Fraud Detection & Trust & Safety – Listing & Chat Review
1. Overview
This process reviews a product listing and/or its associated chat transcript to identify complex scam patterns. It produces a concise risk assessment that highlights any suspicious activity and recommends next‑step actions for a Risk Analyst.
2. Business Value
- Protects customers by identifying fraudulent listings before they cause loss.
- Reduces financial exposure by spotting scams early.
- Maintains platform trust by removing fraudulent content quickly.
- Improves efficiency for the Trust & Safety team, reducing manual investigation time.
3. Operational Context
- When to run:
- When a new listing is flagged by a user, a moderation system, or internal monitoring.
- When a chat transcript involving a buyer or seller is flagged for possible fraud.
- Who uses it: Risk Analysts, Trust & Safety specialists, and senior risk managers.
- How often: Each time a flagged listing or chat is received for review (multiple times per day in high‑traffic e‑commerce platforms).
4. Inputs
4.1 Listing Data (optional – use when a listing is the focus)
- Name/Label: Product Listing
- Type: Structured text (list of fields)
- Details Provided:
- Product title
- Product description (including any promotional text)
- Asking price / currency
- Seller name (as displayed on the platform)
- Seller rating (e.g., 4.3/5)
- Number of reviews (if any)
- Listing date (yyyy‑mm‑dd)
- Category (e.g., electronics, apparel)
- Location of seller (city, country)
- Image URLs (optional)
| Field | Example Value |
|---|
| Title | “Premium Wireless Headphones – 20% off today!” |
| Description | “Brand new, shipped from US. Free shipping.” |
| Price | “$49.99” |
| Seller Name | “TechGear_Official” |
| Seller Rating | “4.2 / 5” |
| Reviews Count | “12” |
| Listing Date | “2025‑08‑05” |
| Category | “Electronics – Audio” |
| Location | “Los Angeles, USA” |
| Image URLs | ["https://example.com/img1.jpg"] |
4.2 Chat Transcript (optional – use when a chat is the focus)
- Name/Label: Chat Transcript
- Type: PDF document or plain‑text file
- Details Provided:
- Sequential messages (each includes speaker label, timestamp, and message content).
- The speaker label may be “Buyer”, “Seller”, or “System”.
- Timestamps in ISO 8601 format (e.g., 2025‑08‑05T14:23:00Z).
| Speaker | Timestamp | Message |
|---|
| Buyer | 2025‑08‑05T14:23:00Z | “Hi, I’m interested in the headphones.” |
| Seller | 2025‑08‑05T14:24:12Z | “Great! We can ship them for $30 if you pay via wire.” |
| Buyer | 2025‑08‑05T14:25:05Z | “I prefer PayPal. Are you okay?” |
| Seller | 2025‑08‑05T14:26:00Z | “I only accept bank transfer to my personal account.” |
4.3 Flag Reason (optional)
- Name/Label: Flag Reason
- Type: Text field
- Details Provided:
- Reason the listing or chat was flagged (e.g., “User reported suspicious payment request”).
| Reason |
|---|
| “User reported suspicious payment request.” |
Note: Only the inputs listed above are required for a single execution of this process. All other reference data is provided in the Appendices.
5. Outputs
5.1 Fraud Risk Assessment Report
- Name/Label: Fraud Risk Assessment
- Contents:
- Summary of findings.
- Risk Score (0‑100).
- Risk Level (Low / Medium / High).
- List of detected scam patterns with brief description and evidence excerpt.
- Recommended next steps (e.g., “Escalate to senior analyst”, “Suspend listing”).
- Formatting Rules:
- Use plain‑language bullet points.
- Header sections: “Summary”, “Risk Score”, “Risk Level”, “Findings”, “Recommendations”.
- Risk Score expressed as a number (e.g., “Score: 78”).
5.2 Flag Summary (Optional)
- Name/Label: Quick Flag Summary
- Contents: One‑line summary for dashboard view:
- “Listing ID 12345 – High Risk – 78/100 – Immediate Review.”
- Formatting Rules:
- Single line, tab‑separated values:
Listing ID | Risk Level | Score | Action.
6. Detailed Plan & Execution Steps
- Collect Input(s). Gather the Product Listing and/or the Chat Transcript along with any Flag Reason. Ensure each required field is present.
- Verify completeness. If any required field is missing, stop and flag the item for manual review.
- Read the text. Scan the product description and chat messages for any of the patterns listed in Appendix C – Pattern Reference.
- Identify matches. For each detected pattern:
- Record the pattern name.
- Capture the relevant snippet (up to 150 characters).
- Note the severity rating (High / Medium / Low) defined in the pattern reference.
- Calculate Risk Score.
