was deducted again. Four zero-amount refunds are separate: those were voided requests that never processed.
The Orphan Payment
The gateway collected payment for 16 orders that don't exist in the orders table. Payment went through — money was charged — but the order creation step failed right after. ₹35,464 is stranded with no fulfilment record attached. Five other payments have no order_id at all: those are gift card top-ups, which legitimately have none.
The Weekend Rate on Weekdays
Service bookings on weekdays should be billed at the standard rate. But 23 bookings made Monday–Friday are showing rate_type='weekend' — the weekend premium rate. A bug in the rate-selection logic triggered when a booking was made within 48 hours of a weekend. Weekend bookings billed at weekend rate are fine — check the day of week.
The Out-of-Range Rating
Product star averages look off. Seven reviews submitted via the mobile app have rating=0 — a bug sent 0 instead of 1 when users tapped the first star too quickly. Seven more have rating=6 from an old API version that allowed a 6-star option. Both sets are skewing averages on product pages. Three NULL-rating drafts are unrelated.
The Unshipped Paid Order
Seventeen orders were fully paid over 30 days ago but are still sitting in shipping_status='pending'. A fulfilment webhook failed silently for a batch placed on Feb 1–3, 2024. The money is collected; the goods never shipped. Nine recently-pending orders (within 30 days) are normal fulfilment queue — those aren't the problem.
The Discount Cap Breach
Four coupon codes have a maximum discount amount cap — no order should save more than the cap regardless of order size. But 21 applications have a discount_amount that exceeds the coupon's cap. A percentage was calculated correctly but the cap check was skipped for high-value orders. BIGSALE30 has no cap — its large discounts are fine.
The Wrong Region Deal
Sales commission and quota are calculated per territory. Fourteen closed deals are assigned to reps whose home region doesn't match the deal's region — quota is being credited to the wrong territory. REP-007 is a national account manager with region=ALL; their cross-region deals are always valid and should be excluded.
The Free Trial Double-Dipper
Free trials are limited to three accounts per company domain. Six corporate domains have blown past that — one has six active trial accounts, another has five. People are signing up as ceo@, cto@, eng1@, eng2@... to multiply their trial time. Personal email domains (gmail, yahoo, hotmail) are excluded from this limit.
The Missing Delivery Confirmation
22 shipments show shipping_status='delivered' but have no delivery_confirmed_at timestamp. A message queue backlog caused the delivery confirmation webhook to be dropped for a batch processed on Feb 15, 2024. Without the confirmation, we can't prove delivery and customers could successfully dispute the charge. Shipments that are still out_for_delivery with NULL confirmation are expected — those are fine.
The Reviewer Who Never Bought
27 product reviews were left by customers who never purchased that product. The review platform was open to any registered user — not gated to verified buyers — allowing fake or competitor accounts to flood products with 1-star reviews. CUST-R099 reviewed before buying (order came later) — technically no prior purchase but they did eventually buy.
The Negative Stock
Warehouse manager flagged something in the weekly stock report — 9 SKUs are showing negative on-hand quantities. Stock can't go negative physically. We need to know which products and by how much.
The Double Bill
Three customers emailed support saying they were charged twice this month. Finance says it's isolated. Find all customers who were invoiced more than once in the same calendar month — finance thinks it's just those three, but you're not so sure.
The Leave-Day Clockin
HR noticed some employees have attendance records on dates they had approved leave. Either leave was cancelled without updating the system, or payroll is about to pay them twice. Find everyone who clocked in on an approved leave day.
The Self-Referral
Marketing wants to audit the referral programme before the next payout cycle. Find any customers who used their own referral code to claim the sign-up bonus — the form didn't validate ownership, so it was technically possible.
The Below-Cost Listings
The pricing team ran an automation last month to apply discounts across Electronics. CFO wants a sanity check: are any products currently priced below their cost price? Even one means we're losing money on every sale.
The Pre-Purchase Warranty Claim
Warranty ops flagged something odd — a handful of claims appear to have been filed before the customer even purchased the product. Could be data entry errors, could be fraud. Find them all.
The Ghost Department
HR deleted 3 departments last quarter during a reorg. Someone just pointed out that a chunk of employees still show those departments as their primary assignment — their cost centre, reporting line, and system access all reference a department that no longer exists.
The Negative Gift Card
A customer complained their gift card showed a negative balance after checkout. That should be impossible — we're supposed to reject redemptions that would take balance below zero. Find all gift cards currently below zero.
The Misrouted Critical Ticket
Support response times on critical issues spiked last week. The theory is that some critical tickets are landing in the tier-1 queue, where agents aren't trained to handle them. Verify how many critical tickets are assigned to tier-1 agents.
The Zero-VAT Products
Tax compliance raised a flag — some products in vatable categories appear to have 0% VAT applied. If true, every sale of those products is understating our liability. Find which vatable products are incorrectly set to 0% VAT.
The Archived Address
Logistics raised a concern — some recent orders are pointing to shipping addresses that have been archived. Those addresses may be vacant or wrong. The checkout session cached the address ID and didn't check for archival. Find the affected orders.
The Post-KYC Transaction
Compliance review: find any transactions processed on accounts that failed KYC verification. Those transactions should have been blocked at the gateway. The gateway routing cache wasn't invalidated when KYC status changed to failed.
The Promo Exclusion Breach
Finance found that last week's FLASH20 promotion was applied to some product categories that were explicitly excluded from it. The frontend showed the promo as valid for all categories — the backend never re-checked the exclusion list. Find the violations.
The On-Leave Driver
Dispatch flagged that some deliveries were assigned to drivers on approved sick leave on the delivery date. The dispatch system only filters inactive drivers — it doesn't check the leave calendar. Find all affected deliveries.
The Backwards Sessions
Venue ops found some event session records where end time is before start time. A UI update swapped the AM/PM fields in the data entry form — operators entered afternoon times but the system stored them as morning. Give us the full list.
The Double Checkout
IT asset management shows some equipment checked out to two people simultaneously — neither returned it before the second booking went through. A race condition in the booking form allowed both requests to pass the availability check. Find which assets are double-booked.
The Phantom Admins
Security review flagged something odd — we've got users with admin role who've never shown up in the audit log, not once. Every real admin action gets logged, so zero entries means those permissions have just never been used. Could be an orphaned service account, could be a deprovisioning gap we missed. Need to know which, and why.
The Manager Who Reports to Himself
HR ran a data integrity check on the org chart tool and it choked — reporting rollups showed 3 employees with themselves listed as their own manager. That is not possible in a real hierarchy, and it is silently breaking every headcount dashboard that walks the manager chain. Find who they are.
