Fraud Triage n8n Workflow: Orders to Slack & Airtable

Instant fraud triage for new orders—auto-approve safe ones, alert teams on risky ones

The Fraud Triage n8n Workflow: Orders to Slack & Airtable receives e-commerce orders via a webhook, calculates a fraud risk score for orders over 500, logs decisions to Postgres, then routes low-risk orders to a fulfillment HTTP API while medium/high-risk orders are sent to Slack and tracked in Airtable.

What this workflow does

• Receives order data through an HTTP POST webhook (POST /order), expecting fields such as id, orderTotal, billing/shipping addresses, previousOrders, and country/payment attributes.
• Computes risk for higher-value orders: when orderTotal > 500, it calculates a fraud risk score and risk level using signals including shipping/billing, order history, IP/card country, and payment-method data.
• Persists triage results by upserting order ID, risk score, risk level, and status into a Postgres table (e.g., public.orders).
• Applies decision logic:
  • Low-risk → auto-approved
  • Medium-risk → queued for review
  • High-risk → manual review
• Routes outcomes:
  • Auto-approved orders are sent to a fulfillment HTTP API with an approval flag and retry settings.
  • Review/high-risk cases trigger a Slack alert and create a pending review record in Airtable.
• Responds to the webhook with JSON containing the order ID and the decision; workflow errors are posted to a separate Slack channel.

Use cases

• SaaS and e-commerce operators that want fraud triage automation without blocking all orders.
• Teams that need Slack notifications plus Airtable review tracking for medium/high-risk transactions.
• Automation engineers building a reliable webhook-to-decision-to-fulfillment pipeline with Postgres persistence.

Technical details

• n8n nodes / integrations: webhook, if, code, postgres, slack, airtable.
• Core flow: webhook → risk scoring → Postgres upsert → decision branching → fulfillment HTTP API / Slack + Airtable → JSON response.