{
  "id": "bW6ZMtS9WKREWhS0",
  "meta": {
    "templateCredsSetupCompleted": true
  },
  "name": "WooCommerce Fraud Detection & Slack Alert Workflow",
  "tags": [],
  "nodes": [
    {
      "id": "f327a8a4-60cd-4f1b-9293-04283954c39d",
      "name": "Cron: Fetch Orders",
      "type": "n8n-nodes-base.scheduleTrigger",
      "position": [
        -432,
        64
      ],
      "parameters": {
        "rule": {
          "interval": [
            {}
          ]
        }
      },
      "typeVersion": 1.2
    },
    {
      "id": "54183cda-42ff-4e26-8a2b-9ce14775f2da",
      "name": "Fetch Order (WooCommerce)",
      "type": "n8n-nodes-base.wooCommerce",
      "position": [
        -224,
        64
      ],
      "parameters": {
        "orderId": "511",
        "resource": "order",
        "operation": "get"
      },
      "credentials": {
        "wooCommerceApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 1
    },
    {
      "id": "c6aeb846-d50e-45d7-8029-4ed003617812",
      "name": "Normalize Order Data",
      "type": "n8n-nodes-base.set",
      "position": [
        -16,
        64
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "076de5f0-e11c-4feb-99e8-2d70450b230e",
              "name": "order_id",
              "type": "string",
              "value": "={{ $json.id }}"
            },
            {
              "id": "71e5dc78-2c6f-492f-828f-78038773d0d1",
              "name": "status",
              "type": "string",
              "value": "={{ $json.status }}"
            },
            {
              "id": "e043f0dd-2481-4f06-bb0a-4c6097a678ce",
              "name": "order_total",
              "type": "string",
              "value": "={{ $json.total }}"
            },
            {
              "id": "910ac161-fe51-4cb2-a19e-7b4b8b1fd138",
              "name": "currency",
              "type": "string",
              "value": "={{ $json.currency }}"
            },
            {
              "id": "c3e3a76c-ec8a-4327-84ad-206552320a2e",
              "name": "billing_country",
              "type": "string",
              "value": "={{ $json.billing.country }}"
            },
            {
              "id": "0961b088-0833-4b92-bccd-668253f772dd",
              "name": "billing_postcode",
              "type": "string",
              "value": "={{ $json.billing.postcode }}"
            },
            {
              "id": "7a72f331-12f2-49ef-97da-08669956c32d",
              "name": "shipping_country",
              "type": "string",
              "value": "={{ $json.shipping.country }}"
            },
            {
              "id": "bf327353-fda3-42af-be81-e0185b4f94fd",
              "name": "shipping_postcode",
              "type": "string",
              "value": "={{ $json.shipping.postcode }}"
            },
            {
              "id": "e31064d7-da5a-4e49-a499-0c33e12c8bd2",
              "name": "email",
              "type": "string",
              "value": "={{ $json.billing.email }}"
            },
            {
              "id": "ee0f673b-013b-44b2-b873-b8974f4a8e2f",
              "name": "created_via",
              "type": "string",
              "value": "={{ $json.created_via }}"
            },
            {
              "id": "46c75b55-953c-40a3-8a2b-ac4289a44233",
              "name": "needs_payment",
              "type": "string",
              "value": "={{ $json.needs_payment }}"
            },
            {
              "id": "edbcc767-7f20-4b8e-9388-0dd61d6ee333",
              "name": "customer_ip",
              "type": "string",
              "value": "={{ $json.customer_ip_address }}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "c4e2d702-2d29-49ba-961a-3cb9487d2d88",
      "name": "Initialize Fraud Flags",
      "type": "n8n-nodes-base.set",
      "position": [
        176,
        64
      ],
      "parameters": {
        "mode": "raw",
        "options": {},
        "jsonOutput": "{\n  \"billing_shipping_mismatch\": false,\n  \"high_value_order\": false,\n  \"suspicious_email\": false,\n  \"admin_created\": false\n}\n"
      },
      "typeVersion": 3.4
    },
    {
      "id": "9187c213-008c-4cb8-bb06-18e104c46922",
      "name": "Check Eligible Status (Pending/Processing)",
      "type": "n8n-nodes-base.if",
      "position": [
        544,
        64
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "or",
          "conditions": [
            {
              "id": "c6150bbb-b375-4b4c-8bcd-8feb710223b3",
              "operator": {
                "name": "filter.operator.equals",
                "type": "string",
                "operation": "equals"
              },
              "leftValue": "={{ $('Normalize Order Data').item.json.status }}",
              "rightValue": "pending"
