Detect fraud in user activity with PostgreSQL, OpenAI and Slack

AI Fraud Detection Workflow > n8n + PostgreSQL + OpenAI + Slack --- This AI Fraud Detection Workflow is an automated n8n pipeline that analyzes user activity in real time using a combination of rule-based fraud detection, AI interpretation and historical behavioral context. It processes events like login attempts, password changes or transactions, evaluates risk, stores results in PostgreSQL and triggers alerts for high-risk activity. Quick Implementation Steps 1. Import workflow into n8n 2. Configure webhook endpoint /user-activity 3. Set up PostgreSQL connection and useractivitylogs table 4. Add OpenAI API credentials 5. Configure alerting node (Slack or alternative) 6. Activate workflow and test with sample payload What It Does This workflow continuously monitors user activity events and evaluates them for suspicious behavior. When a user event is received, the system: - Validates the incoming request - Fetches last 10 user activity logs from PostgreSQL - Builds behavioral context - Applies rule-based fraud scoring - Sends structured data to AI for interpretation - Combines AI + rule-based decisions - Stores results in the database - Sends alerts for HIGH-risk cases It helps detect anomalies like: - New device usage - Impossible travel (rapid location change) - Foreign access attempts - Sensitive actions like password changes Who It's For - Fintech applications - Banking & payment platforms - SaaS applications with authentication systems - E-commerce platforms - Security and fraud prevention teams - DevOps and backend engineers Requirements to Use This Workflow - n8n account (cloud or self-hosted) - PostgreSQL database - OpenAI API key - Alerting system (Slack / Email / Teams / etc.) - Webhook support for incoming user activity events Database Schema sql CREATE TABLE useractivitylogs ( id BIGSERIAL PRIMARY KEY, userid TEXT, event TEXT, ip TEXT, location TEXT, device TEXT, riskscore INT, aiflag TEXT, createdat TIMESTAMP DEFAULT NOW() ); How It Works & Setup Guide 1. Webhook Trigger Receives user activity via POST request: Endpoint: /user-activity Payload: sql { "userid": "user002", "event": "passwordchange", "ip": "192.165.1.45", "location": "United States", "device": "Chrome Browser - Windows" } 2. Request Validation Ensures required fields exist: - userid - event - ip - location - device 3. Fetch User History (PostgreSQL) Retrieves last 10 activity logs for the user to build behavioral context. 4. Context Builder Merges: - Current event - Historical activity logs This helps detect behavioral anomalies. 5. Rule-Based Fraud Engine Applies deterministic fraud logic: - New device detection - Impossible travel detection - Foreign location access - Sensitive operations (password change, withdrawal) Outputs: - rulescore - rulerisk (LOW / MEDIUM / HIGH) - riskreasons 6. AI Fraud Interpreter (OpenAI) The AI does not calculate risk. It only interprets rule-based output and returns: json { "risklevel": "LOW | MEDIUM | HIGH", "reason": "short explanation" } 7. AI Response Cleaner - Parses AI output safely - Extracts: - airisk - aireason 8. Decision Fusion Layer Final risk logic: - If rule OR AI = HIGH → FINAL = HIGH - Else if either = MEDIUM → FINAL = MEDIUM - Else → LOW 9. Database Logger Stores final result in PostgreSQL: - userid - event - ip - location - device - riskscore (rule-based) - aiflag (AI risk level) 10. High Risk Filter Triggers only when: json finalrisk === "HIGH" 11. Alert Dispatcher Sends fraud alert via Slack (or can be replaced with email, SMS, Teams, etc.) How to Customize Nodes - Fraud Rules Engine: Adjust scoring weights and conditions - AI Prompt: Add domain-specific fraud rules or compliance logic - Database Node: Add extra fields like sessionid, useragent - Alert System: Replace Slack with email, SMS or webhook - Threshold Logic: Modify HIGH/MEDIUM/LOW conditions Add-ons (Enhancements) - GeoIP enrichment using IP tracking - Device fingerprinting integration - Real-time fraud dashboard - Machine learning an