- Start at 0.
- Add points based on each pattern’s severity weight (see Appendix C – Scoring Matrix).
- Cap the total at 100.
- Determine Risk Level.
- Score ≥ 80 → High.
- 50 – 79 → Medium.
- < 50 → Low.
- Compose the Risk Assessment Report.
- Write a concise Summary.
- Include the calculated Score and Level.
- List each identified pattern with its snippet.
- Suggest next steps based on the overall risk (e.g., “Suspend listing”, “Escalate to senior analyst”).
- Create the optional Flag Summary. Include Listing ID, Risk Level, Score, and Recommended Action in a single line.
- Review & finalize. Ensure the report follows the formatting rules. Save the report as a plain‑text document (or present as structured list).
- Log completion. Record the date/time of assessment, analyst name, and any notes about the process.
7. Validation & Quality Checks
- Input Completeness: All required fields present; missing fields → flag for manual review.
- Pattern Match Accuracy: Verify that each highlighted snippet actually contains the identified pattern word‑for‑word.
- Score Calculation: Sum of pattern weights must equal the reported Score; re‑calculate manually for verification.
- Risk Level Consistency: Ensure the Risk Level matches the Score according to the thresholds.
- Report Formatting: Check that the report contains all required sections and uses bullet points and headings as specified.
- Duplicate Detection: Ensure the same pattern is not counted twice for the same listing or chat.
8. Special Rules / Edge Cases
- Missing Transcript or Listing Data: If only one of the two (listing or chat) is provided, the process runs on the available input. If both are missing, halt and flag for manual review.
- Multiple Flag Reasons: Concatenate all reasons in the “Flag Reason” field; treat each as an additional data point for context.
- Conflicting Evidence: If a pattern is identified in both the listing and chat with differing severity, use the higher severity for scoring.
- Unrecognized Language: If the transcript includes non‑English text, flag for manual translation before proceeding.
- Excessive Length: If a transcript exceeds 10 000 characters, truncate after 10 000 characters and note the truncation in the report.
- Score Cap: The final score cannot exceed 100; any overflow is capped.
- Error Handling: If any validation step fails, produce no Risk Assessment Report. Instead, generate a “Processing Error” flag with a brief explanation (e.g., “Missing seller rating – manual review required”).
9. Example
Input (Listing)
- Product Title: “Brand New iPhone 14 – $100 (Original Price $999) – Free Shipping!”
- Description: “Never used, sealed box. Seller asks for a direct bank transfer to avoid fees. Shipping worldwide.”
- Price: $100
- Seller Name: “TechDeals_Official”
- Seller Rating: 3.6 / 5
- Listing Date: 2025‑08‑04
- Category: Electronics – Mobile Phones
Input (Chat Transcript) – PDF
| Speaker | Timestamp | Message |
|---|
| Buyer | 2025‑08‑05T12:15:00Z | “Hi, I’m interested in the iPhone.” |
| Seller | 2025‑08‑05T12:16:12Z | “Great, I can send it for $100 if you pay via bank transfer.” |
| Buyer | 2025‑08‑05T12:17:05Z | “Do you accept PayPal?” |
| Seller | 2025‑08‑05T12:18:00Z | “No, only direct transfer to my personal account, the account is 12345678.” |
| Buyer | 2025‑08‑05T12:20:00Z | “Okay, can you send the account details?” |
| Seller | 2025‑08‑05T12:21:00Z | “Here’s the account: 12345678, bank name: XYZ, Swift: ABCD.” |
Output – Fraud Risk Assessment
Summary
The listing and chat transcript show multiple high‑risk indicators of a possible scam.
Risk Score: 85
Risk Level: High
Findings
-
Pattern: “Price far below market value”.
- Excerpt: “$100 (Original Price $999) – 90 % discount.”
- Severity: High (30 points).
-
Pattern: “Request for direct bank transfer to personal account”.
- Excerpt: “Only direct transfer to my personal account, the account is 12345678.”
- Severity: High (30 points).
-
Pattern: “Urgent language & “free shipping”.*
- Excerpt: “Free shipping! Contact me now.”
- Severity: Medium (15 points).
-
Pattern: “Seller rating below 4.0”.
- Excerpt: “Seller rating 3.6 / 5.”
- Severity: Low (5 points).
Total Score: 30 + 30 + 15 + 5 = 80 (capped at 85 after additional weighting).
Recommendations
- Immediate Action: Suspend the listing pending further investigation.
- Escalate: Forward to senior risk analyst for deep review.
- User Notification: Inform buyer of potential fraud, advise not to proceed with payment.
Flag Summary (Optional)
Listing ID: 2025-08-04-001 | High | 85 | Suspend & Escalate
Appendix A – FAQ
Q1: What qualifies as “price far below market value”?
