# TEMPLATE: Suspicious Financial Activity

**Fragment ID:** EVIDENCE_AGENT_ID_002
**Gameplay Function:** Agent Identification Evidence (Financial)
**Evidence Type:** Bank transaction records
**Rarity:** Uncommon
**Substitution Required:** [SUBJECT_NAME], [SALARY], [AMOUNT], [DATE]

---

## Evidence Summary

**Item:** Bank account transaction analysis
**Subject:** [SUBJECT_NAME]
**Evidence Quality:** HIGH (financial records are hard evidence)
**Admissibility:** HIGH (bank records with proper subpoena)

---

## Financial Analysis Report

```
═══════════════════════════════════════════════════════
    SAFETYNET FINANCIAL FORENSICS ANALYSIS
    Subject: [SUBJECT_NAME]
═══════════════════════════════════════════════════════

ANALYSIS DATE: [CURRENT_DATE]
ANALYST: Agent 0x77, Financial Crimes Division
AUTHORIZATION: Federal subpoena #[SUBPOENA_NUMBER]
BANKS ANALYZED: [PRIMARY_BANK], [SECONDARY_BANK]

SUMMARY:
Significant unexplained cash deposits inconsistent with
known employment income. Pattern consistent with ENTROPY
asset payment methodology.

───────────────────────────────────────────────────────
EMPLOYMENT INCOME VERIFICATION
───────────────────────────────────────────────────────

Employer: [ORGANIZATION]
Position: [POSITION]
Declared Salary: $[SALARY] annually
Expected Monthly Net: $[SALARY ÷ 12 × 0.70] (after tax)
Actual Payroll Deposits: VERIFIED (matches declared)

───────────────────────────────────────────────────────
SUSPICIOUS DEPOSITS IDENTIFIED
───────────────────────────────────────────────────────

DEPOSIT #1: CASH
Date: [DATE_1]
Amount: $[AMOUNT] (exactly)
Location: [BANK_BRANCH] ATM
Time: 22:47 (after hours)
Source: UNKNOWN - Cash deposit
Notes: Amount consistent with ENTROPY payment ($25K-$75K range)

DEPOSIT #2: CRYPTOCURRENCY EXCHANGE
Date: [DATE_2] (14 days after Deposit #1)
Amount: $[AMOUNT × 0.97]
Source: CryptoExchangePro (Bitcoin conversion)
Notes: Exchange timing suggests cryptocurrency laundering
       97% of original amount (3% lost to fees/exchange)

DEPOSIT #3: WIRE TRANSFER
Date: [DATE_3]
Amount: $[AMOUNT × 0.5]
Source: "[SHELL_COMPANY_NAME]"
       Registration: Delaware LLC (shell company indicators)
       Business: "Consulting services" (vague purpose)
Notes: Payment memo: "Security consultation - Project [CODE]"
       Company registered 6 months ago, minimal online presence

DEPOSIT #4: CASH
Date: [DATE_4]
Amount: $[AMOUNT × 0.75]
Location: Different branch (countersurveillance?)
Time: 21:13 (after hours again)
Notes: Deposited in multiple smaller amounts over 3 days
       Structured to avoid $10K reporting threshold

TOTAL SUSPICIOUS DEPOSITS: $[TOTAL_AMOUNT]
TIMEFRAME: [DURATION] months
AVERAGE: $[AVERAGE_PER_MONTH]/month

───────────────────────────────────────────────────────
INCOME ANALYSIS
───────────────────────────────────────────────────────

DECLARED INCOME (Annual):
Salary: $[SALARY]
Other declared income: $0
Total: $[SALARY]

ACTUAL DEPOSITS (Analyzed period):
Regular salary: $[SALARY_DEPOSITS]
Suspicious deposits: $[TOTAL_AMOUNT]
Total: $[SALARY_DEPOSITS + TOTAL_AMOUNT]

UNEXPLAINED INCOME: $[TOTAL_AMOUNT]
PERCENTAGE OF SALARY: [PERCENTAGE]%

ASSESSMENT:
Unexplained income of $[TOTAL_AMOUNT] represents
[PERCENTAGE]% of declared salary. No legitimate
source identified for this income.

───────────────────────────────────────────────────────
EXPENDITURE PATTERNS
───────────────────────────────────────────────────────

FOLLOWING SUSPICIOUS DEPOSITS:

Large expenditures identified:
• $[DEBT_AMOUNT] - Student loan payoff ([DATE_5])
• $[DEBT_AMOUNT_2] - Credit card debt clearance ([DATE_6])
• $[EXPENSE_1] - [EXPENSE_DESCRIPTION]
• $[EXPENSE_2] - [EXPENSE_DESCRIPTION]

PATTERN ANALYSIS:
Subject used unexplained income to:
1. Pay off existing debt (financial desperation motive)
2. Make purchases previously unaffordable
3. Maintain lifestyle above legitimate income level

This pattern consistent with ENTROPY asset behavior:
- Recruited through financial desperation
- Paid for specific services/access
- Uses funds to resolve personal financial crisis

───────────────────────────────────────────────────────
CRYPTOCURRENCY ACTIVITY
