Airbnb Business Intelligence Analyst Interview Preparation Guide - Junior Level

Direct answer

The core move in an incident explanation to a non-technical audience is separating three layers up front: what happened (in plain terms, no root-cause mechanism), what it meant for them (impact, in terms they already track), and what's being done about it, then deliberately leaving out anything that doesn't serve one of those three. Below is an incident where I did that under time pressure, including delivering it live to a mixed engineering-and-business audience.

What to include, what to leave out, and how to decide

• Lead with impact, not sequence. Legal, sales, and executives care about what happened TO THEM first, which customers, how long, what's the exposure, the technical timeline is useful evidence, not the headline.
• Deliberately exclude logs, stack traces, and internal service names; they add authority for an engineering audience and add nothing but confusion for this one. A useful test: if a detail doesn't change what the listener should do next, leave it out.
• Give the cause in one plain sentence with no jargon, something like "a recent configuration change made one of our systems too slow to respond to a partner service in time," rather than either omitting cause entirely (which reads as evasive) or over-explaining the mechanism.
• When delivering this live rather than in a written report, whether it's a hallway update or presenting a postmortem verbally to a room that mixes engineers and business stakeholders, pause after the impact statement for questions before moving to cause. People worried about impact can't absorb a root-cause explanation until that worry is addressed first.

Worked example

Situation: during a high-traffic sales period, our payment service began intermittently failing checkout requests for roughly ninety minutes. Legal, sales leadership, and the executive team needed an explanation quickly.

Task: explain what happened clearly enough for them to act, communicate with affected customers, assess any obligations, decide on immediate next steps, without either alarming them with irrelevant detail or minimizing the impact.

Action: I opened with impact, in the terms they track: which customers were affected, for roughly how long, and that the issue was fully resolved and being watched closely. I gave the cause in one sentence: a recent configuration change made our payment service too slow to respond to our external payment gateway in time, causing some checkout attempts to fail. I described what we did in plain terms (reverted the change, increased how long we wait before giving up on a slow response, added an automatic circuit breaker so a slow dependency can't cascade into a wider outage) and what we were doing next (a deeper review, with a fuller technical writeup available to anyone who wanted it). I left out the specific error codes, service names, and configuration parameter, none of which changed what legal, sales, or the executives needed to do next. I paused for questions right after the impact statement, before moving on, and answered a legal question about customer notification obligations directly instead of routing it back to engineering jargon.

Result: legal and sales left with a clear, accurate picture of exposure and could communicate confidently with affected customers; the executive team approved the follow-up work (the circuit breaker and review) without needing to dig into implementation detail themselves, and a fuller technical postmortem was made available separately for the engineering team that wanted the mechanism-level explanation. I learned that pausing for questions right after the impact statement, before cause, kept people from tuning out a cause explanation they weren't ready to hear yet.

Trade-offs and pitfalls

Leaving out technical detail can read as evasive if you do it silently; I said "I'm not going to walk through the technical internals here, I'm glad to share those separately" so the omission was visible on purpose rather than hidden. The other pitfall is understating severity to keep the room calm, that erodes trust the moment the real scope becomes clear later. State the honest impact even when it's uncomfortable, and let the "what we're doing about it" section carry the reassurance instead of the impact statement itself.

Direct answer

First diagnose why the meeting is stalling: usually it's because status-sharing and decision-making are mixed together, and no one is clearly accountable for closing a decision when people disagree. The fix separates the two (status moves async, meeting time is reserved for decisions), names a decision owner per topic, and tracks decisions in writing so they don't get relitigated the next week.

How to redesign it

Step 1: diagnose before redesigning. Ask whether people are status-updating instead of deciding, whether it's unclear whose call something is, or whether decisions do get made but aren't tracked so they resurface. Each cause has a different fix.

Step 2: separate status from decisions.

Step 3: track decisions so they don't restall. Keep a lightweight decision log: what was decided, who owns it, and the date. If an item can't close live, name a follow-up owner and a deadline instead of letting it silently carry over.

