# From Six Disconnected Systems to One Fraud Intelligence Layer

How we unified six siloed systems into a Snowflake-native fraud intelligence platform for a national fundraising organization, cutting investigations from days to minutes with a team of 2.5 in under 3 months.

## The challenge

A national field fundraising organization with more than 500 field representatives across Canada had fraud signals spread across six enterprise systems: Snowflake signal tables, internal pay systems, a call centre platform, GPS acquisition records, complaint tools and donor payment data. None of them were designed to work together. There was no single place to see the signals side by side, and no reliable way to act on them before it was too late.

Each investigation took roughly five days of work across six manual tools, stitched together by hand.

> "The reason I can't sleep at night — I don't know how many I'm missing in any single day or week."
> — CEO, requirements workshop, April 2026

Three things made this hard:

- **Data complexity.** Six siloed systems meant the layer connecting them had to be built before anything else.
- **Stakeholder alignment.** Five teams had competing priorities. We ran six workshops and captured 92 requirements, each traced to the person who stated it, before writing any code.
- **Compliance.** Every fraud signal touches donor personal information. A PIPEDA-compliant hashing layer was needed before any AI processing could begin. It wasn't in the original brief, but it was essential.

## What we did

We built a fraud intelligence layer, not a dashboard, natively on Snowflake. All five fraud signal streams, the aggregation logic, rep scoring, case history and evidence storage are computed and stored in Snowflake. That makes it the single authoritative data layer the whole platform depends on.

The platform includes:

- **Fraud signal detection:** five live streams covering credit card duplicates, location anomalies, fake phone numbers, attribution and call centre alerts.
- **Rep scorecard:** tenure, charity history, donor timing and payment patterns in one view, with no tab switching.
- **Case management:** the full lifecycle, with assignment, escalation, an immutable audit trail and mandatory outcome capture.
- **Evidence compilation:** one button assembles a complete report, with signals, a location map and metrics, in minutes.
- **External complaint intake:** a form that creates cases automatically, replacing a separate manual tool.
- **Leadership visibility:** live identification of reps working off the grid, team activity reporting and case outcome tracking.

How we worked:

- Every requirement was traced to the stakeholder who stated it.
- Every change was approved by a person through structured PR review.
- The system was built for handoff. Training and full ownership transfer were the exit condition, not an add-on.

## The results

- **Investigations:** from about 5 days per case across 6 manual tools to minutes in one platform and one workflow, on demand.
- **Data:** six disconnected systems became one Snowflake-native platform.
- **Coverage:** unknown gaps in daily coverage became continuous, live signal coverage.
- **Delivery efficiency:** a build of this scope (6 data integrations, a compliance hashing architecture, 5 live signal streams and full case management) would typically need 8 to 12 specialists over 9 to 12 months. We delivered it with 2.5 resources in under 3 months, against 92 requirements and 72 test cases.

The client engaged us for a third phase, adding natural-language queries on Snowflake, with training and handoff in July 2026.