The Oversold Show
Box office says "Coldplay Tribute Night" sold out weeks ago, but 34 more people showed up at the gate than the venue holds. A corporate block-booking promo code skipped the capacity check. Some other shows look oversold too at first glance, but a lot of those tickets got cancelled — find the one that's actually over.
The Double-Booked Forklift
Warehouse ops flagged a scheduling glitch — one forklift, FLT-07, was booked to two different operators at the exact same start time on March 14th. Physically impossible, one machine, one driver. Don't confuse it with OP-014, who's legitimately running two different pieces of equipment at once as shift lead.
The Refund Bigger Than The Order
Finance flagged 5 orders where the total refunded is more than the customer ever paid. Support agents were re-processing refund requests for customers who called in twice about the same issue, and the tool never checked whether a refund had already gone through. One ₹18,500 refund looks alarming on its own, but that one's fine — the order was ₹22,000.
The Refill Too Soon
Pharmacy compliance flagged 6 patients who refilled a controlled 30-day prescription after only 9 days. That is a diversion red flag. A bunch of routine antibiotic refills also look "too soon" at first glance — those are fine, short courses get renewed early all the time. It is only the controlled-class refills that matter here.
The Certificate Issued Early
5 course certificates were issued on a calendar date before the student had even finished the final module — physically impossible unless someone hit the "issue" button manually. A handful of other certs look early too if you compare exact timestamps, but those are the same-day overnight batch job, not a problem.
The Claim Above the Limit
Underwriting flagged 4 claims that were approved for more than their own policy's coverage limit — an override slipped past the sub-limit check. About 10 more claims look like they blow through a limit too, but that's only if you match claims to policies by the customer's name instead of the actual policy_id — those customers hold two different policies with very different limits.
The Impossible SIM Travel
Fraud ops flagged 4 SIMs that connected from India, then from the US, only 3 hours apart — no flight makes that trip, classic SIM-cloning signature. Dozens of other SIMs also show two countries in their logs, but with a 6-day gap between them — completely normal travel, not fraud.
The Batch That Passed Without Being Tested
7 production batches are marked qa_status = passed with zero rows in qa_test_results — nobody actually ran a test before signing off. 13 more batches also show zero test rows and a passed status, but those are on the low_risk_repackaging line, which is exempt from per-test logging by policy — not a problem.
The Cold Chain Break
5 shipments of frozen berries logged 9+ straight temperature readings above the 8°C safe threshold — over 2 hours of sustained cold-chain failure — yet were still marked delivered_ok. Ten other shipments had a reading or two spike above 8°C too, but that's just normal dock loading noise under 30 minutes.
The Bus That Never Left the Depot
3 trips are marked completed — meaning the route was reported as run — but every single GPS ping for those trips sits at the exact same depot coordinates. The bus never moved. Twelve other trips also show zero movement, but their status is standby — buses legitimately parked on reserve, not a problem.
The Vacant Unit Still Billing Rent
6 units moved out with no new lease signed, but rent invoices kept generating for 3 more months afterward — nobody told billing the unit was empty. 8 other vacated units also got an invoice after move-out, but it was a one-off vacancy_utility charge the owner legitimately covers on an empty unit, not rent.
The Billed Hour During Approved Leave
6 attorneys billed hours on a day they had an approved full-day leave request — someone kept working (or kept the clock running) on unpaid time off. 9 more attorneys billed hours on a half-day leave date, which is completely normal — they worked the other half.
The Pilot Over the Duty Limit
5 pilots logged over 15 hours of actual flight duty in a single day — past the 14-hour regulatory limit. Several more pilots also show over 14 total hours logged that day, but that total mixes in reserve/standby time, which doesn't count toward the flight-duty limit at all.
The Banned Player Still Winning
5 banned players got paid a tournament prize dated after their ban_date — anti-cheat flagged them, but the payout pipeline never checked ban status before releasing money. 15 more banned players also have a prize on record, but they won it before they were banned — completely legitimate.
The Meter Reading That Went Backwards
6 meters logged a reading lower than their previous one with no replacement on file — usage can't go backward under normal billing, which points to tampering or a bad read. 10 other meters also show a lower reading, but those had a legitimate meter swap recorded on that same row.
The Vaccine Given Twice in One Day
5 pets got the SAME vaccine twice on the same day at two different clinic locations in the chain — a duplicate administration nobody caught because the two locations don't share real-time records. 8 other pets also have two vaccine records the same day, but they're two different vaccine types — a normal combo visit.
The Change Order Paid Without Approval
10 change orders were paid out while still pending or rejected — the payment run isn't actually checking approval status before releasing funds. 20 more change orders were paid under an approval_status of approved_verbal — a legitimate regional practice where a site manager approves by phone, not a violation.
The Canceled Subscription Still Streaming
12 accounts kept streaming after their paid_through date — well past the grace period they'd already paid for, meaning a device session token never got revoked. 18 more accounts also streamed after cancelling, but it was still before paid_through — completely legitimate use of access they'd already paid for.
The Book Checked Out After Being Lost
8 book copies show an active checkout recorded after they were marked lost — the catalog never actually pulled them from circulation. 12 more lost copies also show a checkout scanned after the lost date, but it was cancelled right away — staff caught the scanning error immediately.
The Comp Room Still Billed the Minibar
5 fully-comped reservations got a minibar or breakfast charge marked billed_to_guest — those categories are supposed to be included free for comp guests. 10 other comp reservations also got billed for something, but it was spa services, which were never part of the comp package.
The Fixed Rate That Changed Mid-Term
6 fixed-rate loans show a different applied_rate between two billing statements — a fixed rate is never supposed to change mid-term. A rate-lock bug re-priced these borrowers. 24 more loans also show the rate changing between statements, but they're variable-rate loans, which are supposed to reprice.
The Personal Training Session With No Trainer
10 personal_training sessions were billed at the PT rate with trainer_id left NULL — clients paid for one-on-one coaching that was never actually assigned to anyone. 40 group_class sessions also have trainer_id NULL, but that's normal — classes aren't tied to a single trainer in this system.
The Return Mileage Less Than Pickup
8 rental agreements have a return_mileage lower than pickup_mileage with no odometer reset on file — physically impossible under normal driving, points to odometer rollback or a data-entry swap. 12 more agreements show the same pattern, but the odometer was legitimately replaced during service that day.