Step 4: reconsider the cadence. If most items now resolve async, a lower-frequency decision meeting paired with a written weekly status may serve the group better than a fixed weekly sync for everything.

Worked example

Situation: a cross-functional project with design, engineering, and data has a standing 60-minute weekly sync. Status updates take up 45 minutes, decisions surface in the last 15, and things 'decided' in the room get revisited the following week.
Action: introduced a pre-read posted 24 hours ahead covering status and any open decisions that need a live call; restructured the meeting to skip status entirely and spend the full time on flagged decisions, each with a named owner; started a shared decision log so a closed decision has a record to point back to.
Result: the meeting shortened from 60 to 30 minutes because status moved out of the room, and decisions stopped resurfacing because there was now a written record of what was actually agreed and by whom.

Trade-offs and pitfalls

• Cutting the meeting without giving people another outlet just moves the stalling into chat threads. Live time is still needed for genuine disagreement, don't eliminate it entirely.
• Naming a decision owner can feel like taking authority away from the group. Frame it as who is accountable if the call turns out wrong, not as a power grab.
• Async pre-reads fail without a light enforcement habit. If nobody protects the norm, it quietly reverts to status-in-the-room within a few weeks.
• Adding a decision log and a template is itself process. If it isn't paired with removing something (like the status round-robin), it just adds overhead on top of the original problem.

Direct answer
For gaps and irregular timestamps, choose the imputation/aggregation method based on WHY data is missing: forward-fill or interpolate for genuinely continuous processes with short, random gaps; backfill cautiously (it can leak a later value earlier); drop or explicitly flag longer gaps; and always aggregate to a granularity coarse enough that the remaining irregularity stops mattering, documenting every assumption so a downstream anomaly or seasonal-adjustment step doesn't mistake an artifact of your imputation for a real signal.

Structured elaboration

• Forward-fill: carries the last known value forward; reasonable for a slowly-changing metric with short gaps (a few hours of missing data in an otherwise-smooth daily series), but WRONG for a metric that should genuinely be zero during a gap (e.g. a count metric with a true "nothing happened" period looks identical to "we didn't collect data").
• Backfill: carries a LATER value backward to fill an earlier gap; usable for offline/historical analysis where you have the luxury of hindsight, but must never be used in a pipeline that also serves real-time or point-in-time-sensitive downstream consumers, since it directly leaks future information into a past period.
• Interpolation: linear or otherwise, for smoothly-varying continuous metrics with short gaps - a reasonable middle ground for a metric that plausibly moved gradually between two known points, but inappropriate for a metric that can genuinely jump discontinuously (interpolating across a genuine step-change smooths away exactly the signal you might care about).
• Dropping: appropriate for genuinely unreliable periods (a known outage, a known instrumentation break) rather than trying to impute a value you have no real basis for - explicitly excluding a known-bad window is more honest than filling it with a guess that could distort downstream statistics.
• Aggregating to daily/weekly: irregular intra-day timestamps (late-arriving events, uneven collection times) often stop mattering once rolled up to a daily or weekly grain, since the aggregation absorbs the within-period irregularity; choose the coarsest grain that still serves the downstream use case, rather than fighting irregularity at a finer grain than you actually need.
• Avoiding false anomalies/seasonal effects: an anomaly or seasonal-adjustment pipeline downstream has no way to distinguish "the metric really dropped" from "we forward-filled zero because of a collection gap" unless you tell it - always propagate a data-quality flag (or exclude affected periods) rather than silently letting an imputed value flow into anomaly-detection or decomposition logic as if it were a genuine observation.
• Documenting assumptions: record, alongside the cleaned series, exactly which periods were imputed, by which method, and why - this is what lets a later analyst (or your future self) distinguish a real signal from an artifact of your own cleaning choices months later.

