[$250] Stale "Review fraudulent charge" task on the Home screen in New Expensify but the fraud flag was already cleared

[m-natarajan]

If you haven’t already, check out our contributing guidelines for onboarding and email contributors@expensify.com to request to join our Slack channel!

---

Version Number:
Reproducible in staging?: Needs Reproduction (Reproduction blocked)
Reproducible in production?: Needs Reproduction
If this was caught during regression testing, add the test name, ID and link from BrowserStack:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: @strepanier03
Slack conversation (hyperlinked to channel name): #Expensify Bugs

Action Performed:

1. Use Expensify Card and trigger potential fraudulent transaction flag
2. Clear the flag via New Expensify chat
3. Click on Home tab
4. Click on Review potential fraud alert under Time Sensitive Tasks
5. Get dropped into Inbox in workspace chat with nothing actionable seen

Expected Result:

Customer expects time sensitive task to be cleared when resolving fraud flag in chat and reactivating card

Actual Result:

The workspace chat shows the fraud flag was cleared and the card reactivated but the time-sensitive task to review the fraud is still visible on the Home tab.

Workaround:

Unknown

Platforms:

Select the officially supported platforms where the issue was reproduced:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome
• MacOS: Chrome / Safari

Screenshots/Videos

The screenshots for the issue is in Slack thread

View all open jobs on GitHub

Issue Owner

Current Issue Owner: @Uzaifm127

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022035056909398145693
• Upwork Job ID: 2035056909398145693
• Last Price Increase: 2026-03-20

[MelvinBot]

Proposal

Please re-state the problem that we are trying to solve in this issue.

After a user clears a fraud flag on their Expensify Card via the New Expensify chat (clicking "It was me" on the fraud alert whisper), the card gets reactivated but the "Review potential fraud alert" time-sensitive task persists on the Home screen. Clicking this stale task drops the user into the workspace chat with nothing actionable.

What is the root cause of that problem?

The resolveFraudAlert() function in src/libs/actions/Card.ts:1562-1619 only makes optimistic Onyx updates to REPORT_ACTIONS (setting the resolution field on the chat whisper). It does not update CARD_LIST at all.

The Home screen's TimeSensitiveSection determines whether to show the fraud review widget by checking the card's Onyx state — specifically card.fraud and card.nameValuePairs.possibleFraud — via the useTimeSensitiveCards hook and the isCardWithPotentialFraud() utility.

Since resolveFraudAlert never touches CARD_LIST, the card retains its fraud = 'domain'/'individual' state and its possibleFraud data in Onyx after resolution. The chat whisper buttons disappear immediately (because the report action resolution IS optimistically updated), but the Home screen widget persists because it reads card state, not report action state.

What changes do you think we should make in order to solve the problem?

Add optimistic Onyx updates to CARD_LIST in the resolveFraudAlert() function at src/libs/actions/Card.ts, following the same pattern used by freezeCard()/unfreezeCard() (which use buildCardListUpdates() to optimistically update card state):

1. In the optimistic data, merge into the card's CARD_LIST entry: set card.fraud to CONST.EXPENSIFY_CARD.FRAUD_TYPES.NONE and clear card.nameValuePairs.possibleFraud to null
2. In the failure data, restore the original card.fraud and card.nameValuePairs.possibleFraud values so the widget reappears if the API call fails
3. The function signature may need to accept the card object (or workspaceAccountID) to use buildCardListUpdates(), similar to how freezeCard/unfreezeCard are structured

What alternative solutions did you explore? (Optional)

An alternative would be to have the useTimeSensitiveCards hook cross-check the report action's resolution status (i.e., look up the fraud alert report action and check if it already has a resolution set). However, this would add unnecessary coupling between the card widget and report actions data, and goes against the existing pattern where card UI state is driven by card Onyx data. The optimistic update approach is cleaner, consistent with other card actions (freezeCard, unfreezeCard), and provides immediate UI feedback.

---

Next Steps for Contributor+ team: Reply with @MelvinBot implement this to create a draft PR, @MelvinBot <your feedback> to refine this analysis, or explain why you are rejecting Melvin's proposal.