The Trip Fare That Doesn't Match the Distance
10 standard trips traveled under 1km but charged a fare over ₹500 — way out of line with normal per-km pricing, suggesting a driver manually overrode the fare. 30 more short trips also have a high fare, but their fare_type is cancellation_fee — a flat fee for a rider who cancelled after the driver arrived.
The Restricted Donation Spent on the Wrong Program
10 donations restricted to a specific program had their funds allocated to a genuinely different program — a real violation of donor intent. 12 more restricted donations look mismatched on a strict string comparison, but the allocated program is the exact same one, just cased and padded differently.
The Rejected Applicant Who Enrolled Anyway
7 students whose application was rejected — with no approved appeal anywhere on file — show up enrolled for the term anyway. 8 more rejected students also enrolled, but they went through the appeals process and had their appeal approved, which is completely legitimate.
The Driver Logged Hours During Maintenance
8 trucks have driving hours logged while an out_of_service maintenance ticket was open — the truck should have been grounded. 12 more trucks also logged driving hours during an open ticket, but its severity was cosmetic — a minor issue that never took the truck off the road.
The Validated Ticket That Still Got Billed
10 parking sessions were charged an exit fee even though the merchant validation was still valid at exit time — the gate isn't checking validation status before charging. 20 more sessions were also charged despite having a validation on file, but that validation had already expired before the customer left, so charging those is correct.
The Vessel Departed Before Clearance
8 standard-clearance shipments physically departed port before customs clearance was ever recorded — a real compliance breach. 12 more shipments also show the same pattern, but they're pre_cleared — cleared in advance at origin, so departing before the destination-side clearance record is completely expected.
The Vote Counted From a Closed Precinct
6 in-person ballots were cast after their precinct's official closing time — the polling station should have already stopped accepting votes. 25 more ballots also show a cast_at after closing, but they're mail ballots, which run on a completely separate submission window not tied to precinct closing time.
The Guest Pass Used After Membership Cancelled
8 former members checked in to the space after their membership was cancelled, with no day-pass purchase covering that visit — the badge system never actually revoked their access. 15 more former members also checked in after cancelling, but each one has a matching day-pass purchase for that exact date.
The Silent Downgrade Wave
5 accounts had active_seats decline in each of the 3 months immediately before they cancelled — a slow bleed no single-month alert ever caught because each drop was small. 8 education-vertical accounts also show a multi-month seat decline, but that's a normal summer dip that fully recovers by September, and none of them ever actually cancel.
The Loyalty Tier That Never Downgrades
6 customers assigned gold status had spend collapse in every single quarter of 2024 — Q1 to Q4, each quarter strictly lower than the last — landing their annual total at ₹140,000, well under gold's ₹150,000 floor. No override on file, the tier-assignment cron never re-ran. 10 more gold customers show the identical quarterly collapse to the identical total, but they have a documented retention-team override.
The Rep Whose Rank Doesn't Match Their Revenue
REP-001 is officially ranked #1 for Q3 bonus purposes — but that ranking was computed from total revenue, which includes a single ₹900,000 one-time deal that policy says should never count. Recomputing rank from recurring revenue only, REP-001 actually sits at #5. REP-002 through REP-005 also each carry one huge outlier deal pushing them to the top, but theirs are genuinely recurring enterprise contracts — they legitimately belong there.
The Defect Rate Trending Up Undetected
LINE-A's rolling 4-week defect rate has climbed steadily for 12 weeks, from 2.0% to 9.0% — a real emerging quality problem. But the weekly QA report only ever compares this year to the same week last year, and last year had its own one-off supplier defect spike in those same weeks (up to 8.0%), so year-over-year this week reads as "+1 point, not alarming." Four other lines are flat at 2% all year on both the rolling and YoY view.
The Channel That Looks Efficient Only Because of Lag
content_seo's month-aligned CAC swings from ₹2,500 (looks terrible) to ₹100 (looks amazing) two months later, purely because its signups lag its spend by 2 months. Once spend is compared against signups from 2 months later, the channel's true CAC is a steady ₹500 all year. affiliate also has a bad-looking CAC, and it's tempting to write it off the same way — but its signups genuinely decline every month no matter what lag you test.
The Attrition Cohort That Isn't Random
The 2023-06 hire cohort — every one of them managed by MGR-007 — has only 40% voluntary retention at 12 months, versus ~90% for every neighboring cohort, and the departures start as early as month 2. The 2023-03 cohort also looks bad at 60% retention, but 6 of its 8 departures are tagged as layoffs from a company-wide restructuring, not voluntary attrition — filtering to voluntary-only clears it back to 90%.
The Aging Bucket That Skips a Step
5 invoices jump directly from the current aging bucket to 90+ between two snapshots that are a normal 7 days apart — skipping the 30 and 60 buckets entirely, with no missing-week excuse. That pattern means the invoice's true age was concealed. 12 more invoices also appear to skip a bucket, but that's because week 8's snapshot run never happened for anyone — a 14-day gap, not 7.
The Return Rate That's Actually a Size Problem
Size M returns at 36% across all 20 dresses in the category, versus 9-10% for every other size — invisible if you look at any single product's overall return rate, only visible once you group by size across the whole category. DRESS-21 also has a 40% return rate across all its sizes, which looks related, but its return_reason is uniformly color_mismatch — a different problem entirely.
The Cohort That Pauses Instead of Cancels
The official churn dashboard only counts cancellations in a subscriber's first month, and every cohort shows a clean 10% month-0 churn rate on that metric — including 2024-03. But 12 of that cohort's 30 subscribers paused in month 1 and quietly cancelled in month 3, well outside the reporting window. Tracing what happens after each pause shows 2024-03's real total churn is 50%, not 10%.
The Queue Time That Resets the SLA Clock
8 tickets get transferred to a second department right at hour 23 of their 24-hour SLA, then resolved 3 hours later — measured from that last transfer, a comfortable 3-hour resolution. Measured from when the ticket actually opened, it took 26 hours, a real breach the current reporting can never see. 10 other tickets are also transferred, but early, as normal triage — their true duration is a clean 21 hours either way.
The Listing Price That Creeps Up Then Drops
8 listings, all from AGT-003, get their price bumped up within 2 days of listing, then discounted back down to near the original price just 5 days after that — marketed as a big "sale" that's actually just walking the price back to where it started. 6 other listings from different agents show the same increase-then-decrease shape, but the gap is 90 days — genuine repricing after a long stretch with no offers.