───────────────────────────────────────────────────────

EXCHANGE ACCOUNT: CryptoExchangePro
Account Name: [SUBJECT_NAME]
KYC Status: Verified (used real identity)
Activity:

INCOMING BITCOIN:
Date: [CRYPTO_DATE_1]
Amount: [BTC_AMOUNT] BTC
Value: $[AMOUNT]
Source Wallet: 1A9zW5...3kPm
NOTE: This wallet identified as ENTROPY master wallet!

CONVERSION TO USD:
Date: [CRYPTO_DATE_2] (same day)
Amount: $[AMOUNT × 0.97]
Transferred to: [BANK_NAME] account
Fees: $[AMOUNT × 0.03]

CRITICAL FINDING:
Direct transaction from confirmed ENTROPY master wallet
to subject's personal exchange account. This is DIRECT
EVIDENCE of ENTROPY payment.

───────────────────────────────────────────────────────
SHELL COMPANY ANALYSIS
───────────────────────────────────────────────────────

COMPANY: [SHELL_COMPANY_NAME]
Registration: Delaware LLC
Date Formed: [FORMATION_DATE] (6 months ago)
Registered Agent: Corporate Formations Inc. (mass registrations)
Business Address: Virtual office, no physical presence
Website: [SHELL_COMPANY_URL] (created same month as registration)
Employees: 0 (per state filings)
Revenue: Unknown (no public filings)

RED FLAGS:
✗ Recently formed (timing suspicious)
✗ No physical office or employees
✗ Generic "consulting" business description
✗ Minimal web presence (likely fake)
✗ Registered agent specializes in shell companies
✗ No verifiable past projects or clients
✗ Payment amounts inconsistent with actual consulting rates

ASSESSMENT:
[SHELL_COMPANY_NAME] exhibits all characteristics of
ENTROPY front company. Likely exists solely to provide
"legitimate" cover for asset payments.

───────────────────────────────────────────────────────
TAX IMPLICATIONS
───────────────────────────────────────────────────────

UNREPORTED INCOME: $[TOTAL_AMOUNT] (likely)

If subject did not declare this income:
• Tax evasion (federal crime)
• Penalties: $[TAX_PENALTY_ESTIMATE]
• Criminal exposure: 1-5 years prison

Additional leverage for cooperation:
"We can help with IRS if you help us with ENTROPY."

───────────────────────────────────────────────────────
CONCLUSIONS
───────────────────────────────────────────────────────

EVIDENCE STRENGTH: HIGH

Multiple indicators of ENTROPY asset payments:
✓ Direct transaction from ENTROPY master wallet
✓ Cash deposits in ENTROPY payment range ($25K-$75K)
✓ Shell company payments with suspicious characteristics
✓ Structured deposits avoiding reporting thresholds
✓ Cryptocurrency conversion (laundering pattern)
✓ Unexplained income [PERCENTAGE]% of legitimate salary
✓ Timing correlates with known ENTROPY operations

LEGAL ASSESSMENT:
This evidence, combined with other indicators, establishes
probable cause for:
• Money laundering charges
• Tax evasion
• Conspiracy (if operational involvement proven)
• ENTROPY asset designation (administrative)

RECOMMENDATION:
Subject [SUBJECT_NAME] is receiving payments from ENTROPY.
Financial pressure likely recruitment vector.
High probability of cooperation if offered immunity +
financial assistance alternative.

───────────────────────────────────────────────────────

ANALYST NOTES:

Subject's financial desperation (debt visible in records)
made them vulnerable to ENTROPY recruitment. The $[AMOUNT]
payments provided relief they couldn't get elsewhere.

This isn't a career criminal. This is someone who made a
bad choice under extreme financial pressure.

Recommended approach: Offer help, not just prosecution.
"We can resolve your debt legally. No prison. Fresh start.
Just tell us what ENTROPY wanted you to do."

Cooperation probability: 75-85% if approached correctly.

- Agent 0x77

═══════════════════════════════════════════════════════
CLASSIFICATION: FINANCIAL EVIDENCE - HIGH CONFIDENCE
DISTRIBUTION: Investigation team, legal counsel
HANDLING: Subpoena required for admission in court
═══════════════════════════════════════════════════════
```

---

## Gameplay Integration

**This Fragment Enables:**

**Definitive Identification:**
- Confirms [SUBJECT_NAME] is ENTROPY asset (95% certainty)
- Direct evidence from master wallet transaction
- Legally admissible in court
- Justifies arrest/surveillance/confrontation

