Fraud Detection Agent

The Fraud Detection Agent monitors signups, usage patterns, and conversation data to surface coordinated fraud rings before they exhaust your credits or corrupt your platform data. It runs automated queries across your user database, identifies accounts that share suspicious characteristics — identical disposable-email domains, burst signup patterns, uniform credit consumption curves — and groups them into rings with supporting evidence attached.

Every detected ring is documented with scale, pattern, OS fingerprint, and credit spend before a pull request is opened to block the offending domains. A Slack report summarizes findings immediately so your trust and safety team always knows what was blocked and why.

Connect the agent to your user database and configure the fraud signals that matter to your platform — signup velocity by domain, feature usage patterns, credit consumption curves, and conversation content signals. Set thresholds based on your traffic baseline that define what constitutes suspicious behavior.

Define the remediation playbook: which actions the agent can take autonomously (domain blocklist PRs, Slack alerts) and which require human approval (account suspension, refunds). Configure the Slack channel for fraud reports and the GitHub repository where blocklist PRs should be opened.

Once live, the agent runs on your configured schedule in Oz. You can inspect every fraud determination in the Oz dashboard, review the evidence attached to each flagged ring, and adjust detection weights without redeploying.

BigQuery or your preferred data warehouse for user and usage data queries, GitHub for blocklist and remediation pull requests, Slack for real-time fraud investigation reports delivered to your trust and safety channel.

Verisoul or your fraud detection vendor for supplementary reputation signals, Stripe for payment pattern analysis, and your internal identity verification pipeline for cross-referencing new signups against known fraud indicators.