The Discount Stacking That Bypasses the Cap
8 orders have 3 separate discount codes stacked — app promo, loyalty points, birthday coupon — summing to 37% of the subtotal, over the documented 30% max-discount policy. Each code was applied by a different system with no idea the others had already fired. 15 more orders have a single discount over 30% on its own, but it's a manager_comp code, explicitly exempt from the stacking cap.
The Readmission That Doesn't Count as a Readmission
10 patients came back within 3 days of discharge for the same issue, but their return visit was classified as observation instead of inpatient — off the books for the official 30-day inpatient readmission metric, even though it's a real readmission clinically. 8 more patients also have an observation visit after an earlier inpatient stay, but the gap is 60 days — an unrelated later visit, not a readmission.
The On-Time Rate That Ignores the Redefinition
The reported on-time delivery rate jumps from 65% to 95% at month 7 and stays healthy afterward — looks like a big operational win. It's entirely because a policy change added a 24-hour grace window to "on-time" starting month 7. Measured against the original strict definition, the true on-time rate keeps falling every month, from 90% down to 35% — the redefinition masked a steadily worsening trend, it didn't fix anything.
The Viewability Metric That Counts Empty Loads
PUB-07 reports 90% viewability — the best of any publisher — but only 0.4% of its viewable impressions ever get a real click or hover, versus 15% everywhere else. PUB-03 also engages below normal at 8%, but that's a documented older-demographic audience effect, not fraud. Only PUB-07's near-zero engagement despite top-of-class viewability is the real red flag — a prefetch load technically satisfying the viewability definition without a human ever seeing it.
The Pay Gap That Only Shows Up At Promotion
30 Group-B employees promoted from L3 to L4 started at the same salary as their Group-A peers, got a smaller raise, and landed at a genuinely lower ending salary for the identical level jump — 896,000 versus 960,000. 10 more Group-B promotions also show a smaller percentage raise, but they started from an already-higher base and land at the exact same 960,000 ending salary as Group A.
The Claim Frequency That Spikes Right Before Non-Renewal
12 non-renewing policyholders filed just 1 claim across the first 10 months of their policy, then suddenly filed 5 more in the final 2 months before lapsing — a rolling monthly claim rate spike far above their own baseline right before leaving. 8 more non-renewing policyholders show the exact same late-period spike, but every one of those late claims is tied to a documented regional flood event.
The Feature Adoption That's Actually One Team
Total monthly events for bulk_export grew from 400 to 5,025 over 6 months — a 12x jump reported as a huge adoption win. But distinct-account count barely moved, 61 to 66. Excluding just one enterprise account's automated integration script, volume only grew from 300 to 325. 5 other accounts also show growing API-integration volume, but each is a genuinely different customer onboarding their own integration.
The Safety Stock That Never Triggers a Reorder
6 product-warehouse combinations dropped below their reorder point in 3 separate weeks over a 10-week window and never once triggered a purchase order — not that week, not before, not after. 4 more combinations also dipped with no PO in the exact breach week, but recovered on their own because a PO was already placed back in week 1, well before the dip.
The Chargeback Rate That Hides in Aggregation
BIN 411111 has a 25% chargeback rate — 125 of 500 transactions — completely diluted into the merchant's overall 3.09% chargeback rate by volume from 19 other BINs. BIN 533221 also runs elevated at 8%, but that's a documented high-risk international BIN category that has always disputed more, not new fraud. Grouping by BIN instead of the merchant total is what surfaces the real breach.
The A/B Test That Peeked Too Early
Through day 3, variant B's cumulative conversion rate (9%) looks like a decisive win over variant A's 5% — nearly double. Running the cumulative rate out to the full 14-day test shows B's early lead was a novelty spike that fades: by day 14, B has fallen to 4.68% while A held a steady 5.00% the entire time. The day-3 leader completely reverses by the end of the test.
The Write-Off That Hides a Utilization Problem
The litigation practice group's write-off rate has climbed every single quarter — 5%, 10%, 20%, 35% — while total hours billed also grew, so the invoiced total still looked fine. The corporate group also had a high 25% write-off rate, but only in Q3, tied to one documented large client dispute — a one-off that reverts to 5% in Q4, not a trend.
The Jackpot That Resets the Streak
On MACHINE-042, a standard-tier slot, 6 players hit a 55-spin losing streak in a row — computed via the classic gaps-and-islands technique — far beyond what standard-tier variance should ever produce. Players on high-stakes machines regularly hit 17-spin losing streaks too, which sounds alarming, but higher variance is documented and expected for that tier. It's only a problem on a standard-tier machine.
The Demand Forecast That's Always Wrong the Same Way
The North region's 7pm forecast error has grown every month for 6 months — 50, 80, 120, 170, 230, 300 MW — a systematic and worsening under-prediction with no documented cause. The noon hour also shows a steadily growing error, but that one has a known_factors record explaining it: a new solar farm coming online, already factored into revised planning.
The Bundle Discount That Cannibalizes Full-Price Plans
Total subscriber count grew from 700 to 1,800 over 6 months and total revenue also grew, from 560,000 to 890,000 — both headline numbers look like a win. But revenue-per-subscriber fell from 800 to 494, a 38% decline, because nearly all the subscriber growth is low-revenue bundle accounts diluting the base of full-price standalone accounts. Neither raw metric alone shows it — only tracking the ratio over time does.
The Enrollment Yield That's Backwards
Measured 30 days before the deposit deadline, digital_ads looks like the worst recruiting channel by far — 22.5% yield versus counselor_referral's 85%. Digital_ads applicants just decide late: by the actual deadline, digital_ads finishes at 90% yield, the single best channel, while counselor_referral ends at 89%. campus_visit also improves between snapshots (75% to 80%), but its rank never changes — only digital_ads flips from worst to best.
The Carrier Rate That's Cheaper Only on Paper
CheapFreight's quoted rate (5,000) has looked cheaper than PremiumLogistics's (6,000) every month. But CheapFreight's fuel surcharge climbed steadily every month — 200 to 2,200 — while PremiumLogistics's stayed flat at 100. By month 6, CheapFreight's true cost (7,200) is well above PremiumLogistics's (6,100). Some CheapFreight shipments also carry a one-off oversize handling fee in months 5-6, but the fuel surcharge alone was already climbing from month 1.
The Return Fraud Ring Hiding in Plain Sight
Five customer accounts all have unusually high return rates. So does CUST-0042, but that one's legitimate — every return has scanned tracking and a wrong_size reason. The other five share the exact same payment card and device ID across "different" accounts, and every single one of their returns has tracking_scanned = false: they never shipped anything back.