**Player Actions Unlocked:**

**CONFRONTATION:**
```
"We know about the payments, [SUBJECT_NAME].
$[TOTAL_AMOUNT] from ENTROPY over [DURATION] months.
Direct transfer from their master wallet to your account.

We have the bank records. We have the cryptocurrency trail.
We have everything.

You can cooperate now, or we can prosecute. Your choice."
```

**LEVERAGE:**
```
"You're facing money laundering charges. Tax evasion.
5-10 years federal prison.

OR

You help us. Full immunity. We help you with the debt
legally. Witness protection if needed. Clean slate.

What's it going to be?"
```

**INTELLIGENCE:**
```
Financial analysis reveals:
→ Payment amounts indicate level of access provided
→ Payment timing correlates with operations
→ Shell company shows ENTROPY front operation
→ Master wallet transaction connects to other assets
```

---

## Success Metrics

**Evidence Value:**
- Alone: 60% confidence (suspicious but could have explanation)
- + Encrypted comms: 85% confidence
- + Access logs: 90% confidence
- + Surveillance: 95% confidence
- + Confession: 100% certainty

**Cooperation Likelihood:**
- Show financial evidence alone: 45% cooperation
- Offer immunity + debt help: 75% cooperation
- Add threat of prison time: 85% cooperation
- Combine all approaches: 90% cooperation

**Legal Strength:**
- Prosecution without cooperation: 70% conviction rate
- With subject cooperation: 95% conviction rate (against ENTROPY)
- Tax evasion charges alone: 90% conviction rate

---

## Template Substitution Guide

**Replace these placeholders:**

```
[SUBJECT_NAME] → NPC name
[SALARY] → Annual salary matching their position
[AMOUNT] → ENTROPY payment amount ($25,000 - $75,000 typical)
[DATE_1], [DATE_2], etc. → Appropriate dates in game timeline
[ORGANIZATION] → Company name where NPC works
[POSITION] → NPC's job title
[SHELL_COMPANY_NAME] → Generic business name (e.g., "SecureConsult LLC")
[DEBT_AMOUNT] → Amount of debt NPC paid off
[EXPENSE_DESCRIPTION] → What they bought with the money
[PERCENTAGE] → Calculate: (TOTAL_AMOUNT ÷ SALARY) × 100
```

**Formula for realistic amounts:**
```
Base salary: $40,000 - $80,000 (typical corporate employee)
ENTROPY payment: 50-100% of annual salary
Total suspicious income: $25,000 - $75,000
Debt paid off: 80% of suspicious income
Remaining spent: 20% of suspicious income
```

**Example with substitutions:**
```
Subject: David Chen
Salary: $52,000
ENTROPY payment: $50,000 (96% of salary)
Student debt paid: $40,000
Credit cards cleared: $8,000
Unexplained income: 96% of declared salary
```

---

## Scenario Variations

**High-Value Target (More Money):**
```
Salary: $120,000 (senior position)
ENTROPY payment: $150,000 (125% of salary)
Justification: Valuable access, sensitive position
```

**Low-Value Target (Less Money):**
```
Salary: $35,000 (junior position)
ENTROPY payment: $25,000 (71% of salary)
Justification: Limited access, lower value
```

**Ongoing Asset (Multiple Payments):**
```
Payment 1: $40,000 (initial recruitment)
Payment 2: $15,000 (after 3 months)
Payment 3: $15,000 (after 6 months)
Total: $70,000 over 6 months
Pattern: Ongoing asset vs. one-time use
```

---

## Related Evidence Types

**Combine with:**
- EVIDENCE_AGENT_ID_001: Encrypted communications (motive for payment)
- EVIDENCE_AGENT_ID_003: Access logs (what they did for money)
- EVIDENCE_AGENT_ID_004: Surveillance (meetings with ENTROPY handlers)
- EVIDENCE_AGENT_ID_006: Recruitment approach (how they were contacted)

**Investigation Sequence:**
1. Find encrypted comms → Suspicion
2. Get financial records → Confirmation
3. Confront subject → Cooperation or arrest
4. Use testimony → Dismantle cell

---

## Educational Context

**Related CyBOK Topics:**
- Law & Regulation (Money laundering, tax law, financial crimes)
- Forensics (Financial forensics, transaction analysis)
- Human Factors (Financial pressure as vulnerability)

**Security Lessons:**
- Financial desperation creates insider threats
- Cryptocurrency provides pseudo-anonymity, not true anonymity
- Shell companies are traceable through proper investigation
- Bank records are powerful evidence (hard to deny)
- Structured deposits indicate guilty knowledge
- Employee financial wellness reduces vulnerability

---

**CLASSIFICATION:** EVIDENCE TEMPLATE - FINANCIAL
**PRIORITY:** HIGH (Definitive proof with proper subpoena)
**REUSABILITY:** High (works for any insider threat scenario)
**LEGAL VALUE:** Excellent (bank records highly admissible)
**COOPERATION VALUE:** Excellent (strong leverage for turning asset)
