This workflow follows the Emailsend → HTTP Request recipe pattern — see all workflows that pair these two integrations.
The workflow JSON
Copy or download the full n8n JSON below. Paste it into a new n8n workflow, add your credentials, activate. Full import guide →
{
"name": "Fraud Alert Pipeline",
"nodes": [
{
"parameters": {
"httpMethod": "POST",
"path": "fraud/cli-spoofing",
"authentication": "headerAuth",
"headerAuth": {
"name": "x-webhook-secret",
"value": "={{$env.WEBHOOK_SECRET}}"
}
},
"id": "cli-webhook",
"name": "CLI Spoofing Webhook",
"type": "n8n-nodes-base.webhook",
"typeVersion": 1,
"position": [
250,
300
]
},
{
"parameters": {
"httpMethod": "POST",
"path": "fraud/irsf",
"authentication": "headerAuth"
},
"id": "irsf-webhook",
"name": "IRSF Webhook",
"type": "n8n-nodes-base.webhook",
"typeVersion": 1,
"position": [
250,
500
]
},
{
"parameters": {
"httpMethod": "POST",
"path": "fraud/wangiri",
"authentication": "headerAuth"
},
"id": "wangiri-webhook",
"name": "Wangiri Webhook",
"type": "n8n-nodes-base.webhook",
"typeVersion": 1,
"position": [
250,
700
]
},
{
"parameters": {
"conditions": {
"number": [
{
"value1": "={{$json.risk_score}}",
"operation": "larger",
"value2": 0.7
}
]
}
},
"id": "check-risk",
"name": "Check Risk Level",
"type": "n8n-nodes-base.if",
"typeVersion": 1,
"position": [
500,
300
]
},
{
"parameters": {
"fromEmail": "alerts@acm.ng",
"toEmail": "fraud-team@acm.ng",
"subject": "\ud83d\udea8 CLI Spoofing Alert - {{$json.spoofing_type}}",
"text": "CLI Spoofing Detected\n\nPresented CLI: {{$json.presented_cli}}\nActual CLI: {{$json.actual_cli}}\nSpoofing Type: {{$json.spoofing_type}}\nConfidence: {{$json.confidence_score * 100}}%\n\nTime: {{$json.created_at}}"
},
"id": "send-cli-email",
"name": "Send CLI Alert Email",
"type": "n8n-nodes-base.emailSend",
"typeVersion": 1,
"position": [
750,
200
]
},
{
"parameters": {
"fromEmail": "alerts@acm.ng",
"toEmail": "fraud-team@acm.ng",
"subject": "\u26a0\ufe0f IRSF Alert - {{$json.destination_country}}",
"text": "IRSF Fraud Attempt Detected\n\nSource: {{$json.source_number}}\nDestination: {{$json.destination_number}}\nCountry: {{$json.destination_country}}\nRisk Score: {{$json.risk_score * 100}}%\nEstimated Loss: \u20a6{{$json.estimated_loss}}\n\nAction: {{$json.action_taken}}\nTime: {{$json.created_at}}"
},
"id": "send-irsf-email",
"name": "Send IRSF Alert Email",
"type": "n8n-nodes-base.emailSend",
"typeVersion": 1,
"position": [
500,
500
]
},
{
"parameters": {
"url": "={{$env.PUSH_NOTIFICATION_URL}}",
"method": "POST",
"bodyParameters": {
"parameters": [
{
"name": "title",
"value": "Wangiri Detected"
},
{
"name": "body",
"value": "Suspicious call from {{$json.source_number}} ({{$json.ring_duration_ms}}ms ring)"
},
{
"name": "target_number",
"value": "={{$json.target_number}}"
}
]
}
},
"id": "send-wangiri-push",
"name": "Send Wangiri Push",
"type": "n8n-nodes-base.httpRequest",
"typeVersion": 3,
"position": [
500,
700
]
},
{
"parameters": {
"operation": "set",
"key": "fraud:alert:{{$json.id}}",
"value": "={{JSON.stringify($json)}}",
"expiration": 86400
},
"id": "cache-alert",
"name": "Cache Alert",
"type": "n8n-nodes-base.redis",
"typeVersion": 1,
"position": [
750,
400
],
"credentials": {
"redis": {
"name": "<your credential>"
}
}
},
{
"parameters": {
"channel": "#fraud-alerts",
"text": "\ud83d\udea8 *{{$json.event_type}}* detected\n\u2022 Risk: {{$json.risk_score * 100}}%\n\u2022 Time: {{$json.created_at}}"
},
"id": "slack-notify",
"name": "Slack Notification",
"type": "n8n-nodes-base.slack",
"typeVersion": 1,
"position": [
750,
600
]
}
],
"connections": {
"CLI Spoofing Webhook": {
"main": [
[
{
"node": "Check Risk Level",
"type": "main",
"index": 0
}
]
]
},
"Check Risk Level": {
"main": [
[
{
"node": "Send CLI Alert Email",
"type": "main",
"index": 0
},
{
"node": "Cache Alert",
"type": "main",
"index": 0
}
]
]
},
"IRSF Webhook": {
"main": [
[
{
"node": "Send IRSF Alert Email",
"type": "main",
"index": 0
},
{
"node": "Slack Notification",
"type": "main",
"index": 0
}
]
]
},
"Wangiri Webhook": {
"main": [
[
{
"node": "Send Wangiri Push",
"type": "main",
"index": 0
}
]
]
}
},
"settings": {
"executionOrder": "v1"
},
"staticData": null,
"tags": [
{
"name": "fraud",
"id": "1"
}
]
}
Credentials you'll need
Each integration node will prompt for credentials when you import. We strip credential IDs before publishing — you'll add your own.
redis
For the full experience including quality scoring and batch install features for each workflow upgrade to Pro
About this workflow
Fraud Alert Pipeline. Uses emailSend, httpRequest, redis, slack. Webhook trigger; 9 nodes.
Source: https://github.com/abiolaogu/VoxGuard/blob/main/backend/n8n/workflows/fraud-alert-pipeline.json — original creator credit. Request a take-down →
Related workflows
Workflows that share integrations, category, or trigger type with this one. All free to copy and import.
Fraud Alert Notification. Uses slack, emailSend, httpRequest. Webhook trigger; 6 nodes.
This workflow automates competitive price intelligence using Bright Data's enterprise web scraping API. On a scheduled basis (default: daily at 9 AM), the system loops through configured competitor pr
🛡️ Jamf Policy Integrity Monitor
This workflow automatically detects at-risk customers by listening for inactivity signals from Mixpanel, scoring their churn risk, syncing everything to HubSpot, creating a prioritized ClickUp follow-
This n8n workflow proactively scans and aggregates threat intelligence, network logs, and vulnerability data every 15 minutes to detect emerging risks across the infrastructure. It analyzes anomalies,