Workspace / Northwind PSP / Rules / Geo jump then large withdrawal
⌘K
read-only
SK

Geo jump then large withdrawal

shadow v1

Cross-stream rule: device geo-jump immediately preceding a large card withdrawal.

by seed

Original English

If a device emits a high-severity geo_jump signal and that user attempts a card withdrawal of $1,000 or more within 15 minutes, force a 3DS challenge.

Compiled AST

{
  "name": "Geo jump then large withdrawal",
  "action": {
    "sink": "routing",
    "params": {
      "verb": "force_3ds",
      "reason": "geo_jump_then_card_withdrawal"
    }
  },
  "stages": [
    {
      "id": "geo_jump",
      "type": "accumulator",
      "match": {
        "all": [
          {
            "eq": "geo_jump",
            "field": "signal_type"
          },
          {
            "eq": "high",
            "field": "severity"
          }
        ]
      },
      "stream": "device_signals",
      "remember_for_seconds": 900
    },
    {
      "id": "card_withdrawal",
      "type": "trigger",
      "match": {
        "all": [
          {
            "eq": "withdrawal",
            "field": "direction"
          },
          {
            "eq": "card",
            "field": "method"
          },
          {
            "gte": 100000,
            "field": "amount"
          }
        ]
      },
      "stream": "payments",
      "requires_prior": "geo_jump"
    }
  ],
  "join_key": "user_id",
  "description": "If a device emits a high-severity geo_jump signal and that user attempts a card withdrawal of $1,000 or more within 15 minutes, force a 3DS challenge."
}

Timeline

Created
2026-05-21 18:54
Shadow started
2026-05-21 18:54