The Ghost Contractor Payroll
CTR-014's contract ended February 28th with no extension on file, but invoices for "hours worked" continued monthly through October — 8 months of payments to someone whose contract had ended. Every one of those invoices was approved by a manager who themselves departed the company on March 1st. 6 other contractors also have invoices past their original end date, but each has a documented extension on file.
The Recall That Should Have Happened Sooner
14 defect reports across 4 plants all reference the same supplier lot — but the lot number was typed inconsistently into a free-text field ("LOT-4471", "lot 4471", "Batch#4471") and every plant used a different symptom label. Normalizing the text and matching it to supplier_shipments traces all 14 to one shipment from Supplier SUP-09. 9 more reports mention a lot number too, but trace to a completely different, already-resolved lot.
The FX Hedge That Was Never Actually Hedged
Treasury reported being fully hedged all year, but USD/COP exposure grew to 8,000,000 by month 6 while zero hedge notional was ever booked against USD/COP. Instead, 500,000/month sits booked against USD/CUP — Colombian Peso confused with Cuban Peso — where it does nothing, since there's no real CUP exposure. USD/MXN, a similarly-named pair, is genuinely and fully hedged every month.
The Enterprise Deal That Was Never Actually Signed
DEAL-BIGCO is marked closed_won for 500,000 and its revenue was recognized — but contract_status has been stuck at "sent" the whole time, never countersigned. The actual cash received was only 15,000, and that amount exactly matches a small, separate add-on purchase order — not the big deal. 6 other closed_won deals also show contract_status "sent," but each has a cash receipt that exactly matches its deal amount, signed through a different e-signature system.
The Employee Discount That Became a Resale Operation
EMP-042 bought 5 units of HEADPHONE-X on four separate occasions with no authorization on file. Each purchase is followed within 2-3 days by a marketplace listing under "quicksale99" — EMP-042's known alias — for the exact same SKU and quantity. EMP-018 also bought 20 units of one SKU in a single large purchase, which looks similar, but it has a documented manager authorization and no matching listing exists anywhere.
The Trial Data That Was Quietly Adjusted
SITE-07 reports the lowest adverse-event rate of any trial site. But 9 of its patients were "withdrawn" just 1-3 days before their scheduled follow-up visit — the exact visit where an adverse event would most likely surface. SITE-03 also has a low rate, but its patient population is documented as younger and healthier, and its withdrawals aren't clustered before follow-ups at all.
The Grant Money That Funded Something Else
GRANT-088's approved categories are reagents, animal_care, and publication_fees — supplies isn't even approved. But 6 expenditures were coded to supplies anyway, with descriptions like "Laptop - Dell XPS 15" and "Monitor 27-inch 4K" — equipment with nothing to do with the grant's research scope. 8 more supplies entries also sound generic, but they're small-dollar consumables like pipette tips and petri dishes, legitimately in scope.
The Container That Was Never on the Ship
5 containers are marked departed with zero gate scans on record — never physically scanned into the port at all. All 5 were filed by the same agent, AGENT-07. 8 more "departed" containers also look suspicious — their gate scan happened several hours after the manifest cutoff — but a scan did happen, just delayed by normal processing backlog.
The Loan Portfolio That Was Riskier Than Reported
7 loans show a payment posted 1 day before every single month-end snapshot, then reversed 1 day after — every month, for 6 months straight. Excluding those round-trip payments, these loans are delinquent every single month. 5 more loans also have a reversal on file, but it's a single one-off NSF bounce mid-month, unrelated to the reporting date and not repeating.
The Near-Miss Reports That Stopped Coming From One Shift
Shift C's near-miss reports dropped to zero right after a new supervisor took over — but workers'-comp claims for Shift C stayed exactly as frequent as before. If safety had improved, claims should have dropped too. Nearly every missing report would have named EQUIPMENT-42, which the new supervisor also controls the maintenance budget for. Shift A also saw reports drop, but its claims dropped too — a real improvement.
The Matching Gift That Was Claimed Twice
6 employer_gift_ids show up in match_requests submitted by two different nonprofits, for the exact same amount and date — the same corporate-match dollar drawn down twice for one gift. 9 more cases show the same donor submitting to two different nonprofits close in time, but those are genuinely separate donations, each with a distinct employer_gift_id and a different amount.
The Franchise Royalty That Was Underreported
6 franchise locations under-report sales versus the POS system's own totals, but only on Saturdays and Sundays — weekdays match almost exactly. Weekends are when those locations switch to a manual end-of-day tally instead of the automatic POS export. LOC-014 also shows a mismatch on one Tuesday, but that date has a documented POS outage — a real system gap, not underreporting.
The Outage That Was Caused By The Fix For The Last Outage
4 incidents over 6 months are tracked as independent, unrelated events — but each one's fix deployment directly caused the next incident weeks later. INC-01's fix caused INC-02; INC-02's fix caused INC-03; INC-03's fix caused INC-04. It's one long causal chain, not four separate problems. INC-02B looks like it could belong to the same chain by symptom category, but its root cause traces to a completely unrelated service.
The Adjuster Who Always Approved Right at the Limit
ADJ-07 approves claims across 4 different claim types clustered 95-98% of the secondary-review threshold — a statistically implausible pattern spanning varied claim types, with 4 claimants repeating across different policies. ADJ-12 also clusters near a threshold, but exclusively handles windshield_replacement claims — a claim type with a naturally fixed cost near that threshold for any adjuster, documented and expected.
The Employee Paid Twice For The Same Pay Period
A failed payroll batch on May 15th got re-run without anyone rolling back the first attempt. Finance just noticed 4 employees have two separate "regular" deposits for the exact same May 31st pay period — same amount, same period, paid out twice. A few employees also show a second May payment, but that's their quarterly bonus, not a duplicate — don't flag those.
The Coupon Used After It Expired
Finance is asking why SPRING20 kept getting applied after its expiry date. 7 orders used it between May 1st and May 2nd — a full day or more after it expired on April 30th at midnight. There's also a batch of WELCOME10 orders that look "late" too, but marketing extended that one's deadline in writing — check the extensions log before you flag it.
The Gym Membership Charged After Cancellation
Billing support is fielding angry calls — 5 members who cancelled were still charged $49 on the next cycle. The billing job reads member status at the start of the day, so cancellations processed same-day slip through by one extra run. Some members do show a charge on their exact cancellation day, but those charges happened hours before they cancelled — leave those alone.
