Write the note for the person who reopens it.

Fictional scenarios and synthetic data. Reviewed 6 November 2026.

Four months after a Meridian FX withdrawal was held, the trader disputes the decision through the broker's complaints process, and Stilling Bank, as acquirer, asks Northbank Pay what happened. Tomas, who held it, is on leave. The note in the case system reads, in full: "ATO, held, see Slack." Ines spends an afternoon reconstructing what Tomas knew in forty minutes.

What is actually being decided.

A case note is not a diary. It is the only durable record of why an action was taken, written at the moment the reasons were clearest, for a reader who was not there. That reader may be a colleague reopening the case next week, a dispute analyst assembling evidence next quarter, an acquirer asking about a pattern next year, or an auditor asking whether the control existed at all.

Each of those readers needs the same three things in the same order: what was observed, what was inferred from it, and what was done about it, with the inference clearly marked as the part that could be wrong. The note that mixes them cannot be checked, and a note that cannot be checked cannot defend anyone.

Confirm the applicable response deadline with the acquirer. Contemporaneous records can support a response; no particular note format guarantees success. The case note is where it is recorded.

The template.

Here is the form we use in this library. Four blocks, in this order, in some cases.

Case <id> · <merchant> · opened <date, time, zone> by <first name> Trigger. What fired and what it saw, as a rule sentence or alert text with the number. Observations. Numbered facts, each with the system it was seen in. No conclusions in this block. Inference. One sentence, labelled "inference", with the strongest innocent alternative beside it. Action. What was done, to which entity, by whom, reviewed when, rolled back how. What would change my mind. The evidence that would make the inference wrong. Status. Open, held, closed; next review date; who holds it now.

The blocks exist to separate observation from inference. "Password reset, new device, bank details changed, withdrawal requested, all within fifty minutes" is four observations. "The account has been taken over" is an inference. Evidence before action in Volume 01 explains why the order matters; the template enforces it.

The same case, written twice.

The Meridian FX case, with synthetic details. First, the note as it was written:

ATO, held, see Slack.

Second, the note as the template would have it:

Case MFX-2291 · Meridian FX · opened 14:58 UTC, 3 July, by Tomas Trigger. Rule A-14: IF an account changes withdrawal bank details within 60 minutes of a password reset THEN hold withdrawals for 24 hours pending review. Fired at 14:51. Observations. (1) Password reset completed 14:02 from a device reference not seen on this account before (auth log). (2) New device reference first seen 14:05, IP in 198.51.100.0/24, country differs from the account's 14-month history (session log). (3) Withdrawal bank account changed 14:40 to an account in a different name from the account holder (payments admin). (4) Withdrawal of €4,800 requested 14:51, the account's largest ever; previous maximum €900 (ledger). (5) No login from any previously known device since the reset (session log). Inference. Inference: the account has been taken over and the withdrawal is cash-out. Alternative: the holder has travelled, replaced a phone and changed banks on the same afternoon. Observation (3), a different name on the new bank account, is what makes the alternative weaker. Action. Withdrawal held, account only. Not blocked, not closed. Owner: Tomas. Review: 09:00 UTC, 4 July. Rollback: release the withdrawal and clear the hold flag. What would change my mind. A successful login from a previously known device; a verified call-back on the number on file from before the reset; the new bank account shown to be in the holder's name. Status. Held. Next review 4 July. Handed to Ines for the morning.

The first note took five seconds and cost an afternoon. The second took five minutes and would have answered the acquirer's query by return. Notice what the second note does not contain: no name, no bank account number, no card details, no copied e-mail. It references the systems where those things live. A note is read by more people than a record is, and personal data in a note travels further than anyone intended.

Notes for rules, rings and ratios.

The same four blocks serve beyond single cases. A rule's description field should hold its trigger, its purpose, its budget and its owner, as A rule is a claim sets out. A link-analysis finding should hold the attribute table, the strong-link cluster and the path from each member to the hub, as A shared attribute is a lead describes; the inference "one operator" goes in the inference block, nowhere else. A portfolio decision about a merchant near a monitoring threshold should hold the ratio, its two components, the month they were measured and the remediation agreed. When the acquirer asks, each of these notes is the answer.

The alternative we keep alive: a well-formatted note can still be wrong in its observations. A timestamp copied from the wrong time zone, a device reference misread from a truncated log. The template makes errors findable, which is the most any format can do.

A failure mode to watch.

The inference is written in the observations block. "Fraudster reset the password at 14:02" is one observation and one inference welded together, and the reader who comes later cannot tell which part was seen and which was believed. Once the case is closed, the weld is permanent. Six months on, in a representment or a complaint, the note reads as though the conclusion was known before the evidence, and no one can prove otherwise.

A way to work it.

1. Put the seven block headings into your case system as a default note body, so a blank note already has the shape.
2. For one week, write every note in the template. Time it. it settles at under five minutes for a routine case.
3. At the end of the week, pick three closed cases and hand each to a colleague who did not work it. Ask them to defend the action from the note alone. Where they cannot, the note was missing a block.
4. Strip personal data from the notes you reviewed and replace it with record references. Make that the standard.
5. Add "what would change my mind" to the review checklist. A case reopened on new evidence should start by reading that line.
6. Once a quarter, pull every note whose action had a review date and check the review happened. A hold with no review is a block with a politer name.

Take it to the desk.

If one of us left tomorrow, which of this month's closed cases could the rest of us defend to the acquirer from the notes alone?

Try it: Password reset, new device, bank details changed within an hour Look up: linked entities · dispute · step-up

The Volume 01 case account-takeover is the simpler version of MFX-2291. Two prior transactions and a matching footprint shows what a note has to contain for one specific dispute type, months after it was written.

Edited 6 November 2026. Primary references are listed above; fictional scenarios are not claims about Antifrog customers or operating experience.

Fictional learning material. Any numerical examples are synthetic. Use only authorised, appropriately minimised records for workplace exercises; do not upload customer information to this learning site.