Fraud Watch Investigator flagged suspicious refund behavior on day 7 and routed the account cluster into manual risk review.