| ID | Subject | Typology | Verdict | Risk | Actions proposed | Status |
|---|---|---|---|---|---|---|
| FR-2291 | Refund diversion via lookalike booking portal | Account takeover | Malicious | 96 | Freeze refunds · reset creds · preserve evidence | Payments frozen |
| FR-2288 | Loyalty-points resale ring (6 accounts) | Points abuse | Malicious | 91 | Suspend accounts · notify loyalty ops | Escalated |
| FR-2285 | Supplier invoice — "ProServ Catering" | Invoice fraud | Suspicious | 64 | Hold payment · verify bank change letter | Under review |
| FR-2283 | Card-testing burst — Cape Town properties | Card testing | Malicious | 88 | Block BIN range · alert acquirer | Blocked |
| FR-2281 | Guest chargeback cluster — Durban | Friendly fraud | Suspicious | 57 | Compile evidence pack for acquirer | Evidence pack |
| FR-2279 | Front-desk refund above limit — Umhlanga | Insider misuse | Suspicious | 49 | Dual-approval rule · supervisor review | Under review |
| FR-2277 | New device — finance controller login | Credential misuse | Clean | 12 | None — verified with user | Closed |
| FR-2274 | OTA commission reconciliation delta | — | Clean | 8 | None — timing difference | Closed |