Casefile: Fraud Investigation Tooling

A&R could flag a track as suspected fraud, but the flag led nowhere. Fraud Ops tracked cases in a spreadsheet, and case history sat in general artist notes, mixed in with A&R notes.

Enforcement happened by hand in other admin tools: takedowns on some stores but not others, distribution removal, payment blocks, and reinstatements.

No formal usability testing. We worked with the people doing the work: a walkthrough Fraud Ops recorded of a real investigation, design reviews and a feedback session with Fraud Ops, bug bashes, and a production test in August 2025 where operators worked real cases.

Testing caught what reviews missed. In the July 2025 bug bash I found that re-requesting a case wiped its history and reset its status. Fraud Ops asked to choose which stores to restore to, in June and again at the August production test.

Two views, one record. A&R flags tracks and checks status without seeing sensitive case data. Fraud Ops gets the full case: actions, history, and activity log.

One case per track. My bug-bash find led to this rule: the request action is disabled while a case is open, so each track keeps one case and one history.

Reinstatement as separate actions. Reinstated was already a status, but it only changed a label. I designed the reinstate flow: the operator picks what to undo (the track, distribution rights, payments) and leaves a reason, and the system carries out each one. So an operator can unblock payments and keep a track down. Restores are per store.

A&R-flagged cases moved into one record per track, with status and history in one place.

Activity logs give Fraud Ops the audit trail spreadsheets never had.

Fraud Ops opened cases in it from launch week, and pointed the team back to it when an automated check went down.

Nobody has pulled a usage readout beyond launch week, so the result here is the workflow change, not a metric.

Lead designer from first concept to launch: the Fraud Ops view, what we added to the existing A&R view, the investigation and takedown flows, and reinstatement.

Our design director co-led the first concept round with me. I worked with a PM, Fraud Ops, the A&R team, and engineering. Casefile went live to Fraud Ops on September 10, 2025, after a production test in August. The investigation view is limited to Fraud Ops.