How to Protect Your FlutterFlow App from Fraud

Firebase App Check is the single most impactful fraud prevention tool for Firebase-based apps. It adds a cryptographic attestation to every request from your app, proving to Firebase that the request originated from your legitimate app binary. Without it, anyone can use your public Firebase config to call Firestore, Cloud Functions, and Storage directly from curl or a script. In the Firebase console, go to App Check under the Build section. For Android, enable Play Integrity. For iOS, enable App Attest. For web, enable reCAPTCHA v3 (free). Enable monitoring mode first for 7 days, review the metrics, then click Enforce. After enforcement, requests without valid attestation tokens are automatically rejected by Firebase.

Stripe Radar is Stripe's machine-learning fraud detection engine and is active on all Stripe accounts at no extra cost. In your Stripe Dashboard, go to Radar → Rules. By default, Radar blocks obviously fraudulent cards. Enhance this by adding custom rules: block charges when 'risk_score > 75', block when 'is_prepaid_card = true' if your business does not accept prepaid cards, and require 3D Secure when 'risk_score > 50'. 3D Secure adds a bank verification step for suspicious charges, dramatically reducing chargebacks. In your FlutterFlow Cloud Function that creates a Payment Intent, add stripe_3d_secure: 'automatic' to trigger it based on Radar's assessment.

1// Cloud Function: createPaymentIntent with fraud protection
2const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
3
4exports.createPaymentIntent = functions.https.onCall(async (data, context) => {
5  if (!context.auth) {
6    throw new functions.https.HttpsError('unauthenticated', 'Login required');
7  }
8
9  const { amount, currency, customerId } = data;
10
11  // Enforce minimum and maximum amounts server-side
12  if (amount < 50 || amount > 1000000) {
13    throw new functions.https.HttpsError('invalid-argument', 'Invalid amount');
14  }
15
16  const paymentIntent = await stripe.paymentIntents.create({
17    amount,
18    currency: currency || 'usd',
19    customer: customerId,
20    // Let Stripe Radar decide when to trigger 3D Secure
21    payment_method_options: {
22      card: { request_three_d_secure: 'automatic' },
23    },
24    // Add metadata for your own fraud review
25    metadata: {
26      user_id: context.auth.uid,
27      ip_address: context.rawRequest?.ip || 'unknown',
28    },
29  });
30
31  return { clientSecret: paymentIntent.client_secret };
32});

Fraudsters create throwaway accounts to test stolen cards. Requiring a verified email before allowing purchases adds a meaningful barrier. In FlutterFlow, add an account status check before any payment flow: verify that the user's emailVerified field in Firebase Auth (or a custom emailVerified field in Firestore if using a custom OTP system) is true. Use a Conditional Action in FlutterFlow: if currentUserEmailVerified is false, navigate to the email verification page instead of the checkout page. Add a similar check in your createPaymentIntent Cloud Function: if the Firebase Auth token does not have email_verified: true, throw an unauthenticated error.

Bot attacks typically make hundreds or thousands of requests from a small number of IP addresses. Add IP-based rate limiting to your Cloud Functions to detect and block this pattern. In each sensitive Cloud Function, extract the client IP from context.rawRequest.ip (for HTTPS callable functions) or req.ip (for HTTP functions). Store a request counter in Firestore under rate_limits/{ipHash} with a 1-minute rolling window. If requests from a single IP exceed your threshold (typically 20-30 per minute for payment endpoints), return a rate-limit error and log the incident. Hash the IP address before storing it to avoid storing PII.

1// IP rate limiting utility for Cloud Functions
2const crypto = require('crypto');
3
4async function checkIpRateLimit(db, rawIp, endpoint, maxPerMinute = 20) {
5  const ipHash = crypto
6    .createHash('sha256')
7    .update(rawIp + process.env.RATE_LIMIT_SALT)
8    .digest('hex')
9    .substring(0, 16);
10
11  const key = `${ipHash}_${endpoint}`;
12  const ref = db.collection('ip_rate_limits').doc(key);
13  const now = Date.now();
14  const windowStart = now - 60000;
15
16  const result = await db.runTransaction(async (tx) => {
17    const doc = await tx.get(ref);
18    const data = doc.exists ? doc.data() : { count: 0, windowStart: now };
19
20    if (data.windowStart < windowStart) {
21      tx.set(ref, { count: 1, windowStart: now,
22        expiresAt: new Date(now + 300000) });
23      return { allowed: true };
24    }
25    if (data.count >= maxPerMinute) {
26      return { allowed: false, retryAfter: 60 - Math.floor((now - data.windowStart) / 1000) };
27    }
28    tx.update(ref, {
29      count: admin.firestore.FieldValue.increment(1) });
30    return { allowed: true };
31  });
32
33  return result;
34}

Beyond payment fraud, watch for account-level fraud signals: multiple accounts from the same IP, unusually fast sign-up to purchase flows (bots complete checkout in under 5 seconds), email addresses from known disposable email providers, and sign-ups with sequential or obviously fake usernames. In your user registration Cloud Function, check the email domain against a disposable email blocklist (block-list available as an npm package: disposable-email-domains). Log the sign-up IP and time-to-first-purchase. For RapidDev clients building marketplace apps, we recommend flagging new accounts that make a purchase within 60 seconds of sign-up for manual review rather than automatic blocking.