The Fraud Detection Agent monitors signups, usage patterns, and conversation data to surface coordinated fraud rings before they exhaust your credits or corrupt your platform data. It runs automated queries across your user database, identifies accounts that share suspicious characteristics — identical disposable-email domains, burst signup patterns, uniform credit consumption curves — and groups them into rings with supporting evidence attached.

Every detected ring is documented with scale, pattern, OS fingerprint, and credit spend before a pull request is opened to block the offending domains. A Slack report summarizes findings immediately so your trust and safety team always knows what was blocked and why.

Paste this prompt into Warp — or any agent runtime that supports skills:

Clone https://github.com/warpdotdev/fraud-detection-agent-oss.git (or use my
existing clone) and run the setup skill at .agents/skills/setup/SKILL.md to
deploy fraud-bot.

The setup skill handles cloning, schema config, secret registration, environment creation, and the first run — interactively, asking you only for the values it can't discover.

Or set it up manually:

1. Point the schema config at your warehouse

Copy config/schema.json to config/schema.local.json and set your project, datasets, tables, and Metabase database IDs. SCHEMA.md documents the column contract each logical table must satisfy.

2. Register secrets

Store credentials as team-scoped Oz secrets — they are injected as environment variables at runtime:

oz secret create --team METABASE_API_KEY   # prompts for the value
oz secret create --team SLACK_BOT_TOKEN
# Optional, for the appeals / verification skills:
oz secret create --team BOT_FRONT_API_KEY
oz secret create --team SLACK_COMMUNITY_BOT_TOKEN
oz secret create --team VERISOUL_API_KEY

3. Create an environment

Create an Oz environment that includes this repo — plus your own server or data-model repos for extra context — then find its ID with oz environment list.

4. Run

Kick off a one-off cloud run, or put the analysis on a daily schedule:

oz agent run-cloud \
  --environment <ENV_ID> \
  --prompt "Read instructions.md and run daily fraud detection analysis"

oz schedule create \
  --name "Daily Fraud Detection" \
  --cron "0 9 * * *" \
  --environment <ENV_ID> \
  --prompt "Read instructions.md and run daily fraud detection analysis"

Once live, you can inspect every fraud determination in the Oz dashboard, review the evidence attached to each flagged ring, and adjust detection weights without redeploying.

BigQuery or your preferred data warehouse for user and usage data queries, GitHub for blocklist and remediation pull requests, Slack for real-time fraud investigation reports delivered to your trust and safety channel.

Verisoul or your fraud detection vendor for supplementary reputation signals, Stripe for payment pattern analysis, and your internal identity verification pipeline for cross-referencing new signups against known fraud indicators.