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @Krishna2323 (External)

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~022035056909398145693

[NirDiamant]

Proposal

Please re-state the problem that we are trying to solve in this issue.

After a user resolves a fraud alert on their Expensify Card by clicking "Confirm" (It was me) in the New Expensify workspace chat, the "Review potential fraud alert" time-sensitive task on the Home screen continues to be displayed even though the fraud has been cleared and the card reactivated.

What is the root cause of that problem?

The Home screen reads fraud state exclusively from ONYXKEYS.CARD_LIST via the useTimeSensitiveCards hook (src/pages/home/TimeSensitiveSection/hooks/useTimeSensitiveCards.ts:22), which shows the widget when isCardWithPotentialFraud(card) is true — i.e., when card.fraud === 'individual'/'domain' or card.nameValuePairs?.possibleFraud is populated (src/libs/CardUtils.ts:1178-1179).

The resolveFraudAlert function (src/libs/actions/Card.ts:1562-1619) only writes optimistic/success/failure data to ONYXKEYS.COLLECTION.REPORT_ACTIONS — it sets originalMessage.resolution on the chat whisper message. It never updates CARD_LIST. So after the user resolves the fraud alert in chat, the report action correctly shows resolution: 'recognized', but CARD_LIST still holds card.fraud = 'individual' and card.nameValuePairs.possibleFraud still populated. The Home screen hook only reads CARD_LIST and has no awareness of the report action's resolution, so it keeps showing the stale task until the backend eventually pushes an updated card object via Pusher.

What changes do you think we should make in order to solve the problem?

In resolveFraudAlert (src/libs/actions/Card.ts), add optimistic, success, and failure Onyx updates for ONYXKEYS.CARD_LIST alongside the existing REPORT_ACTIONS updates:

• Optimistic data: For the given cardID, merge { fraud: CONST.EXPENSIFY_CARD.FRAUD_TYPES.NONE, nameValuePairs: { possibleFraud: null } } into the card entry in CARD_LIST. This makes the Home screen task disappear immediately when the user clicks "Confirm".
• Success data: No additional change needed (backend will push the updated card).
• Failure data: Revert CARD_LIST back to the original fraud value and possibleFraud object (captured before the API call) so the task re-appears if the API fails.

This should only apply when isFraud === false (the RECOGNIZED resolution path — user confirmed it was them). When isFraud === true (actual fraud), the card gets deactivated by the backend, so the Pusher-pushed update is the appropriate source of truth.

What alternative solutions did you explore?

An alternative would be to modify useTimeSensitiveCards to cross-reference ONYXKEYS.COLLECTION.REPORT_ACTIONS for each card's fraudAlertReportID and hide the widget if the action already has a resolution set. This avoids touching resolveFraudAlert but adds a joined Onyx query (two keys) to a hook that currently only needs one key, adding complexity and performance cost. The optimistic CARD_LIST update in resolveFraudAlert is simpler and more consistent with the existing pattern used elsewhere in the codebase.

[melvin-bot]

📣 @NirDiamant! 📣
Hey, it seems we don’t have your contributor details yet! You'll only have to do this once, and this is how we'll hire you on Upwork.
Please follow these steps:

1. Make sure you've read and understood the contributing guidelines.
2. Get the email address used to login to your Expensify account. If you don't already have an Expensify account, create one here. If you have multiple accounts (e.g. one for testing), please use your main account email.
3. Get the link to your Upwork profile. It's necessary because we only pay via Upwork. You can access it by logging in, and then clicking on your name. It'll look like this. If you don't already have an account, sign up for one here.
4. Copy the format below and paste it in a comment on this issue. Replace the placeholder text with your actual details.
   
   Format:

Contributor details
Your Expensify account email: <REPLACE EMAIL HERE>
Upwork Profile Link: <REPLACE LINK HERE>

[arlo-owls]

🚫 Duplicated proposal withdrawn by 🤖 ProposalPolice.

[github-actions]

⚠️ @arlo-owls Your proposal is a duplicate of an already existing proposal and has been automatically withdrawn to prevent spam. Please review the existing proposals before submitting a new one.

[surafeal-dev]

🚫 Duplicated proposal withdrawn by 🤖 ProposalPolice.