            },
            {
              "id": "01ed2894-8c4c-49b8-9005-4eb391da11f3",
              "operator": {
                "name": "filter.operator.equals",
                "type": "string",
                "operation": "equals"
              },
              "leftValue": "={{ $('Normalize Order Data').item.json.status }}",
              "rightValue": "processing"
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "deae4649-b8ca-4386-96d0-db4085a77e35",
      "name": "Check Address Mismatch",
      "type": "n8n-nodes-base.if",
      "position": [
        1136,
        -400
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "or",
          "conditions": [
            {
              "id": "4502debd-dd37-4af7-937c-0216289c2834",
              "operator": {
                "type": "string",
                "operation": "notEquals"
              },
              "leftValue": "={{ $('Normalize Order Data').item.json.billing_postcode }}",
              "rightValue": "={{ $('Normalize Order Data').item.json.shipping_postcode }}"
            },
            {
              "id": "b65dd36f-1ac9-4b25-a192-be840c30cb63",
              "operator": {
                "type": "string",
                "operation": "notEquals"
              },
              "leftValue": "={{ $('Normalize Order Data').item.json.billing_country }}",
              "rightValue": "={{ $('Normalize Order Data').item.json.shipping_country }}"
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "710cf0e6-cb3b-4bbf-9256-0e7773318ddf",
      "name": "Flag: Address Mismatch",
      "type": "n8n-nodes-base.set",
      "position": [
        1376,
        -416
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "8c97c1a4-b266-48cd-b050-68a0c9541254",
              "name": "billing_shipping_mismatch",
              "type": "boolean",
              "value": false
            }
          ]
        },
        "includeOtherFields": true
      },
      "typeVersion": 3.4
    },
    {
      "id": "1f5ebee0-7470-4b13-821a-334fcd9d29e6",
      "name": "Check High Value (>500)",
      "type": "n8n-nodes-base.if",
      "position": [
        1120,
        -32
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "85222dbf-d8f5-41f0-90b8-57b886619c36",
              "operator": {
                "type": "number",
                "operation": "gt"
              },
              "leftValue": "={{ Number($('Normalize Order Data').item.json.order_total) }}",
              "rightValue": 500
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "a40fda33-4987-4113-8afc-d751a5e10ae1",
      "name": "Flag: High Value Order",
      "type": "n8n-nodes-base.set",
      "position": [
        1408,
        -48
      ],
      "parameters": {
        "mode": "raw",
        "options": {},
        "jsonOutput": "{\n  \"high_value_order\": true\n}\n"
      },
      "typeVersion": 3.4
    },
    {
      "id": "69d73305-c317-4619-86d6-0326cb10ee01",
      "name": "Prepare Email",
      "type": "n8n-nodes-base.set",
      "position": [
        1120,
        320
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "61699291-bcde-4d4c-94d4-ba6f7b3b8a80",
              "name": "email_lower",
              "type": "string",
              "value": "={{ $('Normalize Order Data').item.json.email }}"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "c025bc59-5f51-44df-a18e-dfd6ab1825fa",
      "name": "Detect Disposable Email",
      "type": "n8n-nodes-base.if",
      "position": [
        1328,
        320
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "62b2e6a2-9586-4238-a125-b3470fac22f9",
              "operator": {
                "type": "string",
                "operation": "regex"
              },
              "leftValue": "={{ $json.email_lower }}",
              "rightValue": "(mailinator|tempmail|10minutemail)"
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "b0380cf2-4764-4c75-812a-cfaf2bdf7ecc",
      "name": "Flag: Suspicious Email",
      "type": "n8n-nodes-base.set",
      "position": [
        1568,
        304
      ],
      "parameters": {
        "mode": "raw",
        "options": {},
        "jsonOutput": "{\n  \"suspicious_email\": true\n}"
      },
      "typeVersion": 3.4
    },
    {
      "id": "648dcdb8-3349-4cea-a182-8f953d2a1d67",
      "name": "Check Admin Created Order",
      "type": "n8n-nodes-base.if",
      "position": [
        1104,
        720
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "547fa801-6707-43ca-a54e-f17c40070ef2",
              "operator": {
                "name": "filter.operator.equals",
                "type": "string",
                "operation": "equals"
              },
              "leftValue": "={{ $('Normalize Order Data').item.json.created_via }}",
