Casefile: Fraud Investigation Tooling

Fraud Ops tracked suspicious-track investigations in shared spreadsheets. Status was ambiguous, ownership unclear, and there was no audit trail.

One track could have several open investigations with conflicting status. Partial takedowns (some platforms, not others) and reinstatements were coordinated by hand.

No formal user testing. I ran design reviews with the people doing the work: walkthroughs and explorations with Fraud Ops and the A&R team, iterating on their feedback.

Phase 1 went to a small Fraud Ops group behind a feature flag. Real cases exposed a gap: marking a track reinstated didn't restore payments or distribution.

Two views, one record. A&R flags tracks and checks status without seeing sensitive case data. Fraud Ops gets the full case: actions, history, and activity log.

One investigation per track. Duplicates caused conflicting status, so a second investigation is blocked and the request button hides while one is open.

Don't tip off fraudsters. Takedowns can notify the artist or distributor, but notifications default to off, and the chosen reason sets the message.

Reinstatement in phases. A checklist now, per-platform restore next, automation later. The tool names the gap instead of hiding it.

Investigations moved out of spreadsheets into one record per track, with status, owner, and history in one place.

Activity logs give Fraud Ops the audit trail spreadsheets never had.

Usage wasn't instrumented, so the result here is the workflow change, not a metric.

Lead designer: both views, the investigation and takedown flows, and the reinstatement plan.

Worked with Fraud Ops, the A&R team, an ops product lead, and engineering. Phase 1 was demoed in October 2025 and runs behind a feature flag.