Agent setup guide
Fraud & Transaction Risk Monitor
Scores every transaction against your fraud rules and holds high-risk ones for an analyst.
What it does
Scores every transaction against your fraud rules and holds high-risk ones for an analyst.
- Receives each transaction (with any customer history you have) from your processor, core system or store through a webhook.
- AI scores it 0–100 against the fraud rules you write and the history you send, lists the rules that fired and the anomalies with evidence, and writes a case summary and a neutral verification message draft.
- High-risk transactions are posted to your Slack fraud channel and held in Reviews for an analyst; confirmed cases are logged in your Google Sheets case log.
- Medium-risk transactions are added to a review queue sheet; low-risk ones stay in the run history.
What it needs
- A paid plan (agents run live on paid plans).
- An AI provider key (Settings → AI Providers).
- Slack and Google Sheets, connected in Settings → Integrations.
- A processor, core system or store that can send each transaction (ideally with customer history fields) to a webhook URL.
What it doesn't do
- It never blocks, holds, refunds or cancels a payment, or contacts a customer: “hold” means it waits in Reviews, and your analysts act in your own systems.
- It isn't a trained fraud model and doesn't replace your processor's fraud tools; it applies your written rules plus AI judgement to the data sent.
- It doesn't fetch history from Stripe, Square or Shopify itself; send the context with each transaction.
- It never uses protected characteristics or names as risk signals.
Availability and plans
Available
Its workflow is built and tested, and every app it needs is live. You can get it and set it up now.
Included free on the Enterprise plan; on other paid plans it's a one-time purchase per workspace (the price is on the Agents page). The Agents page in the app always shows its current status.
Before you start
- A paid plan: agents run live, and the Free plan only runs Dry Runs.
- An AI provider key (OpenAI, Anthropic, Google and more) in Settings → AI Providers. AI usage is billed by your provider.
- These apps, connected in Settings → Integrations: Slack and Google Sheets.
- A form, app or system that can send each new item to a webhook URL (the agent starts from a webhook).
- About 25 minutes.
Set it up step by step
Get the agent first (buy it, or it's already yours when your plan includes it), then in Agents → My agents press “Set up this agent”. That creates the agent's workflow in your workspace (it counts towards your plan's workflow limit) and opens the canvas with a setup checklist above it. Each item links to the exact place to go and ticks itself off when it's done.
1. Connect your AI provider
The AI steps run on your own key (OpenAI, Anthropic, Google and more). Add one in Settings → AI Providers.
2. Connect Slack
Connect the Slack workspace your fraud team uses (Settings → Integrations → Slack).
3. Connect Google Sheets
Connect the Google account that can edit your fraud case log (Settings → Integrations → Google Sheets).
4. Write your fraud rules
Open “Score the transaction” and replace the placeholder with your rules. The score is only as good as these rules and the history you send.
| Setting | What to enter | In step |
|---|---|---|
| Your fraud rules | Replace the placeholder with your rules, e.g. amounts over $5,000 from accounts under 30 days old, more than 5 transactions in an hour, billing and IP countries differ, high-risk merchant categories. Add custom score cut-offs if you want. It starts as “[PASTE YOUR FRAUD RULES HERE]” until you replace it. | “Score the transaction” |
5. Pick the Slack account and fraud channel
Open “Alert the fraud team in Slack” and pick your account and channel. Invite the app to private channels first (/invite @Fluxo Flow).
| Setting | What to enter | In step |
|---|---|---|
| Slack account | The Slack workspace alerts are posted to. Pick your connected Slack account. | “Alert the fraud team in Slack” |
| Fraud channel | The private channel your fraud analysts watch, e.g. #fraud-alerts. | “Alert the fraud team in Slack” |
6. Pick your case log and review queue
Open “Log the confirmed case” and “Add to the review queue sheet” and pick your account, spreadsheet and tab in each. Header row: Time, Transaction, Customer, Amount, Currency, Channel, Score, Level, Rules hit, Summary, Status.
| Setting | What to enter | In step |
|---|---|---|
| Google account (fraud case log) | The Google account that can edit the fraud case log spreadsheet. Pick your connected Google Sheets account. | “Log the confirmed case” |
| Fraud case log spreadsheet | Paste the link of the spreadsheet used as your fraud case log. Keep its sharing restricted to the people who need it. | “Log the confirmed case” |
| Fraud case log tab | The tab inside the spreadsheet, e.g. Cases. | “Log the confirmed case” |
| Google account (review queue) | The Google account that can edit the review queue spreadsheet. Pick your connected Google Sheets account. | “Add to the review queue sheet” |
| Review queue spreadsheet | Paste the link of the spreadsheet used as your review queue. Keep its sharing restricted to the people who need it. | “Add to the review queue sheet” |
| Review queue tab | The tab inside the spreadsheet, e.g. Review queue. | “Add to the review queue sheet” |
7. Test it with Dry Run
Press Dry Run: the agent runs on sample data with no messages sent and nothing written to your apps.