              "rightValue": "admin"
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "183d9859-1e1d-49a0-a5f4-cd6f94e541f8",
      "name": "Mark Admin Order",
      "type": "n8n-nodes-base.set",
      "position": [
        1360,
        704
      ],
      "parameters": {
        "options": {},
        "assignments": {
          "assignments": [
            {
              "id": "4998dc09-ec7c-4348-9e95-a4b91d6f9a70",
              "name": "created_via",
              "type": "string",
              "value": "admin"
            }
          ]
        }
      },
      "typeVersion": 3.4
    },
    {
      "id": "c2a49adf-4efd-4a88-b01a-5384d5c40595",
      "name": "Merge Fraud Signals",
      "type": "n8n-nodes-base.merge",
      "position": [
        2384,
        -32
      ],
      "parameters": {
        "mode": "combine",
        "options": {
          "includeUnpaired": true
        },
        "combineBy": "combineByPosition",
        "numberInputs": 4
      },
      "typeVersion": 3.2
    },
    {
      "id": "8ad2f551-e9ff-4e73-9248-39004f5818f0",
      "name": "Calculate Fraud Score",
      "type": "n8n-nodes-base.code",
      "position": [
        2704,
        0
      ],
      "parameters": {
        "jsCode": "let score = 0;\n\nif ($json.billing_shipping_mismatch) score += 2;\nif ($json.high_value_order) score += 3;\nif ($json.suspicious_email) score += 1;\n\n// reduce risk if order created by admin\nif ($json.created_via === 'admin') score -= 2;\n\n// never allow negative score\nif (score < 0) score = 0;\n\nreturn [{\n  json: {\n    ...$json,\n    fraud_score: score\n  }\n}];\n"
      },
      "typeVersion": 2
    },
    {
      "id": "0aca5161-c3e5-49bc-a4c7-d919ff9873a4",
      "name": "Fraud Threshold Check",
      "type": "n8n-nodes-base.if",
      "position": [
        3008,
        0
      ],
      "parameters": {
        "options": {},
        "conditions": {
          "options": {
            "version": 2,
            "leftValue": "",
            "caseSensitive": true,
            "typeValidation": "strict"
          },
          "combinator": "and",
          "conditions": [
            {
              "id": "29d08cb7-13f1-4200-8e4c-2ec7a8105fe3",
              "operator": {
                "type": "number",
                "operation": "gte"
              },
              "leftValue": "={{ $json.fraud_score }}",
              "rightValue": 1
            }
          ]
        }
      },
      "typeVersion": 2.2
    },
    {
      "id": "2c2e53b8-dfb0-484a-8d1f-3f63d678352f",
      "name": "Send Slack Fraud Alert",
      "type": "n8n-nodes-base.slack",
      "position": [
        3392,
        -16
      ],
      "parameters": {
        "text": "=\ud83d\udea8 Fraud Alert Detected  \nOrder ID: {{ $('Fetch Order (WooCommerce)').item.json.id }} \nOrder Amount: \u20b9{{ $('Fetch Order (WooCommerce)').item.json.total }}\nCustomer:  {{ $('Fetch Order (WooCommerce)').item.json.billing.first_name }}{{ $('Fetch Order (WooCommerce)').item.json.billing.last_name }}\nEmail: {{ $('Fetch Order (WooCommerce)').item.json.billing.email }} \nPhone: {{ $('Fetch Order (WooCommerce)').item.json.shipping.phone }} \nFraud Score: {{ $json.fraud_score }}  \nBilling & Shipping Mismatch: {{ $json.billing_shipping_mismatch }} \nHigh Value Order: {{ $json.high_value_order }}\nSuspicious Email: {{ $json.suspicious_email }}\nCreated Via: {{ $json.created_via }} \nShipping Address: {{ $('Fetch Order (WooCommerce)').item.json.shipping.address_1 }} {{ $('Fetch Order (WooCommerce)').item.json.shipping.address_2 }} {{ $('Fetch Order (WooCommerce)').item.json.shipping.city }} {{ $('Fetch Order (WooCommerce)').item.json.shipping.state }}{{ $('Fetch Order (WooCommerce)').item.json.shipping.postcode }}\nPayment Status: {{ $('Fetch Order (WooCommerce)').item.json.payment_method }}\n",
        "select": "channel",
        "channelId": {
          "__rl": true,
          "mode": "list",
          "value": "C09S57E2JQ2",
          "cachedResultName": "n8n"
        },
        "otherOptions": {}
      },
      "credentials": {
        "slackApi": {
          "name": "<your credential>"
        }
      },
      "typeVersion": 2.3
    },
    {
      "id": "47b34f8d-0871-4ec3-819a-453f7ef81128",
      "name": "Sticky Note",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -496,
        -112
      ],
      "parameters": {
        "color": 7,
        "width": 896,
        "height": 416,
        "content": "## Order Retrieval & Preparation\nThis section triggers the workflow on a schedule, fetches order details from WooCommerce and standardizes the data. It also initializes default fraud flags to ensure all checks start with consistent values before applying any fraud detection logic."
