All templates

Automated Trovata Fraud Alert Triage

Every morning, WebRun opens Trovata, scans recent outgoing transactions for fraud indicators including new or unrecognized payees, amounts significantly above recent averages, round-number amounts, and off-hours processing times, logs each flagged transaction in Airtable, and posts a Slack alert to your treasury team to investigate before the items fully clear.

Runs on WebRun · Strict Lockdown policy
Every day at 7:00 AM WebRunorchestrates each step
1 Trovata scan outgoing transactions for fraud indicators
2 Airtable log flagged transactions in the triage queue
3 Slack alert treasury team to investigate flagged items
In short

How do I automatically detect and triage suspicious bank transactions before they clear?

WebRun scans all outgoing transactions in Trovata every morning for fraud indicators including new payees, unusually large amounts, round-number payments, and off-hours processing, logs each suspicious item in an Airtable triage queue with full details, and pings the treasury team in Slack to investigate before the transactions fully clear.

  • Suspicious transactions flagged and queued every morning before they fully clear
  • Treasury team has full transaction details in Airtable to make fast decisions
  • Fraud indicators are configurable so thresholds match your risk tolerance

Built for corporate treasury teams · finance controllers · CFOs · internal audit teams

Step by step

What does WebRun do on every run?

The exact actions WebRun takes, in order - in plain language, so you can adjust anything.

  1. WebRun signs in and gets to work

    Opens app.trovata.io in a real browser with your saved login - no setup, no API keys.

  2. 1
    Trovata - scan outgoing transactions for fraud indicators
    trovata.io
    WebRun in Trovata: scan outgoing transactions for fraud indicators
    WebRun opens Trovata to scan outgoing transactions for fraud indicators.
    • Open Trovata and pull all outgoing transactions from the past 24 hours
    • Flag transactions meeting one or more fraud indicators: payee not seen in the past 90 days, amount more than 3 times the historical average for that payee type, round amounts above $10,000, or transactions initiated outside business hours
    • Capture full transaction details including bank, account, payee, amount, currency, and timestamp

    Done when All transactions meeting at least one fraud indicator are identified and captured.

  3. 2
    Airtable - log flagged transactions in the triage queue
    airtable.com
    WebRun in Airtable: log flagged transactions in the triage queue
    WebRun opens Airtable to log flagged transactions in the triage queue.
    • Open the Fraud Alert Triage Queue Airtable base
    • Add a record for each flagged transaction not already in the queue
    • Populate all transaction details and note which fraud indicators triggered the flag
    • Set status to Needs Investigation

    Done when Every flagged transaction has a triage record in Airtable.

  4. 3
    Slack - alert treasury team to investigate flagged items
    slack.com
    WebRun in Slack: alert treasury team to investigate flagged items
    WebRun opens Slack to alert treasury team to investigate flagged items.
    • Post a Slack alert to the treasury security channel listing the number of flagged items and total value at risk
    • Include a link to the Airtable triage queue for the team to open immediately

    Done when Treasury team is alerted and has the context needed to begin investigation.

Run settings

How is each run configured?

Starting pageWhere Chrome opens at the start of each run
app.trovata.io
ScheduleRuns automatically on this cadence
Every day at 7:00 AM
DeliveryHow each run's result reaches you
Fraud triage queue · Airtable · Slack
OutputWhat each run produces - An Airtable fraud triage queue of suspicious outgoing transactions with indicator details, plus a daily Slack alert to the treasury team.
Worklist
Setup & safety

Secure by default

Connect once, stays signed in

WebRun signs in once and keeps each session in a persistent environment, so every run picks up right where it left off.

Your credentials stay in your own private environment - WebRun never stores your passwords.
Strict Lockdown

Every action is checked against this policy before it runs.

Domains ALLOWLIST
Typed input ALLOW
Shell command BLOCK
File uploads BLOCK
Runs in a contained environment More on policies
Good to know

Questions, answered

Will it block or reverse a suspicious transaction automatically?

No. Blocking or reversing a payment requires direct action with your bank, which is a financial action that must be taken by a human. WebRun flags and queues suspicious transactions so your team can contact the bank immediately if a transaction looks fraudulent.

How does it decide what counts as suspicious?

WebRun uses four configurable indicators: new or unrecognized payees, amounts significantly above the historical average for that payee type, large round-number amounts, and transactions initiated outside your business hours. You can adjust the thresholds for each indicator during setup.

What if a flagged transaction is legitimate?

Your team marks it as Cleared in Airtable. WebRun tracks cleared verdicts so the same payee-amount pattern is not repeatedly flagged as the baseline updates over time.

Put this on autopilot.

Turn it on in minutes - or have our team set it up for you.