Associating Fraud Sessions with a Case for Investigation

5-40 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

5.11.8 Listing the Cases that I Am Currently Working With

Both CSR and Agent type cases can be searched based on the current owner. This search filter finds cases for which the last action performed was by the user you are searching. Before You Begin Ensure that you have the proper permissions work with cases. List Cases Im Currently Working On 1. Log in to the OAAM Admin Console. 2. As a CSR or CSR Manager: In the Cases search page, search for the cases you are currently working on by specifying the following criteria in the search filters: 3. As an Investigator: In the Cases search page, search for the cases you are currently working on by specifying the following criteria in the search filters.

5.11.9 Marking One or More Sessions as Confirmed Fraud

The following section outlines the steps to mark one or more sessions as confirmed fraud. Included are references to other sections where you can find specific information. Before You Begin Ensure that you have the proper permissions to create and work with Agent cases. Mark One or More Sessions as Confirmed Fraud To mark a session as FraudNot Fraud, create an agent case link the session and close the Agent case with Disposition as either Confirmed Fraud or Not Fraud.

1. Log in to the OAAM Admin Console as an Investigator.

2. Create an Agent case. Refer to

Section 5.5.5, Creating an Agent Case Manually.

3. Link sessions to the case. Refer to

Section 5.7.1, Linking Sessions.

4. Change the severity of the case to High. Refer to

Section 5.6.2, Changing Severity Level of a Case.

5. Close the case with Disposition as Confirmed Fraud. Refer to

Section 5.6.3, Changing Status of a Case. Table 5–8 CSR Searches for Cases Working On Filter Value Current Owner Search by your user name. The agent who performed the last action Case Status Pending Expired Hide Expired Table 5–9 Investigator Searches for Cases Working On Filter Value Current Owner Search by your user name. The agent who performed the last action Case Status Pending, Escalated Expired Hide Expired Investigation Using Agent Cases 5-41

5.11.10 Closing a Case

The following section outlines the steps to close a severity of High. Before You Begin Ensure that you have the proper permissions to work with cases. Close a Case To close a case: 1. Log in to the OAAM Admin Console. 2. Navigate to the Cases search page. Refer to Section 5.3, Opening the Case Search Page. 3. Open the Case Details page. Refer to Section 5.5.3, Viewing Agent Case Details. 4. Change the severity of the case to High. Refer to Section 5.6.2, Changing Severity Level of a Case. 5. Change the status of the case. Refer to Section 5.6.3, Changing Status of a Case. 6. Close the case with a disposition. Refer to Section 5.6.4.1, Closing a Case Manually.

5.11.11 Closing Multiple Cases

The following section outlines the steps to close multiple cases. Before You Begin Ensure that you have the proper permissions to work with cases. Close Cases To close multiple cases: 1. Log in to the OAAM Admin Console. 2. Navigate to the Cases search page. Refer to Section 5.3, Opening the Case Search Page. 3. Close multiple cases. Refer to Section 5.6.5, Bulk-Editing Agent Cases.

5.11.12 Auto-Status Change Escalated Cases

Actor: Security InvestigatorSecurity Investigator Manager CSR case is created via one of the two possible flows automanual. 1. CSR performs escalate case action. Case is turned into an Agent type case with a status of Escalated. 2. Investigator searches for all the cases with Escalated status. He filters the results on the severity column so the highest severity cases are shown at the top. 3. He clicks one of the high severity case IDs in the list. Validation checks if the case still has Escalated status before opening the case screen and automatically changes the status to pending. 4. Case log displays creation, escalate action, access by user and status change to pending. 5-42 Oracle Fusion Middleware Administrators Guide for Oracle Adaptive Access Manager

5.12 Best Practices and Recommendations

Best practices and recommendations are provided below: ■ A Fraud Investigator looks into suspicious situations either escalated from customer service or directly from alerts. ■ An Fraud Investigation Manager would want to see which cases need to be given attention by his team. ■ A Fraud Investigation Manager must routinely search for overdue cases to make sure none of the cases are pending. ■ If a customer suspects fraud, then the severity level assigned is High. For example, if the customer wants a different image, then the severity level assigned is Low. Severity levels of a case can be escalated or de-escalated as necessary. Anyone can change the severity of cases.