Trigger
Why was this case selected?
Registered country
Poland
Review period
September 2026
Recent login distribution
More than 20 logins occurred outside the customer's registered country during the review period.
AI Investigation
What appears to have happened
Mock AI outputA large share of sessions resolve to IP ranges associated with commercial VPN providers rather than a specific country, which limits what the login data alone can establish. Payment and address evidence are unchanged and internally consistent, but the volume of non-attributable sessions means the underlying country mismatch question cannot be fully resolved from the evidence currently available.
Key Evidence
Login Activity
Wallet Admin41% of logins resolve to known VPN/proxy IP ranges rather than a specific country.
Payment & Funding
Payment InstrumentsFunding account is an unchanged, verified Polish bank account.
Transaction Activity
Core BankingMerchant locations are predominantly Polish; no clear foreign residence pattern.
KYC
KYC SystemIdentity verified against a Polish national ID with no outstanding items.
Address Verification
KYC SystemAddress supported by a recent bank statement; no evidence of a foreign address.
Previous Reviews
Case ManagementNo prior reviews on file for this account.
Control / Policy Check
Prototype policy · synthetic example- Requirement
- Current residential address must be supported by qualifying recent proof of address.
- Observed
- A recent bank statement supports the registered Polish address; no contradicting evidence is present elsewhere.
- Additional context
- A significant share of login sessions cannot be attributed to a country due to VPN/proxy use, limiting confidence in the trigger itself.
- Potential discrepancy
- Unable to determine whether VPN-masked sessions originate inside or outside the registered country.
Agent Conclusion
Mock AI outputINSUFFICIENT EVIDENCE
Address and payment evidence are consistent with the registered country, but the high share of VPN-masked sessions means the login-based trigger cannot be confirmed or ruled out from available data.
Recommended action
Request additional session or device evidence, or re-run the review once VPN-masked sessions can be attributed, before drawing a conclusion.
Evidence supporting conclusion
2 sources
Confidence
Low
Human Review
The AI recommendation is a starting point, not the final decision. You own this decision.