Responding to an Adaptive Fraud Ring

Your dashboards show: over 6 hours, the decline rate on transactions between 180–220 from a specific set of BINs (card ranges) has tripled, while overall fraud rate (from mature labels, 8 weeks old) shows no recent change. Rule-hit rates show a new pattern: many of these transactions use previously unseen devices but reused shipping addresses.

1. Why is "mature label fraud rate shows no change" not reassuring here, and what should you look at instead?
2. Propose an immediate (same-day) response and a medium-term (same-week) response, and explain why they differ in mechanism.
3. Why does clustering transactions right around 180–220 specifically suggest an adaptive adversary rather than a natural traffic pattern?