Automate fraud checks in n8n: three ready-made workflows for leads, orders and phone numbers

You do not need to write code to put fraud checks into your forms, your shop and your spreadsheets. If you already run automations in n8n, you can add FraudNova to one of them in a few minutes by importing a ready-made workflow, creating a single credential and choosing a single threshold.

n8n is a workflow automation tool that you can use on n8n Cloud or host yourself, anywhere in the world. This guide covers three importable workflows that use only n8n's built-in nodes, and need nothing installed; if you would rather drop in one node, see the FraudNova node below. Each connects a common tool and is easy to re-wire.

The FraudNova node

The one-click path is the community node n8n-nodes-fraudnova. It is a verified node: on n8n Cloud, search "FraudNova" in the node picker; on self-hosted n8n, install it from Settings, Community nodes. Create the FraudNova API credential with your fn_ key, add the FraudNova node, and pick IP Address, Email Address or Phone Number, then Check or Check many. Every result carries a flagged field, so one IF node on {{ $json.flagged }} replaces the three HTTP Request nodes and the six-part condition in the templates. A failed check is refunded and is never flagged, and billing is unchanged at 1 credit per check. The source is on GitHub.

Before you start

You need three things, and you only do them once.

1. An API key. Create one under Dashboard, API keys. Keys start with fn_ and are shown once, so copy it straight away.
2. One n8n credential. In n8n, create a Bearer Auth credential named exactly FraudNova API and paste your key alone as the token; n8n adds the Bearer prefix for you. Every HTTP Request node in the templates points at this credential by name, so you select it once per node and never paste the key into a workflow.
3. One threshold. Each workflow that makes a decision has a Settings node at the top with a single field, risk_threshold, set to 75. That is the top of the suspicious band. You change that one number to make the workflow stricter or looser, without touching any expression.

Every check costs 1 credit, whichever type it is: IP, email or phone. The workflows check once per item and never retry on their own, so a lead gate uses 2 credits per lead, the order workflow uses 3 per order and the spreadsheet workflow uses 1 per row.

Workflow 1: a lead gate for any form

Download lead-gate-webhook.json

This workflow starts with a Webhook node. Your form tool posts a JSON body containing the visitor's email and ip (phone and country are accepted but not checked), and n8n answers on the same request. If ip is missing, the IP check returns an error and counts as not checked, so the decision rests on the email alone. It works with your own site or any tool that lets you set the JSON body and read the reply: a custom form handler, another n8n workflow, or a Make or Zapier webhook step. Form builders that post a fixed payload without the visitor's IP and ignore the response, such as Tally or Typeform, cannot drive it as-is.

The workflow checks the email and then the IP, and rejects the lead if any of these is true:

• the email is a disposable address,
• the email or the IP has a fraud_score at or above your threshold,
• the IP is a proxy, a vpn or a tor exit.

It responds on both paths, so your form never hangs. A rejected lead gets {"accepted": false, "reason": "...", "scores": {...}} and an accepted one gets {"accepted": true, "scores": {...}}.

Adapting it. To store accepted leads, add an Airtable, HubSpot or database node after Respond accepted. See also our guide to disposable email addresses.

Workflow 2: risky WooCommerce orders, straight to Telegram

Download woocommerce-order-risk-telegram.json

This workflow starts when WooCommerce creates an order. It checks the billing phone number with the billing country as a hint, the billing email, and the customer's IP address, then sends you a Telegram message if the order looks risky. An order is risky when any score reaches your threshold, the phone is VOIP or flagged as risky, the email is disposable, or the IP is a proxy, VPN or Tor exit.

The Telegram message carries the order number, the total, the customer's name, the three scores and the list of flags, so you can decide in a few seconds whether to hold the order, call the customer or let it ship. Orders that look fine end the run quietly, so you only hear about the ones that matter.

Adapting it. Telegram needs a bot token from @BotFather and the chat id you want to alert. If your team lives somewhere else, delete the Telegram alert node and connect the true output of Risky? to a Slack, Discord, Microsoft Teams or Email node. The scores and flags are available to any of them with the same expressions.

Workflow 3: enrich a Google Sheet of phone numbers

Download sheet-phone-enrichment.json

Not every use of a fraud check is a yes or no decision. Sometimes you just have a list of phone numbers, and you want to know which ones are real. This workflow watches a Google Sheet for new rows, reads the phone column and an optional country column, checks the number, and writes the answer back into the same row: valid, line_type, carrier, fraud_score, risky, checked_at and status.

The sheet needs header columns named phone, country (optional), valid, line_type, carrier, fraud_score, risky, checked_at and status. Format the phone column as plain text, or include the + and country code, so leading zeros are not lost. Results are matched back to the row by phone number, so a duplicate number updates the first matching row. There is no threshold here because nothing is decided for you. You sort or filter the sheet yourself, for example to drop VOIP numbers before an SMS campaign. For rows without a country, set default_country in the Settings node. Our guide to phone number validation for lead gen explains the line type and carrier fields.

Choosing a threshold

The default of 75 means: act on anything that sits in the high-risk band or the top of the suspicious one. That is a reasonable start for most lead forms. A finance or insurance offer may want 60 or 65. A high-volume, low-payout offer may only want to act at 85. The right number depends on what a bad lead costs you compared with what a lost good lead costs you, and our guide to fraud score thresholds walks through how to tune it from your own results.

A failed check never marks anyone as risky

Networks fail and balances run out. Every Check node in the templates has Continue on fail turned on, and every decision first confirms that the check succeeded. If you are out of credits, rate limited or hit an upstream problem, the lead is accepted with scores set to { email: null, ip: null }, the order does not trigger an alert, and the sheet row gets status set to error. A good customer is never blocked because a check did not run.

Costs and limits

Each check is 1 credit, with no subscription, and new accounts get free trial credits once the email is verified. Each API key has a rate limit, and each account has a cap on checks running at the same time. Those limits are in the API docs, and higher limits are available on request. The lead gate waits 15 seconds for each check because a form cannot wait a minute, while the order and sheet workflows wait 60; a timed-out check counts as not checked. If you need to score a large existing list rather than live traffic, the batch endpoints accept up to 100 items per request.

Next step

Try a single check before you build anything. Run an IP from a recent lead through the free IP checker and see which signals come back, then create an account for your API key and import the first workflow. The IP fraud detection API page lists every signal a check returns.