The Pallet Marked Delivered Twice
Ops flagged inflated delivery counts on Route 03. Turns out 5 pallets have two separate "delivered" scans logged seconds apart — a handheld scanner glitch double-fired when the signal dropped mid-scan. Don't confuse this with pallets that have a delivered scan AND a later returned scan — that's a real return, not a duplicate.
The Security Deposit Refunded To The Wrong Tenant
A tenant called asking where their deposit went — someone else got it. Turns out 4 lease deposit refunds were paid to a tenant_id that has nothing to do with that lease, after a property manager processed refunds from a spreadsheet with rows shifted by one. There are also refunds going to a "different" tenant on a few units, but those are the unit's previous tenant correctly getting their own prior deposit back.
The Parking Garage That Undercharged Overstays
Revenue audit found 6 vehicles that stayed 7-9 hours but were still billed the $15 flat rate instead of the hourly overstay rate — all entered between 2-3am, exactly when the exit kiosk's clock-sync job runs and its overstay check silently fails. Some cars stayed just 5-15 minutes past the 4-hour mark and were also billed flat rate — that's correct, the garage has a documented 20-minute grace period.
The Library Fine Still Accruing On A Returned Book
A patron disputed a $55 fine on a book she returned weeks ago. Turns out 5 checkouts have a returned_at date on file but their fine status is still "accruing" — the fine-closing job only triggers off due_date passing, not off the actual return, so a handful of returned books keep silently racking up charges. Books that are genuinely still out with a NULL returned_at and an accruing fine are correct — leave those.
The Baggage Fee Charged Twice
A passenger complained about being charged $35 twice for the same bag. Support found 5 bookings where the exact same bag_sequence_number was billed twice, seconds apart — the kiosk bag-tag printer double-submitted the charge on a printer jam retry. Passengers checking two actual bags also show two charges on one booking, but those are different bag_sequence_numbers — two real bags, not a duplicate.
The Maintenance Ticket Closed Before The Technician Arrived
Facilities audit found 6 tickets where closed_at is earlier than the technician's own arrived_at timestamp on the same ticket — all logged by the same contractor, TECH-09, who appears to have been pre-closing tickets to hit an SLA dashboard target before actually showing up. A few tickets show the fix closed just 3-5 minutes after arrival — that's a genuinely fast fix, not a red flag.
The Customer With Two Accounts And One Email
Loyalty points support ticket: a customer says her points are "missing" — turns out she has two accounts because the signup form never normalized email casing or trims whitespace. 5 people have two accounts each where the email is identical once you lowercase and trim it (e.g. "[email protected]" vs "[email protected] "). A few unrelated people just happen to share a display name with genuinely different emails — that's a coincidence, not a duplicate.
The SIM Swaps That Always Preceded a Roaming Spike
4 lines (LINE-101 through LINE-104) each had a SIM swap processed by the same retail agent, AGT-114, and within 90 minutes of every swap a burst of expensive roaming usage began in Nordholm — a country none of them had ever roamed in before — racking up $6,506.55 in wholesale charges. Each line was swapped back within 48 hours, before the billing cycle closed. LINE-205 also has $1,190.25 in Nordholm roaming, but its only SIM swap was 214 days earlier — a routine device upgrade, unrelated to the roaming.
The Urgent Care Group Billing Above Its Own Triage Notes
3 providers inside "Metro Urgent Care - Group C" (PROV-C1, PROV-C2, PROV-C3) bill the highest-severity E/M code, 99285, on 42 encounters their own triage notes marked as low or moderate acuity — $14,490.00 in overbilling above what the acuity actually supports. Dr. Okafor at the trauma center also bills 99285 constantly, but his case mix is genuinely critical/high acuity on every one of his encounters — zero mismatches, not upcoding.
The Damage Deductions With No Repair Behind Them
Property manager Rosa Kim (MGR-04) withheld "damage_repair" deductions from 6 tenant deposits across her 5 properties, totaling $4,095.00 — but not one of those deductions has a matching vendor invoice on file. No repair vendor was ever paid. MGR-03 also withheld a large $1,100.00 damage_repair deduction on one lease, but it has a matching invoice from ProFix Contractors for the exact same amount — a legitimate repair, not skimming.
The Facility That Got Paid To Curtail Load It Never Cut
FAC-07's declared pre-event baseline (850.00 MW) has no relationship to its actual 10-day trailing average at the event hour (419.0 MW) — the baseline was padded right before the event. Its real load during the event (600.00 MW) was actually higher than its historical typical load, meaning it cut nothing, yet it was paid $45,000.00 for a fabricated 250 MW reduction. FAC-03's declared baseline (595.00 MW) also sits well above its full 10-day average (538.4 MW), but its load was climbing steadily day over day — against just the most recent 3 days (570.0 MW avg) the declared baseline is a close, reasonable match. Legitimate growth, not padding.
The Pilot Who Was Never Actually "Positioning"
CAPT-08's roster logs one codeshare flight per duty day as "positioning" (deadheading, excluded from duty-time limits) on 2024-03-05, 2024-03-12, and 2024-03-19 — but the codeshare manifest shows CAPT-08 was the actual operating crew on all three. Recounted as operating duty, CAPT-08's total duty time hits 14.50, 14.25, and 14.25 hours on those three days — over the 14-hour limit every time. CAPT-11 also has a "positioning" codeshare leg, but the manifest shows PARTNER-CREW-22, not CAPT-11, actually operated that flight — genuinely deadheading, no violation.
The Warranty Claims That Only Made Sense At The Rolled-Back Mileage
4 vehicles show odometer mileage that decreases between a service visit and the later trade-in appraisal — physically impossible without a rollback. Each was sold certified pre-owned at the rolled-back mileage, and warranty claims worth $8,605.00 combined were filed shortly after, claims that would have been denied outright at the true, pre-rollback mileage (all above the 60,000-mile warranty cap). Only 2 customer IDs — CUST-R01 and CUST-R02 — file all 4 claims, rotating across the 4 "different" vehicles. One other VIN also shows a mileage drop, but from an obvious 999999 keypunch typo down to 45,200 in a single correction with no warranty claim after — a data-entry fix, not a rollback.
The Comps That Exactly Covered What Went Missing
LOC-09's Ribeye 12oz shrinkage on two counts — 24 units on 2024-06-30, then 21 units on 2024-07-31 — is matched almost exactly, unit for unit, by a burst of manager-comp transactions for the very same item logged by the very same manager, MGR-22, the day before each count: $832.50 in "comps" that's really theft relabeled as free food. LOC-04 also has a large comp spike ($360.00, 30 transactions) the day before its count, but those comps are all Reserve Wine, and that count shows zero Ribeye shrinkage — a Valentine's Day wine promotion, unrelated to any missing inventory.
