Model Diagnostics / Top-K Alerts / ENT-4821 — Margaret Winslow
MW
Margaret Winslow
ENT-4821 · Account: 5830174296O3 · Brampton, ON
Alert Rank #1 6/6 Models Flagged Romance Fraud Pattern 4 Channels Active
0.95
Consensus Anomaly Score
Rank 1 of 1,247 entities
Restaurant Server
$38,000 / yr
$28,700
7.5x baseline
2019-03-14
Jun - Nov 2025
94
EMT, Wire, Cash, Connex

Model-by-Model Scores

All Flagged
CAVE
0.94 #1 rank
CWAE
0.92 #2 rank
Deep IF
0.91 #3 rank
Extended IF
0.90 #4 rank
Isolation Forest
0.88 #5 rank
AE
0.86 #6 rank
All 6 models agree this entity is highly anomalous. CAVE and CWAE (contextual models) score highest, detecting behavioral patterns. Even IF (tabular-only) scores 0.88, suggesting both point and contextual anomalies are present.

Feature Attribution (Consensus)

Signed Relevance
← Mitigates risk Increases risk →
Rapid in/out pattern
+0.84
Intl wire volume
+0.76
EMT source diversity
+0.68
Cash structuring
+0.61
Volume/income ratio
+0.55
Account tenure
-0.24
Legitimate POS activity
-0.15

Transaction Timeline

94 Transactions · Jun-Nov 2025
Jun 2025
Jul 2025
Aug 2025
Sep 2025
Oct 2025
Nov 2025
EMT (34)
Wire (14)
Cash (20)
Connex (26)
Suspicious
Dot size = transaction amount · Hover for detail
Pattern: Escalating EMT inflows from multiple unrelated senders (top of chart, growing larger), followed by outbound international wires to West Africa (middle, red dots, also escalating). Cash deposits consistently just below $10K CTR threshold. Bottom row is legitimate POS noise (small, regular).

Channel Breakdown

4 Channels
ChannelTxnsVolumeAvgFlag
EMT
 34 $18,450 $543 12+ unique senders
Wire
 14 $42,300 $3,021 West Africa outbound
Cash
 20 $87,600 $4,380 Structured <$10K
Connex
 26 $1,240 $48 Normal POS

Typology Assessment

Romance Fraud
Placement
0.88
High
Layering
0.91
High
Integration
0.50
Medium
Structuring
0.78
High

Red Flag Indicators

8 Flags Detected
⚠
Rapid in/out pattern: EMT deposits followed by international wires within 24-48 hoursHigh
⚠
International wires to West Africa (Nigeria, Ghana, Ivory Coast, Burkina Faso)High
⚠
12+ unrelated EMT senders with no apparent relationship to account holderHigh
⚠
Cash deposits structured just below $10,000 CTR threshold ($9,500-$9,900)High
⚠
Escalating wire amounts: $2,500 → $3,200 → $3,800 → $4,200 → $5,000High
⚠
Transaction volume (7.5x baseline) inconsistent with declared income of $38KHigh
⚠
Emotionally coded EMT messages suggesting manipulationMed
⚠
Asset depletion pattern: savings declining while outbound wires increaseMed

Investigation Narrative

AI Generated
Chain-of-Thought Reasoning

Margaret Winslow, a restaurant server in Brampton, ON with declared annual income of $38,000, exhibits a transaction pattern strongly consistent with romance fraud money mule activity.

Over the 6-month observation period (Jun-Nov 2025), her account received 34 EMT transfers from 12+ unrelated senders totaling $18,450, with amounts escalating from $200-$450 to $1,500-$2,000. These inflows were consistently followed within 24-48 hours by outbound international wires to West Africa (Nigeria, Ghana, Ivory Coast, Burkina Faso), totaling $42,300 across 14 transactions.

Cash deposits of $9,500-$9,900 (just below the $10,000 CTR threshold) suggest deliberate structuring. Her 3-month transaction volume of $28,700 represents 7.5x her expected baseline given her income profile.

The small, regular POS transactions (Tim Hortons, Sobeys, Petro-Canada, Shoppers) at $6-$78 are consistent with legitimate daily spending and serve as noise cover for the suspicious flows.

Recommendation: Escalate for STR filing. FINTRAC Project Chameleon indicators matched (4 of 7). Priority: HIGH.