Compliance Prompt for FinCEN Student Aid Synthetic Fraud Detection
This **Luna** task prompt takes your onboarding and disbursement queues and builds a detection filter tuned to the indicators in **FinCEN's July 2026 alert** on synthetic identity rings exploiting federal student aid. Luna, the deepidv compliance overseer, returns an indicator map that translates each alert red flag into a machine-checkable rule, a detection filter that isolates shared device hashes, rapid application velocity, and synthetic credential markers, a false-positive control plan so legitimate applicants are not swept up, and a SAR-support view that captures the evidence examiners expect. Built for compliance and risk teams at institutions disbursing aid or benefits that need to move from a narrative alert to a live detection rule.
How to use this prompt
- 1
Open Luna in the deepidv dashboard and paste the full prompt, or run it in Claude, ChatGPT, or Gemini if you are drafting the detection design outside the platform.
- 2
Replace the INPUT section with your onboarding and disbursement queue structure, the signals you already capture, current fraud rules, and the FinCEN alert indicators you have mapped.
- 3
Run the prompt and read the indicator map first: every alert red flag is translated into a rule with the signal it depends on.
- 4
Hand the detection filter to your data engineer and route the false-positive control plan to your fraud lead; start with the highest-precision indicators.
- 5
Re-run the prompt after each new FinCEN alert and after each fraud pattern shift so the filter tracks the current typologies before disbursements clear.
The prompt
Luna, analyze our account onboarding and disbursement queues against the indicators outlined in FinCEN's July 2026 alert on federal student aid fraud. Build an automated detection filter isolating shared device hashes, rapid application velocity, and synthetic credential indicators. ROLE You are Luna, the deepidv compliance overseer. You translate regulatory alerts into machine-checkable detection rules and tune them so they catch organized rings without denying legitimate applicants. CONTEXT FinCEN's July 2026 alert described synthetic identity rings enrolling in educational programs to siphon federal aid, using aged synthetic profiles that clear basic database checks. The alert directs institutions to look past name-and-number matching to velocity anomalies, device telemetry, and pre-payment intelligence sharing under Section 314(b). INPUT, the user will paste: - Onboarding and disbursement queue structure and the stages each one runs - The signals you capture today (device fingerprint, timestamps, credential fields, IP, bank account age) - Current fraud rules - The FinCEN alert indicators your team has mapped - Your risk tiering rules for hold, review, and release TASKS 1. Translate each FinCEN alert indicator into a machine-checkable rule and name the signal it depends on. 2. Build a detection filter that isolates shared device hashes, rapid application velocity, and synthetic credential markers, and combines weak signals into high-precision clusters. 3. Produce a false-positive control plan that tiers indicators by precision and protects expected patterns like shared campus networks. 4. Specify the SAR-support evidence captured per hold so an examiner can see why the account was flagged. OUTPUT FORMAT, return the following structured response: 1. INDICATOR MAP - Each FinCEN indicator with the rule that checks it and the signal it requires - The indicators you cannot yet check because the signal is not captured, flagged 2. DETECTION FILTER - The rule set with thresholds, and the clusters that combine weak signals into a high-precision flag - The queue stage each rule runs at and the latency it adds 3. FALSE-POSITIVE CONTROL PLAN - Indicators tiered by precision, with hold, review, or release routing per tier - The expected patterns protected from automatic flagging 4. SAR-SUPPORT VIEW - The evidence retained per hold: signals, cluster, and disposition - The pre-payment intelligence fields relevant to Section 314(b) sharing Be specific and tie every rule to an alert indicator and a captured signal. Where a required signal is not captured, flag it instead of assuming it exists.
Test it in Claude or another LLM
This prompt is built for the Luna agent inside deepidv, where Luna analyzes live onboarding and disbursement queues and deploys the detection filter. You can dry-run the workflow in any general LLM first with synthetic queue and indicator data to see the rule set before pointing it at real data.
- 1
Paste the full prompt into Claude, ChatGPT, or Gemini, but replace the opening 'Luna,' with a role instruction such as 'Act as a fraud analyst turning a FinCEN alert into machine-checkable detection rules.' Keep the four OUTPUT sections exactly as written.
- 2
Under the INPUT section, paste the synthetic sample block below so the model has queues and captured signals to build against.
- 3
Add one framing line: 'This is synthetic test data. Build rules only from signals the input says you capture; where a required signal is missing, flag it instead of assuming it exists.'
- 4
Check the output shape: an indicator map, a detection filter with the signal each rule needs, a false-positive control plan, and a SAR-support view. If a rule depends on a signal the input does not list, tighten the role line and re-run.
- 5
Once the output shape is right, run it live in the deepidv dashboard where Luna analyzes your real queues and deploys the filter.
Synthetic sample data to paste alongside the prompt
Fake test data, safe to share with any LLM. Swap in your own once the output looks right.
QUEUES (synthetic, fake): - Onboarding: account opening for aid disbursement, stages identity, device capture, bank link - Disbursement: aid payout to linked account SIGNALS CAPTURED (fake): device fingerprint hash, application timestamp, ITIN/SSN, email domain, IP, bank account age CURRENT RULES (fake): SSN format check; duplicate email check only FINCEN INDICATORS MAPPED (fake): shared device across applicants; application velocity spikes; aged synthetic profiles; mismatched contact attributes RISK TIERING (fake): hold on 2+ high-precision indicators; review on single indicator
Pairs with on deepidv
Sources & further reading
FAQ
What did FinCEN's July 2026 student aid alert warn about?
It warned that organized rings use stolen and synthetic identities to enroll in educational programs and siphon federal aid, relying on aged synthetic profiles that pass basic database checks. The alert urged institutions to look at velocity anomalies, device telemetry, and pre-payment intelligence sharing. This prompt turns those indicators into live detection rules.
Why are shared device hashes a strong signal?
A single device fingerprint appearing across many supposedly distinct applicants is a hallmark of a ring operating an application farm. Basic name-and-number matching misses it because each application carries different stolen credentials. Device-level correlation exposes the shared origin.
How does the filter avoid blocking legitimate students?
The prompt produces a false-positive control plan that tiers indicators by precision and routes only high-confidence combinations to a hold, sending weaker single signals to review rather than denial. Shared campus networks and family devices are handled as expected patterns, not automatic flags.
Can I use this prompt outside the deepidv dashboard?
Yes. It works in Claude, ChatGPT, or Gemini to design the indicator map and filter logic. Live queue analysis and automated rule deployment only work when it runs inside the deepidv dashboard.
Related prompts
Run it with live verification data
These prompts work in any LLM. Inside the deepidv dashboard, Luna, Arbiter, and Arc run them against your real sessions, screening lists, and audit trails.
Book a Demo