Fraud Spike Detection (Hourly)

Risk team needs merchant_id values where failed payment count in any hour is 3x the previous hour and failed_count >= 20.

payment_events(id, merchant_id, event_time, status)