What steps would you take to investigate a customer flagged for unusual transaction patterns?