It could be both misinterpreting the data and not misinterpreting the data though. Let me explain... The argument for misinterpreting the data is easy to use w

It could be both misinterpreting the data and not misinterpreting the data though. Let me explain... The argument for misinterpreting the data is easy to use when you account for time zones. If (a) I'm in the US and (b) I notice that most of my fraudulent transactions occur around 3AM, then it follows that (c) most of my fraud occurs at night. However, if the corollary of "Most of my fraud occurs from India/Singapore/etc", then it's simply a matter of time zones. Does most of my fraud occur at night? It does if I'm in the US but, if I'm the hacker in India/etc, then it occurs during the day. It's 3:45AM where I am in the US (CDT) but it's 2:15PM somewhere in India... However, if I was to write a training manual for my employees who worked in the same building as me (US CDT), then I'm not misinterpreting the data. The data is the "truth" here - if it shows that most fraudulent transactions occur around 3AM local time, then that's the truth and I'd be foolish to over-complicate the issue when trying to train new hires on how to spot fraud.