Fraud Detection Pipeline

advanced · 4 agents · 12 skills

A real-time fraud detection pipeline that processes transaction streams through four escalation stages. The monitor watches live transactions for threshold breaches and velocity anomalies, the pattern analyzer performs deep behavioral analysis on flagged items, the investigator assembles evidence packages for high-confidence cases, and the enforcer executes blocking actions and feeds blocked entities back into the monitoring loop.

Install

clawhub install pilot-fraud-detection-pipeline-setup

Skills used

Agents

<your-prefix>-monitor - Transaction Monitor
Transactions exceeding risk thresholds" },
Skills: pilot-stream-data, pilot-event-filter, pilot-cron, pilot-metrics
<your-prefix>-pattern-analyzer - Pattern Analyzer
Flagged transactions to analyze" },
Skills: pilot-event-filter, pilot-archive, pilot-priority-queue
<your-prefix>-investigator - Case Investigator
Cases requiring investigation" },
Skills: pilot-task-router, pilot-audit-log, pilot-dataset
<your-prefix>-enforcer - Fraud Enforcer
Verdicts to enforce" },
Skills: pilot-blocklist, pilot-webhook-bridge, pilot-audit-log, pilot-alert

Data flows

<your-prefix>-monitor → <your-prefix>-pattern-analyzer:1002 - flagged transactions exceeding risk thresholds
<your-prefix>-pattern-analyzer → <your-prefix>-investigator:1002 - high-risk cases with behavioral analysis
<your-prefix>-investigator → <your-prefix>-enforcer:1002 - fraud verdicts with recommended actions
<your-prefix>-enforcer → <your-prefix>-monitor:1002 - blocked entities to update detection rules

Quick start

# Replace <your-prefix> with a unique name for your deployment (e.g. acme)
# On transaction monitoring server
clawhub install pilot-stream-data pilot-event-filter pilot-cron pilot-metrics
pilotctl set-hostname <your-prefix>-monitor

# On pattern analysis server
clawhub install pilot-event-filter pilot-archive pilot-priority-queue
pilotctl set-hostname <your-prefix>-pattern-analyzer

# On investigation server
clawhub install pilot-task-router pilot-audit-log pilot-dataset
pilotctl set-hostname <your-prefix>-investigator

# On enforcement server
clawhub install pilot-blocklist pilot-webhook-bridge pilot-audit-log pilot-alert
pilotctl set-hostname <your-prefix>-enforcer
# monitor <-> pattern-analyzer (flagged transactions)
# On monitor:
pilotctl handshake <your-prefix>-pattern-analyzer "setup: fraud-detection-pipeline"
# On pattern-analyzer:
pilotctl handshake <your-prefix>-monitor "setup: fraud-detection-pipeline"

# pattern-analyzer <-> investigator (high-risk cases)
# On pattern-analyzer:
pilotctl handshake <your-prefix>-investigator "setup: fraud-detection-pipeline"
# On investigator:
pilotctl handshake <your-prefix>-pattern-analyzer "setup: fraud-detection-pipeline"

# investigator <-> enforcer (fraud verdicts)
# On investigator:
pilotctl handshake <your-prefix>-enforcer "setup: fraud-detection-pipeline"
# On enforcer:
pilotctl handshake <your-prefix>-investigator "setup: fraud-detection-pipeline"

# enforcer <-> monitor (blocked entities feedback loop)
# On enforcer:
pilotctl handshake <your-prefix>-monitor "setup: fraud-detection-pipeline"
# On monitor:
pilotctl handshake <your-prefix>-enforcer "setup: fraud-detection-pipeline"
pilotctl trust