Fraud Service

Port: TBD | DB: db_kesles_merchant (fraud schema) → akan pindah ke db_kesles_merchant_fraud saat extraction | Status: ⚠️ SCAFFOLD — belum LIVE

Penting: Fraud signal collection, scoring, dan review sudah LIVE di merchant_core_api sejak Phase 3 (2026-06-05). fraud_service adalah binary terpisah yang sedang di-scaffold untuk ekstraksi di masa depan. Tidak ada timeline deployment yang ditetapkan.

Overview

fraud_service dirancang sebagai rule-based + ML-augmented fraud detection engine untuk Kesles Merchant. Arsitekturnya terdiri dari dua lapisan:

1. Rule Engine (sudah di-scaffold) — evaluasi sinkron, real-time, deterministik
2. ML Layer (planned) — Isolation Forest berbasis feature vector harian, inferensi async

Status Per Domain

Yang Sudah LIVE (berjalan di merchant_core_api)

Phase	Domain	Status	Lokasi Kode
Phase 1	Fraud registrasi (NIK dedup, user-merchant limit, dashboard login throttle)	✅ LIVE	merchant_core_api/internal/fraud/
Phase 2	Fraud transaksi (velocity, duplicate ext-ref, amount anomaly, settlement SLA, orphan PSP event)	✅ LIVE	services/payment_service/internal/payment/
Phase 3	Composite risk scoring + fraud.events API + dashboard integration	✅ LIVE	merchant_core_api/internal/httpapi/fraud_handlers.go
Phase 4a	Behavioral baseline (avg_tx, avg_amount, p95, active hours)	✅ LIVE	handlers_fraud_baseline.go + mig 081
Phase 4b	ML feature vector snapshot harian	✅ LIVE (data collection)	mig 082, cron core_api
Phase 4c	Foreign login detection (GeoIP)	❌ NOT STARTED	Pending auth_service wiring
Phase 4d	ML model training (Isolation Forest)	❌ NOT STARTED	Menunggu 3–6 bulan data

Yang Ada di Scaffold (belum runtime)

services/fraud_service/ berisi engine + rules package yang akan menjadi runtime aktif saat extraction:

internal/
├── engine/
│   ├── rule.go       — Rule interface (Name, Priority, Evaluate)
│   ├── engine.go     — Engine: Register + Evaluate dengan short-circuit di score 80
│   └── context.go    — EvalContext, EvalResult, RiskLevel, RecommendedAction
└── rules/
    ├── velocity.go   — VelocityRule, IncrementCounter (Redis counter)
    ├── account.go    — NewAccountRule, KYCStatusRule, PreviousFraudRule, MerchantRiskRule
    ├── amount.go     — AmountAnomalyRule, RoundAmountRule
    └── device.go     — DeviceTrustRule, GeoMismatchRule (math placeholder)

Belum ada di scaffold: cmd/main.go, internal/store/, internal/config/, internal/transport/, .env.example, Dockerfile.

Database Schema

Schema fraud.* LIVE di db_kesles_merchant sejak mig 080 (2026-06-05).

fraud.events                    — signal per merchant (merchant_id, signal_type, severity,
                                  score 0-100, status: pending_review/cleared/confirmed)
                                  Diisi oleh core_api + payment_service

fraud.merchant_behavior_baseline — baseline harian (avg_tx_per_day, avg_amount, p95_amount,
                                   active_hour_from/to, sample_days)
                                   Update via POST /internal/fraud/baseline/recompute

fraud.merchant_feature_vectors  — snapshot ML harian (PK: merchant_id + snapshot_date)
                                   signal_count_7d/30d, high_severity_ratio, avg_score_30d,
                                   amount_volatility, peak_hour_variance
                                   Diisi cron core_api 1×/hari

Saat extraction ke fraud_service, schema fraud.* akan dimigrasikan ke database baru db_kesles_merchant_fraud mengikuti pola domain isolation yang sama dengan service lain.

Rule Engine

Skor 0–100, short-circuit di 80. Risk level dan recommended action:

Score	Risk Level	Action
0–40	LOW	APPROVE
41–70	MEDIUM	STEP_UP_AUTH (minta OTP/biometric ulang)
71–100	HIGH	BLOCK atau HOLD (manual review)

Rules yang Di-scaffold (9 rules, 4 kategori)

Rule	Priority	Skor	Trigger
previous_fraud_history	1	50	User pernah terlibat fraud
velocity_check	1	30+20	>5 txn/menit atau >30 txn/jam (Redis counter)
device_trust	1	45/30/15	Emulator / rooted device / VPN
new_account_large_txn	2	30	Akun <7 hari + transaksi >Rp500.000
kyc_status	2	15/40	KYC pending/rejected
amount_anomaly	2	35	Nominal >5× rata-rata 30 hari
merchant_risk	3	40+35	Dispute rate >1% atau refund rate >5%
round_amount	3	15	Nominal bulat kelipatan 50.000 (card testing pattern)
geo_mismatch	4	20	Login >100km dari lokasi registrasi

geo_mismatch dan fungsi trigonometri di device.go masih placeholder — perlu import "math" dan implementasi haversine yang benar sebelum dipakai di production.

Internal API (berjalan di merchant_core_api)

POST /internal/fraud/events               — insert fraud signal
GET  /internal/fraud/events               — list events + filter (merchant_id, risk, status)
POST /internal/fraud/events/{id}/review   — update status event (cleared/confirmed)
POST /internal/fraud/baseline/recompute   — recompute baseline semua merchant
POST /internal/fraud/feature-vectors/snapshot — snapshot feature vector harian

Auth: X-Internal-API-Key. Dipakai oleh dashboard_api untuk fraud review panel.

Rencana Ekstraksi

Saat extraction ke fraud_service dijadwalkan, langkah yang perlu dilakukan:

1. Implementasi cmd/main.go + internal/config/ + internal/store/
2. Port HTTP transport dari merchant_core_api/internal/httpapi/fraud_handlers.go
3. Buat migration db_kesles_merchant_fraud + move schema fraud.*
4. Dual-write soak (core_api + fraud_service) sebelum cutover
5. Fix math placeholder di device.go (import math, implementasi haversine benar)
6. Assign port baru — port 8080–8098 sudah terpakai service lain (mis. 8087/8088 = kesles_reference, 8096 = poslite_service); pilih port bebas dan cek konflik dulu
7. DROP fraud.* dari db_kesles_merchant setelah cutover verified

Deployment

Belum ada deployment. Saat siap:

• Folder VM: merchant_fraud/
• Systemd unit: fraud-service.service
• DB: db_kesles_merchant_fraud (baru, belum dibuat)