The Change Orders That Always Landed Just Under The Limit
PM-06 approved 4 change orders for vendor VEN-14 — $24,100, $24,600, $24,850, and $24,300, totaling $97,850.00 — every single one just under his $25,000 sole-approval authority, avoiding the second-signature review a single larger change order would trigger. VEN-14 also charges $185.50 per cubic yard of concrete on PM-06's projects on average, versus $132.00 on every other PM's project with the same vendor — 40% higher, only for PM-06. PM-11 also approved 3 change orders for VEN-22 clustered just under the $25,000 threshold, totaling $73,350.00, but VEN-22 charges the identical $95.00 per unit to every PM, including PM-11 — a vendor whose standard job package happens to price near that number, not a kickback.
The Inspector Whose Grade A Never Survived The Retest
Inspector INSP-05 declared 7 deliveries from FARM-12 as grade_a — but the independent lab retest on every single one of those 7 came back grade_b. At $50/ton more for grade_a than grade_b, FARM-12 was overpaid $6,900.00 across 138.0 tons. Inspector INSP-09 also grades generously, declaring grade_a on 5 deliveries from FARM-20, but the lab retest agrees with grade_a on all 5 — genuinely high-quality grain, not inflation.
The Attorney Who Billed More Hours Than A Day Has
ATT-07 logs suspiciously round, block-billed time entries across multiple different matters on the same day — and on 3 specific dates, summing every entry for that day totals 26.0, 27.5, and 25.0 hours. A day only has 24. That's 6.5 hours of billed time, worth $2,925.00 at his $450/hour rate, that could not possibly have been worked. ATT-12 also logs long days — 16.0 to 18.0 hours during a trial — but never once exceeds 24 hours in a single day. A genuinely overworked attorney, not a billing impossibility.
The Token That Pumped Itself
4 accounts (ACC-R1 through ACC-R4) traded the low-liquidity token ZYNC back and forth in identical 500-unit lots, each one's sell absorbed by the next ring account's buy within 1-3 minutes, with the price ratcheting up every hop — $1.00, $1.05, $1.12, $1.20, $1.35 — a 35% price increase on 4,000.00 units of pure self-traded volume in 11 minutes, immediately before ACC-R4 cashed out 500 ZYNC to a real external buyer (ACC-0031) at the inflated $1.35. ACC-0031 also moved the price with a large trade, but it was a genuine one-directional buy absorbing the ring's final sell, not a back-and-forth pattern with anyone.
The Five Vendors Who Always Bid Within 5% Of Each Other
On 5 recurring annual signage contracts, the same 5 vendors (VEN-A through VEN-E) bid every time, the winner rotates in a strict round-robin — A, then B, then C, then D, then E — and every losing bid sits within 2.0-5.2% of the winner on every single contract. 5 comparable one-off contracts with unrelated vendors show a 10.0-44.4% spread instead. VEN-F also bid within 2% of a winner once, on one-off contract K6, but VEN-F never appears in the recurring group — one close bid on one contract isn't a repeated pattern.
The Driver Whose Truck Was Always Lighter Than It Really Was
Driver DRV-14 logged a tare (empty truck) weight 900-1,300 lbs below the actual certified tare weight on 6 tickets, across 3 different trucks — inflating the billable net weight on every one. That's 6,450 lbs (3.225 tons) of fabricated waste weight, worth $154.80 in inflated tipping fees at $48/ton. Because it follows the driver across different trucks rather than staying with one truck, it can't be a scale calibration issue. TRK-07's recorded tare also varies by up to 250 lbs across different drivers, but that's normal fuel-level variance on a single truck, not under-recording tied to one person.
The Expiry Dates That Were Extended After They Already Passed
5 lots (L-3001 through L-3005) had their expiry date extended by the same reviewer, QA-REV-3, 14 to 26 days AFTER the original expiry date had already passed, then shipped within days of the extension. Those 5 lots generated 17 complaints afterward, versus a near-zero background complaint rate on lots that were never re-dated. Lot L-4010 also has an expiry_update, but it was requested 60 days BEFORE the original expiry — a proactive stability-testing extension, reviewed by a different QA reviewer (QA-REV-7), and generated zero complaints.
The Artist Whose Plays Were Mostly "Promotional"
Nova Ashworth (ARTIST-11) has 61.87% of her plays classified as "promotional" (which pay no royalty) — flat and consistent across all 6 months — versus a 5.96%-6.95% peer baseline (avg 6.62%) among 5 comparable artists. Reclassified to the peer-baseline ratio, she's owed $5,432.61 in underpaid royalty at $0.003/play. Wren Castellano (ARTIST-19) also shows an elevated overall promotional ratio (42.6%), but broken out by month, it's a normal ~7% every month except March 2024, which spikes to 82% during a documented radio promo campaign — explained, not misclassification.
The Proctor Whose Failing Students Kept Getting "Corrected"
Proctor PROC-06 personally logged 9 post-exam "scanning error correction" score changes, every one bumping a raw score of 66-69 up to exactly 70 or 71 — just over the 70-point passing threshold — and self-approved all 9 himself. No other proctor comes close. PROC-11 also has a batch of score changes, but it's a 15-student blanket +2 regrade for an invalidated exam question, applied to everyone in that session (6 already passing, 9 failing alike), logged by the academic office, not the proctor — not selective, not a conflict of interest.
The Two Devices Behind Four Different Players' Win Streaks
ACC-P1 through ACC-P4 each had a short window where every match was logged in from one of just 2 shared devices — DEV-BOOST-01 or DEV-BOOST-02 — during which they won every single match and climbed a full rank tier, then switched back to their own normal device afterward. DEV-BOOST-01 serves both ACC-P1 and ACC-P2 at different times; DEV-BOOST-02 serves both ACC-P3 and ACC-P4 — a boosting-for-hire ring, not 4 unrelated hot streaks. ACC-P9 also switched devices during a win streak, but DEV-P9-LAPTOP never appears under any other account — a genuine second personal device, not a shared booster rig.
The Fuel Purchases Made 270 Miles From Where The Truck Was
6 of DRV-22's fuel card transactions happened 230-310 miles from where his own GPS log placed his truck within 10-15 minutes of the purchase — $2,633.00 in fuel bought somewhere the truck demonstrably wasn't. DRV-30 also has a transaction with a large mile gap to the nearest GPS reading, but that reading is 6 hours away in time — his GPS logger was simply offline that day, not a same-time contradiction.