Worked example
A daily sales series with 3 missing store-days out of a quarter: forward-filling those with the prior day's value would be defensible for a metric like "cumulative loyalty members" (monotonic, slowly changing) but actively wrong for "daily sales" itself, where a missing day likely means a store closure or data-collection gap, not zero true sales - the right treatment there is closer to excluding those days from any average that would otherwise be biased low, and documenting the exclusion so a rolling-metric consumer downstream knows those 3 days aren't real zeros.

Trade-offs & pitfalls
The single biggest risk in this whole area is silent propagation: an imputation choice made once, early in a pipeline, with no accompanying flag, becomes invisible to every downstream consumer, and a seemingly-reasonable choice (forward-fill) can manufacture a fake "flat period" that a later anomaly detector or seasonal decomposition then treats as genuine signal. Always keep the data-quality flag alongside the imputed value, not just the value itself.

Direct answer. A Cartesian join happens when two tables are combined with no matching condition between them at all, pairing every row of one with every row of the other; here it's caused by the old-style comma-join syntax, where the WHERE clause filters customers on its own but never specifies how orders should relate to customers, so every surviving customer row is paired with every single row in orders.

Structured elaboration. The comma-join syntax (FROM a, b WHERE ...) treats the join condition and the filter condition identically, both just end up in the WHERE clause, which makes it easy to write a WHERE clause that filters one table correctly while forgetting to specify any relationship to the other table at all. The database has no way to distinguish "you forgot the join condition" from "you genuinely want every combination," it just executes exactly what was written, which is why this defect produces a plausible-looking, syntactically valid query that silently returns far too many rows rather than an error.

Worked example. I verified this with a small dataset: two customers in region 5 and two orders (one per customer).

-- accidental Cartesian join: no relationship specified between customers and orders
SELECT c.customer_id, o.order_id
FROM customers c, orders o
WHERE c.region_id = 5;

-- corrected: an explicit join condition ties orders to the customer they belong to
SELECT c.customer_id, o.order_id
FROM customers c
JOIN orders o ON c.customer_id = o.customer_id
WHERE c.region_id = 5;

The first form returns four rows (every one of the two region-5 customers paired with every one of the two orders in the table, regardless of which customer actually placed which order); the corrected form returns exactly two rows, each customer paired only with their own order, which is almost always the actually-intended result.

Trade-offs and pitfalls. In production, detect this pattern by watching for a query whose result row count is suspiciously close to (rows in table A) times (rows in table B), especially right after a schema or query change; the most durable prevention is banning the comma-join syntax in code review or via a linter entirely, requiring explicit JOIN ... ON syntax everywhere, since that syntax structurally forces you to state a join condition rather than making it optional and easy to omit by mistake.

Complexity

A genuine Cartesian join costs O(rows in A times rows in B), which is why it's usually catastrophic on any pair of non-trivial tables rather than just mildly wrong.

Edge cases

A DELIBERATE cross join (generating every combination of two small reference sets, for instance) is a legitimate use of the same underlying mechanism; the distinction from a bug is entirely about whether the row-count explosion was intended, which is exactly why an accidental one is dangerous: it looks structurally identical to a correct query someone meant to write.

Direct answer

In a regulated industry the story changes in three ways before you ever open a slide deck: what you're allowed to show gets filtered by regulation first, every number needs a documented trail back to its source, and the audience usually includes someone whose job is to say no. The craft is presenting a defensible, compliant insight that is still genuinely persuasive, not a watered-down one.

Structured elaboration

1. Filter the insight through the regulatory constraint before you design the story.
Start by asking what you are legally or contractually allowed to surface, not what would make the best slide. In healthcare this typically means de-identification requirements in the style of HIPAA (the Health Insurance Portability and Accountability Act, the US healthcare privacy law) (removing or generalizing direct identifiers, applying k-anonymity style aggregation so no small cell size can be re-identified); in finance it often means restrictions on disclosing individual customer positions, fair-lending constraints on which variables can drive a decision, and model-risk-management documentation requirements. The constraint is not a formatting afterthought, it determines which findings you can even lead with. A finding that is only compelling at the individual-customer level may need to be re-cut at a cohort or segment level to be shshowable at all.

