---
title: How Sardine’s automated rules stopped a $1M fraud ring before a single withdrawal cleared — Sardine Customer Story
source_page: https://www.sardine.ai/customers/529-plan-administrator
canonical: https://www.sardine.ai/customers/529-plan-administrator
format: text/markdown
description: A fraud ring targeted 81 dormant 529 accounts and attempted $130K in withdrawals. Sardine's automated rules contained all 81 before any funds moved.
---

**Quick links:** [Human page](https://www.sardine.ai/customers/529-plan-administrator) · [Home](https://www.sardine.ai) · [Customers](https://www.sardine.ai/customers) · [Blog](https://www.sardine.ai/blog) · [Demo](https://www.sardine.ai/demo)

---

# How Sardine’s automated rules stopped a $1M fraud ring before a single withdrawal cleared

**Products used:** Fraud Investigations, Transaction Monitoring

## Results
- 75+: accounts targeted
- $130K+: in attempted withdrawals
- $0: successfully withdrawn

A leading 529 plan administrator relies on automated fraud rules to protect government savings accounts, a product line where account holders are often not monitoring balances closely and where fraud can go unnoticed until a statement arrives.
The challenge: A fraud ring moving on more than 75 accounts at once
The administrator's government savings vertical was hit by a coordinated attack. A fraud ring identified and targeted 81 unique accounts, with combined exposure of about $1M. The ring moved to cash out, attempting roughly $130K in withdrawals across the targeted accounts.
Government savings products carry a specific risk profile. Account holders check in infrequently, balances can sit untouched for long stretches, and a slow-moving fraud pattern can look like normal account inactivity until money is already gone.
The solution: Rules that locked down the ring automatically
The administrator had fraud rules deployed across this product line before the attack began. When the ring's activity matched the automated triggers, the system locked down the targeted accounts without requiring manual review or escalation.
No analyst had to catch the pattern in real-time. The rules were already tuned to this kind of account-takeover behavior, so detection and containment happened as the ring attempted to move money, not after.
The results: Full containment, minimal cleanup
Every withdrawal attempt failed. Of the $130K+ the ring tried to withdraw, none succeeded.
Zero funds lost, despite roughly $1M in exposure across more than 75 accounts
No manual cleanup, since the automated lockdown prevented any successful withdrawals
Minimal operational burden, with the incident report the primary work required after containment
The administrator's fraud team did not need to reconcile lost funds, manage customer-facing remediation, or coordinate external cleanup. The system performed as designed, and the incident closed with a writeup, rather than a loss.