The Employee Who Comped Stays At Properties On The Same Day
Employee EMP-204 issued 6 "goodwill service recovery" point adjustments to just 3 members — 92,000 points total — and on 3 separate dates, logged adjustments at two different properties on the very same day, which one front-desk employee cannot physically do. None of the 3 members has any stay record at all at the property their adjustment was issued for. EMP-311 also issued a goodwill adjustment, to MBR-045 at property P-07, but MBR-045 has a real stay on file at P-07 right before it, and it's EMP-311's only adjustment — a genuine service recovery, not fabrication.
The One Name Behind Four Unrelated Policyholders' Payouts
4 unrelated policies (POL-101 through POL-104) each had a beneficiary change 20-36 days before a death claim was filed, every one processed by the same agent, AGT-88, and every one naming the exact same person, Denise Okonjo-Hart, as the new beneficiary — $845,000.00 in combined payouts to one person across 4 "unrelated" policyholders. POL-205 also had a beneficiary change 30 days before its claim, but the new beneficiary, Marcus Websley, shares the policyholder's own last name and is on file as her son, and a different agent processed it — a normal family beneficiary update, not fraud.
The Rebuilt Wrecks Insured Like They Were Never Wrecked
5 vehicles have a salvage record (a prior total-loss claim) dated before their current policy started, yet all 5 policies mark salvage_disclosed = false and insure the vehicle at full, undiscounted value — $115,600.00 in exposure the insurer never should have carried. All 5 were written by the same agent, AGT-19, who should have caught the VIN history. VIN-LEGIT-01 also has a salvage record before its policy, but that policy correctly marks salvage_disclosed = true and insures it at a discounted $11,200.00 — properly handled, not fraud.
The Jewelry Store Billed Like A Grocery Store
4 merchants (MER-101 through MER-104) are registered under MCC 5411 (Grocery Stores, 1.2% interchange), but their business license on file shows "Jewelry & Watches" (2.5% interchange) with no compliance exception approved — $2,795.00 in underpaid interchange across $215,000.00 of transaction volume. All 4 were onboarded by the same sales rep, REP-08. MER-022 also shows a registered MCC that does not exactly match its license category ("Grocery & Pharmacy Combo"), but that combo category has a documented, approved compliance exception keeping it at the grocery rate — not a misclassification.
The Recruits Who Never Set Foot On A Team
6 applicants (APP-501 through APP-506) were admitted under the 'athletic_recruit' category — bypassing the standard 1200+ SAT threshold with scores of 860-940 — and none of them has ever appeared on any athletic roster: no tryout, no team, nothing. All 6 were approved by the same admissions officer, OFF-04. APP-777 was also admitted as an athletic_recruit by OFF-04 and never appears on a roster either, but there's a documented injury_disqualifications record showing she was medically disqualified after enrollment — a real recruit who got hurt, not a laundered admission slot.
The Chargebacks For Shipments That Arrived Perfectly Fine
Vendor VEN-33 was hit with 5 chargebacks totaling $4,085.00 citing "late_shipment" or "quantity_shortage" — but every one of those 5 shipments has received_qty equal to expected_qty and on_time = true. The shipments were perfect; the violations were fabricated. All 5 were approved by the same compliance rep, REP-CB-06. VEN-08 also has a chargeback, but its shipment shows a real shortage (480 of 600 units received) and a real late delivery — the chargeback matches what actually happened.
The Tramadol Refills That Never Matched The Days Supply
"Rex" (PET-014, owner Castillo) was prescribed a 30-day supply of Tramadol, a controlled substance, but was refilled 6 times in exactly 6-day intervals, rotating across 3 different clinics (CLINIC-A, CLINIC-B, CLINIC-C) so no single clinic's records would show the pattern. "Milo" (PET-099) is also refilled frequently — every 10 days on a 10-day-supply prescription — but it's Insulin, not a controlled substance, the cadence exactly matches the days_supply, and it's always the same clinic. Normal chronic-condition management, not shopping.
The Warranty Claims Paid For Parts That Never Shipped Back
Dealer DLR-11 filed 5 warranty claims marked core_returned = true — required to collect the $150.00 core charge on top of the repair reimbursement — but not one of those 5 claims has a matching core_return_shipments record. No tracking number, no shipment, nothing. $750.00 in core charges was paid for parts that were never actually sent back for inspection. DLR-06's claim is also marked core_returned = true and the matching shipment arrived 11 days later than usual, but it did arrive, with a real tracking number on file. Slow, not fabricated.
The Operator Badge Riding Free On Every Route But His Own
Operator EMP-19 is assigned to Route-07, where his transit card's $0.00 employee-duty exemption is supposed to apply — but his card tapped $0.00 fare 8 times across 5 completely different routes (Route-01 through Route-05), never once on his own assigned route. EMP-22 also taps $0.00 fare frequently (8 times), but every one of his free taps is on his own assigned route, Route-12 — a normal duty commute exemption.
The Agent Charging Nearly Double The Standard Commission
Agent AGT-07 charges a 35% commission on his talent's domestic bookings — versus the agency-standard 20% rate every other agent applies to domestic work — quietly pocketing the extra 15% across 5 bookings worth $21,600.00 in gig fees, a $3,240.00 skim. Agent AGT-14 charges 25% too, but only on international bookings, which carry a documented, higher 25% agency-standard rate due to added logistics — matches policy exactly, not a markup.
The Invoice For Compute Instances That Never Existed
CUST-08 was billed for 12 compute instances every month for May, June, and July 2024 — but provisioned_resources shows only 7 distinct instances were ever active in any of those months. The same 5-instance gap, every month, at $85/month each: $1,275.00 in phantom compute billed across the quarter. CUST-15 was billed for 10 instances in May and only 3 were running on any single spot-check day — but counting every distinct instance active at any point that month (a short autoscaling burst added 7 more for a few hours on May 15th) totals exactly 10. The bill matches the month's real usage.
The Crew Paid Per Diem On Two Productions The Same Day
4 crew members (Jonas Whitfield, Priya Deol, Marcus Oyelaran, Dana Iverson) were paid per diem on both Prod-Alpha and Prod-Beta for the exact same 4 dates each — physically impossible, since per diem covers being on set that day. That's 16 duplicate claim-days, $1,360.00 double-paid, all approved by the same line producer, LP-05, on both productions. Elena Bryce also claims per diem on both productions, but her Prod-Alpha dates (May 1-15) end before her Prod-Beta dates begin (May 20-June 5) — sequential work, not a double-claim.