2. Choose an anonymization or aggregation method proportionate to the risk, and say so explicitly.
Common options, roughly in order of how much detail they preserve: generalization/binning (age becomes a 10-year band), suppression of small cells (any group below a stated threshold, for example n<10, is not reported individually), k-anonymity (restructuring the data so every individual is indistinguishable from at least k-1 others) or differential privacy (adding carefully calibrated statistical noise so no single record can be reverse-engineered from the released numbers) for released datasets, and full aggregation to segment or cohort level for anything leaving the compliance boundary. State which one you used and why in the deck itself, not just in a footnote; a compliance-literate audience will ask, and pre-empting the question builds trust.

3. Build the documentation trail the regulator or auditor would expect.
At minimum: a data lineage note (where the data came from, what was excluded and why), the exact aggregation/anonymization method applied, the population definition, and any known limitations or exclusions. In a bank this is close to what model-risk-management documentation already requires; in healthcare it is close to what a compliance or privacy officer would ask for before approving external use of a dataset. Producing this alongside the insight, not after someone asks for it, is what separates a defensible story from an accidental disclosure.

4. Present the compliance-versus-insight trade-off to the executive directly, instead of hiding it.
An executive who wants the fuller, more granular picture needs to understand that the constraint is not analyst caution, it is a hard requirement with real penalties for the organization. Frame it as: here is the insight we can show at the compliant aggregation level, here is what more granular view would add, and here is why we cannot show that view without additional legal/privacy sign-off (and what that sign-off would require, e.g., a data use agreement, approval from an institutional review board (the ethics body that approves research involving people's data), legal review). This turns a limitation into a scoped, honest recommendation rather than a vague 'we can't share that.'

Worked example

A healthcare analytics team wants to show a hospital system that a proposed care-pathway change reduces 30-day readmissions. The raw finding is a 2.1 percentage point reduction (from a baseline of 15.0% to 12.9%) in a cohort of 640 patients. Because the cohort includes some very small subgroups (for example, a specific rare-diagnosis subgroup of 6 patients), the team cannot report readmission rates by that subgroup without violating a small-cell suppression rule (commonly a minimum reportable cell size, e.g. n>=11, used across many healthcare reporting standards). The story that ships: the top-line reduction at the full-cohort level (which is well above the suppression threshold and safe to report), a note that subgroup-level results are directionally consistent but suppressed below n=11 per data governance policy, and an explicit statement that a follow-up analysis with a larger sample is planned before subgroup-level claims can be made. The executive sees the real result, understands exactly why the subgroup cut is withheld, and knows what it would take to get it.

Trade-offs and pitfalls

• The biggest pitfall is aggregating so heavily to stay 'safe' that the insight becomes too vague to act on; the discipline is finding the least aggregated view that is still compliant, not the most conservative one available.
• A second common mistake is treating the regulatory constraint as something to mention once in an appendix; a compliance-savvy stakeholder will judge you on whether the constraint shaped the analysis from the start, not whether you disclosed it at the end.
• Do not let 'the regulation requires it' become an excuse for skipping normal storytelling discipline (headline, evidence, recommendation); the compliant version of the insight still needs to lead with the so-what, it just has a narrower evidentiary base.
• When in doubt about whether a cut of the data is disclosable, the right escalation path is your privacy/compliance/legal function, not an individual judgment call, and that escalation itself is worth naming as part of your process when a stakeholder pushes for more granularity.

How I would investigate
I would compare the query profile, not just the SQL text. A CTE, or common table expression, is a named subquery. On some warehouses it is inlined, and on others it may be materialized or repeatedly scanned. I would look for repeated reads of the same large table, lost predicate pushdown, and big intermediate results.

First checks

• Run EXPLAIN or the warehouse query profile.
• See whether the same base table is scanned more than once.
• Check whether filters are applied after large joins instead of before them.
• Compare row counts at each step to find the explosion point.