8. Switch the trigger on
Open the trigger, switch the webhook on and have your processor, core system or store send each transaction to its URL.
How it works
The agent is a normal workflow with 9 steps (1 AI step, with a person approving in Reviews). You can open, edit and monitor it like any other workflow.
- New transaction — Starts when your form or app sends data to the agent's webhook URL. Your payment processor, core system or store posts each transaction (with any customer history you have) to the webhook URL.
- Score the transaction — AI step (runs on your AI provider key). AI checks the transaction against your fraud rules and the customer history you send, scores the risk 0–100, lists the rules hit and writes a case summary.
- High, medium or low risk? — Decision: picks the branch to follow. Scores of 70 or more go to an analyst now; 40–69 go to the review queue sheet; the rest are kept in the run history. Change the numbers on the router to tune it.
- Alert the fraud team in Slack — Slack: Post a message. Branch: High. Posts the transaction, score, rules hit and case summary to your fraud channel so an analyst looks now.
- Fraud team alerted — Kept in the run history. The run history keeps the alert that was posted.
- Analyst decides — A person approves or rejects it in Reviews (the run waits). Branch: High. A fraud analyst reviews the case in Reviews and takes any action (hold, refund, block, contact the customer) in your own systems; approving logs the case as confirmed for follow-up.
- Log the confirmed case — Google Sheets: Add a row. Branch: Confirmed. Appends the case to your fraud case log sheet for follow-up and reporting.
- Add to the review queue sheet — Google Sheets: Add a row. Branch: Medium. Medium-risk transactions are appended to your review queue sheet for an analyst to check in their next pass.
- Keep low-risk in history — Kept in the run history. Branch: Low. Low-risk transactions are kept in the run history with their score; nothing is flagged.
Test it with Dry Run
Press Dry Run in the canvas. The agent runs on the sample data stored on its trigger (the “Sample data for Dry Run” box), so you can check every step's output before anything is live. Edit the sample to match the fields your own form or app sends.
Sample data fields
transaction_id, timestamp, customer_id, customer_email, amount, currency, channel, merchant_category, billing_country, ip_country, shipping_address_new, customer_history.account_age_days, customer_history.average_amount, customer_history.transactions_last_24h, customer_history.failed_attempts_last_24h, customer_history.previous_chargebacks.
- Nothing is sent or written: app actions, emails and Slack posts are simulated, and AI steps don't call your AI provider.
- Approval steps use the Dry Run decision you pick in the step's settings (approved, rejected or timeout), so you can try each branch.
Go live
- Open the trigger, switch the webhook on and have your processor, core system or store send each transaction to its URL.
- The webhook is protected by a secret: send it in the header shown in the Activation panel (requests without it are refused with 403). Each request starts one run.
- The setup checklist adds a “paid plan” item before activation: live runs need a paid plan (the Free plan only runs Dry Runs).
- When every checklist item is done and the trigger is on, the checklist says “Live — this agent is running”. Follow its runs in the workflow's History tab and in Analytics → Agents.
Questions
Can it listen to Stripe, Square or Shopify directly?
Send their events to the webhook from your own system, or switch the trigger to the Stripe, Square or Shopify app trigger in its settings once that app is connected (those apps are still waiting for vendor approval).
Does it block or refund payments?
No. “Hold” means the case waits in Reviews for an analyst. Any hold, refund or block is done by your team in your processor.
Does it learn each customer's behaviour?
It compares the transaction with the history fields you send (average amount, usual country, recent count…). It doesn't build or store its own model.
Troubleshooting
- “No AI provider connected” or a rejected key: connect or fix the key in Settings → AI Providers, then press Test there.
- A checklist item stays unticked: the setting is still empty or still contains its placeholder text. Open the step from the checklist and fill it in.
- An app step fails with “Needs reconnect”: the account's access was revoked or expired. Reconnect it in Settings → Integrations.
- Slack says the app isn't in the channel: in Slack, type /invite @Fluxo Flow in that channel (always needed for private channels).
- Nothing happens when your form sends data: check the webhook is switched on and the request carries the secret header (403 means it's missing or wrong).
- A run shows as paused: it's waiting for someone in Reviews to approve or reject it.
- A step failed: open the run in History and check that step in the Trace tab for the error and what it received.
Generated from the agent's own workflow, so it always matches what the agent does. Last updated .