A: Any listed price that is ≥ 50 % lower than the average market price for the same item, based on the platform’s price database (see Appendix C – Price Benchmarks).
Q2: Why is a direct bank transfer considered a red flag?
A: Legitimate transactions on the platform use approved payment methods (e.g., credit cards, PayPal). Direct bank transfers bypass platform protections and are a common fraud technique.
Q3: What if the seller’s rating is not listed?
A: Treat missing rating as “unknown” and assign a low‑severity point (3 points). Continue with other checks.
Q4: How is the Risk Score calculated?
A: Each detected pattern adds a predefined weight (see Appendix C – Scoring Matrix). The final score is the sum of all weights, capped at 100.
Q5: What does “High” risk mean for the next steps?
A: High risk (score ≥ 80) triggers automatic suspension of the listing and escalation to senior analysts for immediate investigation.
Q6: If the chat is partially missing (e.g., missing buyer’s first message), can I still run the process?
A: Yes, as long as the seller’s messages are present. Missing parts reduce the total possible points but still produce a risk score.
Q7: Are there any false‑positive scenarios?
A: Some legitimate sellers may ask for bank transfer for high‑value items. In such cases, the risk score may be lower due to supporting evidence (e.g., verified seller, strong rating). Review the “Seller Verification” section in Appendix C for additional context.
Q8: How often should the pattern reference list be updated?
A: Quarterly, or whenever new scam tactics are observed. The Trust & Safety team is responsible for maintaining the list in Appendix C.
Q9: Where can I find the list of approved payment methods?
A: In the “Approved Payment Methods” list in Appendix C.
Q10: What is the “Flag Reason” used for?
A: To capture the origin of the review (user report, system flag, manual review). It helps in auditing and improving detection algorithms.
Appendix B – Glossary
| Term | Definition |
|---|
| Scam Pattern | A recognizable behavior or wording that historically correlates with fraudulent activity. |
| Risk Score | A numeric value (0‑100) representing the likelihood that a listing or chat is fraudulent. |
| Risk Level | Qualitative categorization of the risk score: Low, Medium, or High. |
| Flag Reason | The reason a listing or chat was flagged for review (e.g., “User reported suspicious payment”). |
| Severity | The impact rating assigned to a pattern (High, Medium, Low) that determines its weight in the risk score. |
| Approved Payment Methods | Payment types officially supported and secured by the platform (e.g., credit card, PayPal, platform wallet). |
| Escalation | The process of forwarding a case to a senior analyst or higher‑level team for further review. |
| Suspend | Temporarily remove a listing from public view while investigation is underway. |
| Platform | The e‑commerce website or marketplace where the product is listed. |
| Chat Transcript | The written record of a conversation between buyer and seller, including timestamps. |
| Seller Rating | The average rating given to a seller by buyers, expressed as a fraction (e.g., 4.2/5). |
| Price Benchmarks | Reference data for average prices of items in a given category, used for price‑comparison. |
Appendix C – Reference Materials
C1. List of Known Scam Patterns
| Pattern Name | Description | Example Phrase | Severity | Weight (points) | Reason for Flag |
|---|
| Unrealistic Discount | Price is > 50 % below market average. | “Only $10 for a $200 product.” | High | 30 | Indicates possible lure. |
| Direct Bank Transfer | Request for payment via direct bank transfer to personal account. | “Please send money to my personal bank account.” | High | 30 | Bypasses platform protections. |
| Urgent Language | Urges immediate action or threatens loss. | “Reply now or lose the deal.” | Medium | 15 | Pressures victim. |
| Free Shipping for High‑Value Items | Offers free shipping on expensive items to entice purchase. | “Free shipping on this $1500 TV.” | Medium | 15 | Unusual for high‑price items. |
| External Payment Platform | Suggests using non‑platform payment (e.g., Western Union, MoneyGram). | “Send money via Western Union.” | High | 30 | Often used by scammers. |
| Request for Personal Details | Asks for phone number, personal email, or address outside the platform. | “Please give me your personal email.” | High | 30 | Direct contact outside platform. |
| Seller Rating Below 4.0 | Seller has low rating or few reviews. | “Rating 2.5/5.” | Low | 5 | Indicates risk, but not definitive. |
| Inconsistent Product Details | Contradicts product type, brand, or features. | “Brand new iPhone 14 but with a cracked screen.” | Medium | 15 | Suggests misrepresentation. |
| Unusual Shipping Method | Claims shipping via unconventional methods (e.g., courier not supported). | “Will send via private courier, no tracking.” | Medium | 15 | Can be used to avoid traceability. |
| High‑Value Item for Low Price | Combination of high‑value product (e.g., luxury watch) with suspiciously low price. | “Luxury watch for $50.” | High | 30 | Strong indicator. |
| Multiple Listings with Same Text | Same description across multiple seller accounts. | Identical product descriptions across 5 sellers. | Medium | 10 | Possible coordinated fraud. |
| Buyer “Too Good to Be True” | Buyer offers to pay more than listed price. | “I’ll give you $150 for the $100 item.” | Medium | 10 | Indicates potential scam (overpayment). |
| Seller Requests Direct Communication | Wants to move communication to email, phone, or messaging apps. | “Let’s continue on WhatsApp.” | High | 30 | Moves off-platform. |
| Unverified Seller | No verification badge or ID verification. | “I’m new, no verification.” | Low | 5 | Minor indicator. |
| Frequent Price Changes | Listing price changes drastically within short time frame (e.g., from $200 to $20 in 1 day). | “Price dropped from $200 to $20 in 2 days.” | Medium | 15 | May indicate a lure. |
C2. Scoring Matrix
| Severity | Weight (Points) |
|---|
| High | 30 |
| Medium | 15 |
| Low | 5 |
Scoring Rules
- Add the weight for each pattern detected.
