CUSTOMER SUPPORT
Refund Fraud: Weekly Ring-Cluster Report to Notion
Weekly, clusters refund requests in Postgres by shared payment fingerprint, address, and device to surface coordinated fraud rings.
How it runs
The automated pipeline, trigger to output.
- TriggerWeekly schedule
- ActionCluster refunds by shared signals in PostgresPostgres
- LogicFilter to significant clusters and rank by total
- ActionCreate ranked cluster report in NotionNotion
- OutputPost top-rings summary and link to SlackSlack
What it does
Finds the rings, not just the individuals. Once a week it groups historical refunds by shared signals — card fingerprint, shipping address, device, email pattern — to reveal clusters of accounts working together, then ranks them by total dollars refunded so investigators tackle the biggest losses first.
When to use it
Run this for periodic fraud-investigation work when you want a strategic, ranked view of organized refund abuse rather than per-ticket alerts. It complements the real-time gates by catching slow-burn rings that individually stay under thresholds.
How it works
- 1A weekly schedule starts the report.
- 2Postgres runs a clustering query that groups refunds by shared fingerprint, address, and device signals.
- 3A logic step keeps only clusters above a member-count and dollar threshold and ranks them by total refunded.
- 4A Notion page is created with each ranked cluster, its members, and shared signals for the investigation log.
- 5A Slack summary links the report and highlights the top three rings of the week.
Set it up
What you configure once, before turning it on.
- 1Connect PostgresAny Postgres URL — query, write, migrate.
- 2Connect NotionPages, databases, comments.
- 3Connect SlackChannels, DMs, threads, mentions.
- 4Set each agent's modelWe leave models unset so you pick the tier — fast + cheap, or top-quality.
- 5Tune it to your dataEdit the prompts, filters, and field mappings so it matches how your team works.
- 6Test, then turn it onRun once against a sample, confirm the output, then enable the trigger.
More Customer Support workflows
Send a tailored Loom onboarding sequence on Front first-reply
When a new customer's first email lands in Front, this picks the Loom onboarding walkthroughs matching their plan and use case, builds a friendly sequenced reply.
Suggest the right Loom video by classifying Intercom message intent
Reads each new inbound Intercom conversation, classifies what the customer is trying to do, and surfaces the best-matching Loom walkthrough to the agent as an internal note.
Draft personalized fix-live replies for support to review
When a Sentry issue resolves, an agent reads each linked ticket's full thread and drafts a tailored 'your fix is live' reply per requester.
Close the loop with requesters when a Linear bug moves to Done
When a Linear issue created from a support escalation moves to Done after deploy, look up the originating Zendesk tickets and notify each requester that their reported bug is…
Reopen and notify Front conversations when their bug fix deploys
When a deploy resolves a Sentry issue, find the snoozed or closed Front conversations linked to it, reopen them, and send the customer a reply that the fix is now live.
Tell Intercom users their reported bug shipped after a Vercel deploy
On a successful Vercel production deployment, match the release's resolved Sentry issues to Intercom conversations and message each affected user that their reported issue is…
Run it inside a business
This workflow drops into a full company template. Import the org, and this is one of the playbooks its agents run.
Run this workflow in your colony.
14-day trial. No DevOps. No Sales call. Provisioned in under a minute.