What I would change first
If a suspicious CTE is referenced once, I would inline it or fold it into the parent query. If it is reused multiple times, I would stage the filtered result in a temp table or a materialized table so the expensive work happens once.

Rule of thumb
Readability is good, but if separate CTEs each reread a billion-row fact table, the query gets slower. The fix is usually to push filters earlier, keep only needed columns, and avoid recomputing the same join or aggregation in multiple branches.

Direct answer

Conversion rate is the fraction of users who complete a defined target action out of those who had the opportunity to; activation rate is the fraction of new users who reach a defined point of early value, usually within a specific window after signup; retention (day-1, day-7, or day-30) is the fraction of a cohort still active exactly N days after joining; the DAU/MAU ratio is daily active users divided by monthly active users, read as a stickiness signal; and feature adoption rate is the fraction of eligible or active users who have used a specific feature at least once, usually within a defined recent window.

Structured elaboration

Each of these is most useful at a different point in a product decision. Conversion rate is the right lens when evaluating a specific, narrow action, such as whether a redesigned signup form performs better than the old one. Activation is the right lens for evaluating whether NEW users are reaching value quickly, which is a different question from whether they eventually convert on some unrelated action. Retention is the right lens for evaluating whether the product delivers ongoing value once someone has already tried it, which activation and conversion cannot answer on their own since both can look healthy in a product that people try once and never return to. DAU/MAU is the right lens for a quick, single-number read on habitual usage across the whole base, though as a ratio it hides the shape of the underlying distribution. Feature adoption rate is the right lens for evaluating whether a SPECIFIC feature, rather than the product as a whole, is finding an audience.

For each metric, a concrete way to compute it from event-level data and a pitfall to watch for:

Worked example

For a signup flow, if 10,000 sessions viewed a signup form and 1,200 completed it, the conversion rate is $1200/10000=12\%$, computed from event-level counts at those two specific steps. If activation for the same product requires completing signup and one additional core action within the first day, and 620 of the 1,200 signups did so, the activation rate is $620/1200=51.7\%$, a materially different number answering a different question about the same population. If a cohort of those 620 activated users is then tracked forward and 260 are still active exactly 7 days after activation, day-7 retention for that cohort is $260/620=41.9\%$. None of these three numbers can substitute for either of the others: a product could have a strong 51.7% activation rate and a weak 41.9% seven-day retention rate at the same time, which is precisely the situation where activation and retention need to be reported separately rather than folded into one blended "success rate."

Trade-offs and pitfalls

The most common interpretation pitfall is comparing these metrics across products or teams without checking that the underlying definitions match: "activation" and "retention" windows in particular vary widely by convention, so a 30% activation rate at one company and a 30% activation rate at another are not necessarily measuring the same thing. A second common pitfall is treating any one of these five as a complete health signal on its own; a rising conversion rate driven by a lower-quality traffic mix, or a rising DAU/MAU ratio driven by bot activity, can each look like good news while masking a real underlying problem, which is why senior interpretation of these metrics usually means reading several of them together rather than optimizing any single one in isolation.

Direct answer

Finding customers with zero orders is an anti-join: return every row from customers that has no corresponding row in orders. The two standard ANSI patterns are LEFT JOIN ... WHERE right_key IS NULL and NOT EXISTS (subquery); both are correct, and for this exact question they return identical results.

Approach

1. Start from customers (the side you need every row from) and LEFT JOIN to orders on the customer key.
2. A customer with no orders produces a joined row where every orders column is NULL.
3. Filter to exactly those rows with WHERE o.order_id IS NULL (an anti-join), or equivalently use NOT EXISTS to ask the same question without materializing a join.

