How to Integrate Machine Learning for Fraud Detection in FlutterFlow

Create two collections for the fraud detection system. The transactions collection stores each transaction: transactionId (auto-generated), userId (String), amount (Double), currency (String), merchantCategory (String), timestamp (Timestamp), deviceId (String: device fingerprint), ipAddress (String), location (GeoPoint), riskScore (Double: filled by fraud detection), riskDecision (String: 'allow', 'review', 'block'), status (String: 'pending', 'completed', 'blocked'). The fraud_events collection stores flagged items for review: eventId, transactionId, userId, riskScore, features (Map: the input features sent to the model), decision, reviewStatus (String: 'pending', 'cleared', 'confirmed_fraud'), reviewedBy (String UID), reviewedAt (Timestamp), notes (String). Admin queries fraud_events filtered by reviewStatus == 'pending' for the review queue.

Create a Cloud Function named extractFraudFeatures that takes a transaction object and userId. The function queries Firestore to build the feature vector: (1) Transaction velocity: count transactions by this user in the last 24 hours, (2) Amount anomaly: compare current amount to the user's 30-day average transaction amount, (3) Device consistency: check if the current deviceId matches the user's primary device, (4) Location anomaly: calculate distance in km between the current location and the user's most common location (use GeoPoint math), (5) Time pattern: compare current hour to the user's typical transaction hour distribution, (6) Account age days: days since the user's account was created (newer accounts are higher risk). Return these as a normalized feature array: [txVelocity, amountRatio, isNewDevice, locationDistanceKm, timeAnomaly, accountAgeDays]. These six features are the input to your ML model.

1// Cloud Function: extractFraudFeatures
2const admin = require('firebase-admin');
3
4async function extractFraudFeatures(userId, transaction) {
5  const db = admin.firestore();
6  const now = new Date();
7  const oneDayAgo = new Date(now - 24 * 60 * 60 * 1000);
8  const thirtyDaysAgo = new Date(now - 30 * 24 * 60 * 60 * 1000);
9
10  // 1. Transaction velocity (last 24 hours)
11  const recentTxSnap = await db.collection('transactions')
12    .where('userId', '==', userId)
13    .where('timestamp', '>=', oneDayAgo)
14    .get();
15  const txVelocity = recentTxSnap.size;
16
17  // 2. Amount anomaly ratio
18  const historySnap = await db.collection('transactions')
19    .where('userId', '==', userId)
20    .where('timestamp', '>=', thirtyDaysAgo)
21    .get();
22  const amounts = historySnap.docs.map(d => d.data().amount);
23  const avgAmount = amounts.length > 0
24    ? amounts.reduce((a, b) => a + b, 0) / amounts.length
25    : transaction.amount;
26  const amountRatio = transaction.amount / avgAmount;
27
28  // 3. Device consistency
29  const userDoc = await db.doc(`users/${userId}`).get();
30  const primaryDevice = userDoc.data()?.primaryDeviceId || '';
31  const isNewDevice = transaction.deviceId !== primaryDevice ? 1 : 0;
32
33  // 4. Account age in days
34  const createdAt = userDoc.data()?.createdAt?.toDate() || now;
35  const accountAgeDays =
36    (now - createdAt) / (1000 * 60 * 60 * 24);
37
38  return {
39    txVelocity,
40    amountRatio,
41    isNewDevice,
42    accountAgeDays: Math.floor(accountAgeDays),
43    features: [txVelocity, amountRatio, isNewDevice,
44               accountAgeDays],
45  };
46}

Create the main Cloud Function named checkFraud that orchestrates the full pipeline. It calls extractFraudFeatures, then sends the feature array to your ML model endpoint. For Vertex AI: make an authenticated POST to https://us-central1-aiplatform.googleapis.com/v1/projects/{projectId}/locations/us-central1/endpoints/{endpointId}:predict with the feature array. The model returns a fraud probability (0.0-1.0). For testing without a trained model, use Google Cloud's pre-built AutoML Tables or a simple rule-based score while you gather training data. Risk decisions: score >= 0.7 → block (return error to client, create fraud_event with reviewStatus 'pending'), score 0.4-0.69 → flag for review (allow transaction but create fraud_event, send admin notification), score < 0.4 → allow (log score on transaction, no action). Always store the riskScore and features on the transaction document for audit trail.

1// Cloud Function: checkFraud (main)
2exports.checkFraud = functions.https.onCall(
3  async (data, context) => {
4    if (!context.auth) {
5      throw new functions.https.HttpsError(
6        'unauthenticated', 'User must be logged in');
7    }
8
9    const { transaction } = data;
10    const userId = context.auth.uid;
11
12    // Extract features
13    const { features, ...featureData } =
14      await extractFraudFeatures(userId, transaction);
15
16    // Score with ML model (example: simple rule-based)
17    // Replace with Vertex AI endpoint call in production
18    let riskScore = 0.1;
19    if (featureData.amountRatio > 5) riskScore += 0.4;
20    if (featureData.isNewDevice === 1) riskScore += 0.2;
21    if (featureData.txVelocity > 10) riskScore += 0.3;
22    if (featureData.accountAgeDays < 7) riskScore += 0.2;
23    riskScore = Math.min(riskScore, 1.0);
24
25    // Three-tier decision
26    let decision;
27    if (riskScore >= 0.7) {
28      decision = 'block';
29    } else if (riskScore >= 0.4) {
30      decision = 'review';
31    } else {
32      decision = 'allow';
33    }
34
35    // Store fraud event if flagged or blocked
36    if (decision !== 'allow') {
37      await admin.firestore().collection('fraud_events').add({
38        userId, riskScore, decision,
39        features: featureData,
40        transactionData: transaction,
41        reviewStatus: 'pending',
42        createdAt: admin.firestore.FieldValue.serverTimestamp(),
43      });
44    }
45
46    if (decision === 'block') {
47      throw new functions.https.HttpsError(
48        'permission-denied',
49        'Transaction blocked for security review');
50    }
51
52    return { allowed: true, riskScore, decision };
53  });

In FlutterFlow's API Manager, create an API Call to your checkFraud Cloud Function (or use the callable function via a Custom Action with Cloud Functions SDK). On your payment or purchase button, modify the action flow to: (1) Call checkFraud with the transaction details — amount, merchant category, current device info, (2) Check the response: if the call returns an error (blocked), show a Dialog informing the user 'Transaction declined for security review. Contact support if you believe this is an error.' Do not say 'fraud' — use neutral language to avoid alarming legitimate users. If the response shows decision: 'review', proceed with the transaction but show a note 'This transaction is under review and may take additional time.' If decision is 'allow', proceed normally.

Create an admin-protected page in FlutterFlow named FraudReview. Protect it with a Conditional widget checking the current user's role == 'admin' (from their Firestore user document). Add a Backend Query on the fraud_events collection filtered by reviewStatus == 'pending', ordered by createdAt descending, real-time (Single Time Query: OFF). Add a ListView where each item shows: risk score (color-coded: red > 0.7, orange 0.4-0.7), user display name, transaction amount, which features triggered the high score, and the timestamp. Each item has two buttons: Clear (legitimate) and Confirm Fraud. The Clear button calls Update Document on the fraud_events doc setting reviewStatus: 'cleared', reviewedBy: currentUser.uid, reviewedAt: serverTimestamp(). The Confirm Fraud button sets reviewStatus: 'confirmed_fraud' and triggers a Cloud Function to suspend the user account. RapidDev has built fraud review dashboards for multiple FlutterFlow applications in the fintech space.