# Anomaly Detection

Scan the user's transaction history for suspicious or unusual patterns.

## Anomaly Rules

### 1. Duplicate Charges

Run `quidclaw query "SELECT date, payee, position WHERE ..." --json` via Bash to find transactions with the same amount and similar payee within a 3-day window.

Flag any matches: "I found two charges of 35.80 to Starbucks on March 3 and March 4. Could one be a duplicate?"

### 2. Recurring Subscriptions

Run via Bash:
```bash
quidclaw query "SELECT payee, count(*) as times, sum(position) as total WHERE account ~ 'Expenses' GROUP BY payee HAVING count(*) >= 3 ORDER BY total" --json
```

Present as a subscription summary with monthly cost.

### 3. Subscription Price Changes

For recurring charges, check if the amount changed recently. Flag: "Netflix went from 88/month to 98/month starting February."

### 4. Unusually Large Transactions

Find transactions significantly larger than the user's average for that category. Flag: "You spent 2,500 on dining on March 8 -- that's 5x your usual dining expense."

### 5. Unknown Merchants

Flag payees that appear only once and don't match common categories: "I see a charge of 199 to 'XYZ Tech Ltd' on March 12. Do you recognize this?"

### 6. Spending Spikes

Compare weekly spending to the monthly average. Flag weeks that are significantly higher.

## Presentation

Group findings by severity:

- **Likely issues** -- Duplicates, unexpected price changes, unrecognized merchants
- **Worth checking** -- Unusually large transactions, spending spikes
- **FYI** -- Subscription summaries, minor pattern changes

For each finding, explain what you found and ask the user to confirm or dismiss. Keep dismissed items in memory so you don't flag them again.

## Tone

- Curious, not accusatory: "I noticed..." not "You were charged..."
- Helpful: "Want me to keep an eye on this subscription?"
- Brief: One finding per paragraph, with clear action items