      },
      "typeVersion": 1
    },
    {
      "id": "fab791d3-ee5e-401a-946f-ae9720939e6d",
      "name": "Sticky Note1",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        448,
        -112
      ],
      "parameters": {
        "color": 7,
        "width": 352,
        "height": 416,
        "content": "## Order Eligibility Check\nThis section verifies whether the order status is eligible for fraud analysis. Only orders in \u201cpending\u201d or \u201cprocessing\u201d states are considered, ensuring unnecessary checks are avoided for completed, cancelled or irrelevant orders."
      },
      "typeVersion": 1
    },
    {
      "id": "02aac987-d46f-409b-9b0e-a8a7886a893e",
      "name": "Sticky Note2",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        960,
        -544
      ],
      "parameters": {
        "color": 7,
        "width": 848,
        "height": 320,
        "content": "## Address Mismatch Detection\nThis section checks whether the billing and shipping details differ. A mismatch in postcode or country may indicate suspicious activity, so the workflow flags such orders for increased fraud risk evaluation."
      },
      "typeVersion": 1
    },
    {
      "id": "301e0345-e6b2-410f-accf-e72189d37643",
      "name": "Sticky Note3",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        960,
        -160
      ],
      "parameters": {
        "color": 7,
        "width": 864,
        "height": 272,
        "content": "## High-Value Order Detection\nThis section identifies orders with a total amount greater than the defined threshold (e.g., 500). High-value transactions are more likely to be targeted for fraud, so these orders are flagged to increase their overall fraud score."
      },
      "typeVersion": 1
    },
    {
      "id": "93658cdc-286a-401a-b6ed-7f96f060415b",
      "name": "Sticky Note4",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        976,
        208
      ],
      "parameters": {
        "color": 7,
        "width": 864,
        "height": 320,
        "content": "## Suspicious Email Detection\nThis section prepares and analyzes the customer\u2019s email address to detect disposable or temporary email services. If the email matches known patterns like Mailinator or TempMail, it is flagged as suspicious and contributes to fraud scoring."
      },
      "typeVersion": 1
    },
    {
      "id": "990e155d-354e-42cd-854f-38c0852f61e6",
      "name": "Sticky Note5",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        976,
        592
      ],
      "parameters": {
        "color": 7,
        "width": 880,
        "height": 320,
        "content": "## Admin Order Validation\nThis section checks whether the order was created manually by an admin. Since admin-created orders are generally trusted, the workflow marks them and reduces the fraud score to prevent false positives."
      },
      "typeVersion": 1
    },
    {
      "id": "2acb26f7-a0c3-4d48-8db3-5dc3420c3f60",
      "name": "Sticky Note6",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        2096,
        -160
      ],
      "parameters": {
        "color": 7,
        "width": 1696,
        "height": 416,
        "content": "## Fraud Scoring & Alerting\nThis section combines all fraud indicators, calculates a final fraud score and evaluates it against a threshold. If the score meets the risk level, a detailed alert is sent to Slack for immediate review and action."
