{
  "outcome": "quarantine",
  "threat": "ref-hijack-duplicate",
  "why": "reuses the idempotency key of an already-recorded real invoice (supplier lookalike + F1040 + 612.00) while changing the IBAN and asking to delete the prior record; duplicates and supplier-identity lookalikes are quarantine conditions"
}