How Sardine’s automated rules stopped a $1M fraud ring before a single withdrawal cleared
A leading 529 plan administrator relies on automated fraud rules to protect government savings accounts, a product line where account holders are often not monitoring balances closely and where fraud can go unnoticed until a statement arrives.
The challenge: A fraud ring moving on more than 75 accounts at once
The administrator's government savings vertical was hit by a coordinated attack. A fraud ring identified and targeted 81 unique accounts, with combined exposure of about $1M. The ring moved to cash out, attempting roughly $130K in withdrawals across the targeted accounts.
Government savings products carry a specific risk profile. Account holders check in infrequently, balances can sit untouched for long stretches, and a slow-moving fraud pattern can look like normal account inactivity until money is already gone.
The solution: Rules that locked down the ring automatically
The administrator had fraud rules deployed across this product line before the attack began. When the ring's activity matched the automated triggers, the system locked down the targeted accounts without requiring manual review or escalation.
No analyst had to catch the pattern in real-time. The rules were already tuned to this kind of account-takeover behavior, so detection and containment happened as the ring attempted to move money, not after.
The results: Full containment, minimal cleanup
Every withdrawal attempt failed. Of the $130K+ the ring tried to withdraw, none succeeded.
- Zero funds lost, despite roughly $1M in exposure across more than 75 accounts
- No manual cleanup, since the automated lockdown prevented any successful withdrawals
- Minimal operational burden, with the incident report the primary work required after containment
The administrator's fraud team did not need to reconcile lost funds, manage customer-facing remediation, or coordinate external cleanup. The system performed as designed, and the incident closed with a writeup, rather than a loss.