- Multiple occurrences of the same pattern count only once per listing or chat.
- For each distinct pattern, add the assigned weight.
- If the total exceeds 100, cap at 100.
C3. Risk Level Classification
| Score Range | Risk Level |
|---|
| 80 – 100 | High |
| 50 – 79 | Medium |
| 0 – 49 | Low |
C4. Risk Level Action Matrix
| Risk Level | Recommended Action |
|---|
| High | Immediately suspend the listing; flag the chat; escalate to senior analyst; send user warning; log for fraud team. |
| Medium | Place listing under “Review” status; notify risk analyst; schedule follow‑up within 24 hrs; monitor for additional reports. |
| Low | Mark as “No Action Required”; monitor for future activity; no immediate action required. |
C5. Approved Payment Methods (Reference)
- Credit cards (Visa, Mastercard, American Express)
- PayPal (verified account)
- Platform’s internal wallet or payment gateway
- Apple Pay / Google Pay (when linked to a verified account)
Do NOT accept: direct bank transfers, wire transfers, money orders, cash on delivery, third‑party services (Western Union, MoneyGram), or unverified personal accounts.
C6. Style Guide for Risk Assessment
- Tone: Neutral, professional, concise.
- Voice: Direct, actionable.
- Sentence Length: ≤ 25 words per sentence.
- Bullet Points: Use for lists (findings, recommendations).
- Number Formatting: Use numeric scores (e.g., “Score: 78”).
- Date Format: yyyy‑mm‑dd.
- Currency: Include currency symbol (e.g., “$100”).
- Excerpt Length: Up to 150 characters, ellipsis (…) if truncated.
- No Jargon: Avoid technical or internal system terms.
C7. Example Completed Assessment
Summary
The listing for a “Premium Wireless Headphones” at $49.99 and the attached chat show multiple high‑risk indicators.
Risk Score: 85
Risk Level: High
Findings
- Unreasonable Discount (30 points): “$49.99 (Original price $999) – 95 % discount.”
- Direct Bank Transfer (30 points): “Only direct transfer to my personal account, the account is 12345678.”
- Urgent Language (15 points): “Free shipping! Act now.”
- Low Seller Rating (5 points): “Seller rating 3.6 / 5.”
Recommendations
- Suspend the listing immediately.
- Escalate to senior analyst for further investigation.
- Send warning to buyer: “Do not make payments; contact support.”
C8. Process Flow Diagram (Description)
- Input Gathering → 2. Validation → 3. Pattern Detection → 4. Scoring → 5. Risk Determination → 6. Report Generation → 7. Action/Flag → 8. Log & Notify.
(For visual reference, see the internal flowchart.)
Additional Notes
- Speed vs. Accuracy: Prioritize detection of high‑severity patterns; the process can be run quickly (within minutes) for high‑volume environments.
- Documentation: Keep a log of all assessments for audit purposes. Store the Risk Assessment Report alongside the listing ID in the internal case management system.
- Training: Risk Analysts should familiarize themselves with the pattern reference (Appendix C) and the scoring matrix before using this SOP.
- Updates: Review and update the Pattern Reference and Scoring Matrix at least quarterly to capture emerging fraud tactics.
- Confidentiality: All data used in this process is internal and must be handled in accordance with the company’s data‑privacy policies.
- Automation Support: Although this SOP is written for manual execution, it is designed to be straightforward to automate in the future (e.g., with text‑search tools). However, this SOP does not depend on any automated tools.