Analyze promo anomaly and design risk guardrails

During a 2‑hour 11.11 flash sale (11:00–13:00), an account A123 places 80 orders in 10 minutes using 12 payment cards across 5 device_ids; 9 orders share the same shipping address with 4 other accounts; the baseline for similar users is 2 orders/day. The real‑time approval system targets a 0.3% chargeback rate and a 2% manual‑review rate. Part A — Diagnose: (1) What hypotheses besides fraud could explain this pattern? (2) What immediate data would you pull in the next 15 minutes (specific features and joins) to separate coordinated abuse from organic virality? (3) Propose a real‑time decisioning strategy (approve/hold/reject): specify concrete rules or model thresholds and estimate business impact using a cost matrix where FP = $30 lost GMV, FN = $120 fraud loss, review cost = $1/order. (4) Quantify GMV and loss impact if we hold 50% of A123‑like traffic for 30 minutes versus rejecting outright; state assumptions. Part B — Design safer promos: (5) Redesign the promotion to reduce abuse (coupon structure, per‑user caps, velocity limits, payment‑risk tiers, address trust scores, bot mitigation), and define guardrail metrics with alert thresholds. (6) Outline an experiment and monitoring plan (holdout or geo‑split), success/stop criteria, and explicit rollback conditions.