Worked example (sqlite3, verified)

Sample data:

CREATE TABLE customers (customer_id INTEGER PRIMARY KEY, email TEXT);
INSERT INTO customers VALUES
  (1, 'alice@x.com'), (2, 'bob@x.com'), (3, 'carol@x.com'), (4, 'dave@x.com');

CREATE TABLE orders (order_id INTEGER PRIMARY KEY, customer_id INTEGER, order_date TEXT);
INSERT INTO orders VALUES (101, 1, '2024-01-05'), (102, 1, '2024-03-10'), (103, 2, '2024-02-01');
-- customers 3 and 4 have zero orders

LEFT JOIN ... IS NULL:

SELECT c.customer_id, c.email
FROM customers c
LEFT JOIN orders o ON c.customer_id = o.customer_id
WHERE o.order_id IS NULL
ORDER BY c.customer_id;

Result: (3, 'carol@x.com'), (4, 'dave@x.com'). Exactly the 2 customers with no matching order row.

NOT EXISTS (equivalent):

SELECT c.customer_id, c.email
FROM customers c
WHERE NOT EXISTS (SELECT 1 FROM orders o WHERE o.customer_id = c.customer_id)
ORDER BY c.customer_id;

Result: identical, (3, 'carol@x.com'), (4, 'dave@x.com').

Extension: also return the most recent order date, NULL if none. This is the natural follow-on to the same LEFT JOIN, just without filtering out matched rows, aggregated with MAX:

SELECT c.customer_id, c.email, MAX(o.order_date) AS most_recent_order_date
FROM customers c
LEFT JOIN orders o ON c.customer_id = o.customer_id
GROUP BY c.customer_id, c.email
ORDER BY c.customer_id;

Result: (1, alice, '2024-03-10'), (2, bob, '2024-02-01'), (3, carol, NULL), (4, dave, NULL). MAX over an all-NULL group (Carol, Dave) correctly returns NULL rather than erroring or defaulting to 0.

Key points

• LEFT JOIN ... IS NULL and NOT EXISTS are semantically equivalent for a simple single-column anti-join like this one.
• The IS NULL filter must reference a column from the right table that is guaranteed non-NULL when a match exists (typically its primary key, o.order_id here), not an arbitrary right-side column that could itself legitimately be NULL in a matched row.
• The extension query keeps every customer (LEFT JOIN, no WHERE filter) and lets MAX(order_date) do double duty: it answers "most recent order" for customers with orders and naturally yields NULL for customers without any.

Complexity, edge cases & pitfalls

• Both patterns need an index on orders.customer_id to avoid a full scan per customer; with that index, NOT EXISTS typically compiles to a semi-join/anti-join plan that stops at the first match, which is often at least as fast as the LEFT JOIN plan and easier to reason about when more join conditions are added later.
• If orders.customer_id can itself be NULL (an order somehow unassigned), NOT EXISTS is unaffected, but a naive WHERE customer_id NOT IN (SELECT customer_id FROM orders) breaks completely: a single NULL in the subquery's result makes NOT IN return zero rows for the whole outer query. This is why NOT EXISTS (or the LEFT JOIN pattern) is preferred over NOT IN for anti-joins.
• If customers has duplicate customer_id values (a data quality issue, not expected under a primary key), the LEFT JOIN version could return the same customer more than once when it has orders, though the anti-join branch itself is unaffected since it only fires for customers with zero matches.

Headline (15–20s)

• Quick summary: "Conversion rate dropped 12% QoQ — ~0.9ppt absolute decline — costing an estimated $1.2M in quarterly revenue. I recommend a 2-week triage: validate data, isolate segments, and launch targeted experiments to recover ~60% of loss within one quarter."

One‑slide data highlights (45–60s) — show these metrics/charts

• Top line: Conversion rate by week (line chart) with QoQ annotation
• Volume context: Sessions, unique users, and traffic source mix (stacked bar)
• Funnel breakdown: Visit → Product View → Add-to-Cart → Checkout (bar chart with % drop per step)
• Cohort/segment view: Conversion by device (mobile/desktop), new vs returning, and top 3 acquisition channels (small multiples)
• Revenue impact: Estimated lost conversions × AOV (single number card)

Two plausible root causes & evidence to seek (45–60s)

• Cause A — Traffic quality shift: Increased low-intent channels (e.g., paid display/affiliates) reducing conversion.
  • Evidence: Channel-level conversion trends, CPC/CTR changes, new vs returning user ratio, landing-page bounce rates.
• Cause B — UX/regression on key flows (mobile checkout friction or A/B test rollout bug).
  • Evidence: Checkout abandonment by step, JS error logs, app/web release timeline, heatmaps, session replays, device-specific crash/error rates.