      },
      "typeVersion": 1
    },
    {
      "id": "0a0cfd0c-2ee3-410b-a814-cebc2940ddc0",
      "name": "Sticky Note7",
      "type": "n8n-nodes-base.stickyNote",
      "position": [
        -1520,
        -848
      ],
      "parameters": {
        "width": 800,
        "height": 1008,
        "content": "## How the Workflow Works\n- The workflow starts automatically on a scheduled trigger, ensuring regular monitoring of incoming orders without manual intervention.\n- It fetches order details from WooCommerce and prepares the data by extracting relevant fields like amount, email, address and status.\n- Only eligible orders (pending or processing) are passed to the fraud detection pipeline to avoid unnecessary checks.\n- Multiple fraud checks are applied, such as address mismatch, high order value, suspicious email patterns and admin-created orders.\n- Each fraud condition contributes to a score, increasing or decreasing the risk level based on predefined logic.\n- All fraud signals are merged into a single dataset to calculate the final fraud score.\n- If the score crosses the defined threshold, the workflow flags the order as potentially fraudulent.\n- A detailed alert is then sent to Slack, including customer details, order value and fraud indicators for quick review.\n\n\n\n\n\n## Workflow Setup Steps\n- Create a new workflow in n8n and add a Schedule Trigger node to define how frequently the workflow should run.\n- Configure the WooCommerce node by adding API credentials and selecting the \u201cGet Order\u201d operation to fetch order data.\n- Use Set nodes to normalize order data and initialize fraud flags for consistent processing.\n- Add IF nodes to define fraud conditions such as order status check, address mismatch, high-value threshold and email validation.\n- Implement a Code node to calculate the fraud score based on all collected signals.\n- Add a Merge node to combine outputs from different fraud checks into a single flow.\n- Configure the Slack node by connecting your Slack account and selecting the target channel for alerts.\n- Test the workflow with sample orders to verify fraud scoring and ensure alerts are triggered correctly.\n- Activate the workflow so it runs automatically based on the defined schedule."
      },
      "typeVersion": 1
    }
  ],
  "active": false,
  "settings": {
    "executionOrder": "v1"
  },
  "versionId": "baeea89e-a57e-4a7b-8264-b68efb43cdad",
  "connections": {
    "Prepare Email": {
      "main": [
        [
          {
            "node": "Detect Disposable Email",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Mark Admin Order": {
      "main": [
        [
          {
            "node": "Merge Fraud Signals",
            "type": "main",
            "index": 3
          }
        ]
      ]
    },
    "Cron: Fetch Orders": {
      "main": [
        [
          {
            "node": "Fetch Order (WooCommerce)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Merge Fraud Signals": {
      "main": [
        [
          {
            "node": "Calculate Fraud Score",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Normalize Order Data": {
      "main": [
        [
          {
            "node": "Initialize Fraud Flags",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Calculate Fraud Score": {
      "main": [
        [
          {
            "node": "Fraud Threshold Check",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fraud Threshold Check": {
      "main": [
        [
          {
            "node": "Send Slack Fraud Alert",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check Address Mismatch": {
      "main": [
        [
          {
            "node": "Flag: Address Mismatch",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    },
    "Flag: Address Mismatch": {
      "main": [
        [
          {
            "node": "Merge Fraud Signals",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Flag: High Value Order": {
      "main": [
        [
          {
            "node": "Merge Fraud Signals",
            "type": "main",
            "index": 1
          }
        ]
      ]
    },
    "Flag: Suspicious Email": {
      "main": [
        [
          {
            "node": "Merge Fraud Signals",
            "type": "main",
            "index": 2
          }
        ]
      ]
    },
    "Initialize Fraud Flags": {
      "main": [
        [
          {
            "node": "Check Eligible Status (Pending/Processing)",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check High Value (>500)": {
      "main": [
        [
          {
            "node": "Flag: High Value Order",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Detect Disposable Email": {
      "main": [
        [
          {
            "node": "Flag: Suspicious Email",
            "type": "main",
            "index": 0
          }
        ],
        []
      ]
    },
    "Check Admin Created Order": {
      "main": [
        [
          {
            "node": "Mark Admin Order",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Fetch Order (WooCommerce)": {
      "main": [
        [
          {
            "node": "Normalize Order Data",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Check Eligible Status (Pending/Processing)": {
      "main": [
        [
          {
            "node": "Check Address Mismatch",
            "type": "main",
            "index": 0
          },
          {
            "node": "Check High Value (>500)",
            "type": "main",
            "index": 0
          },
          {
            "node": "Prepare Email",
            "type": "main",
            "index": 0
          },
          {
            "node": "Check Admin Created Order",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  }
}