Immediate actions (30–40s)

• Triage (48–72 hrs): Validate metrics (ETL checks), isolate rollout/experiment tags, and freeze risky deploys.
• Quick wins (1–2 weeks):
  • Reallocate paid spend to top-performing channels; pause underperformers.
  • Deploy a mobile checkout rollback or simplified checkout variant for A/B test.
  • Run targeted remarketing to recent cart abandoners.

Measurement & cadence (20–30s)

• Short-term: Daily dashboard with conversion by channel/device/funnel; alert if conversion deviates >3% from baseline.
• Experimentation: Launch prioritized A/B tests with clear KPIs (conversion, AOV, retention); run to statistical significance with expected lift thresholds.
• Reporting: 48-hr triage update, weekly recovery scorecard, and a 90-day post-mortem with root-cause confirmation and ROI.

Ask:

• Approve 48–72h triage and temporary reallocation of paid budget to test channels.

Direct answer: Check volume/count anomalies first (did the NUMBER of transactions spike, or did per-transaction amounts spike, or both), then trace the specific transactions driving the spike back to their source, and distinguish an instrumentation error from a real business event by checking whether the spike correlates with a known business driver (a promotion, a large one-time enterprise deal) or with a known pipeline/logging change (a recent deploy, a duplicate event source).

Structured elaboration, the debugging process:

1. Decompose the spike: is revenue = transaction_count * average_amount moving because of count, average amount, or both? A count-driven spike suggests duplication or a bot/scripted source; an average-amount-driven spike suggests a data-entry error (a missing decimal point) or a genuine large transaction.
2. Trace to specific transactions: pull the actual transactions contributing most to the spike (top N by amount, or a sample if count-driven) and inspect them individually; a handful of transactions with implausible values (e.g., the same amount repeated many times, or an amount several orders of magnitude larger than any historical transaction) is a strong, immediate signal.
3. Check for a recent pipeline/logging change: correlate the spike's start time precisely against recent deploys, SDK version rollouts, or upstream schema changes; a logging bug (e.g., a retry mechanism double-firing a purchase event without proper idempotency) often has an exact, checkable start time matching a specific deploy.
4. Check for a real business driver: cross-reference marketing/sales calendars for a known promotion or large deal that could legitimately explain a spike of this size; a real driver usually has independent corroborating evidence (a specific campaign, a specific known customer) beyond just the revenue number itself.
5. Communicate: report the finding as a specific, falsifiable statement ("the spike is 90% explained by a duplicate-event bug introduced in the June 1 SDK release, confirmed by X duplicate event_ids sharing timestamps within milliseconds of each other") with the corrected number and the remediation status, not a vague "we're looking into it."

Worked example: in one real class of this incident, a UX change appeared to cause a genuine revenue increase, but investigation found the increase actually correlated with a logging bug that inflated EVENT COUNTS (not real purchases) after the change shipped; decomposing the spike into count vs average-amount, and specifically checking whether the elevated event count matched real corroborating signals (actual payment-processor settlements), was what distinguished the real effect from the artifact, since the UX-change timing and the bug's deploy timing happened to coincide, making correlation alone insufficient to conclude causation either way.

Trade-offs & pitfalls: Concluding "it's a real business change" purely because a plausible business narrative exists (without checking for a coincidental pipeline change at the same time) is the exact trap the case above illustrates; always rule out an instrumentation cause with hard evidence (duplicate event_ids, a deploy timestamp correlation, a payment-processor cross-check) before accepting a business explanation, even when the business explanation is genuinely plausible.