Shipped
ShieldPay
A real-time fraud intelligence dashboard for merchants — combines behavioral fingerprinting with an ML ensemble (IsolationForest + XGBoost) to flag suspicious transactions as they happen, built for a hackathon with a genuine production mindset.
Overview
ShieldPay is a real-time fraud intelligence layer for Squad (HabariPay/GTCO) merchants — it scores every settled transaction, investigates suspicious ones with an LLM-backed agent, and feeds merchant feedback into a live retraining loop.
It was built by the four-person Team Sentinel for Squad Hackathon 3.0. I owned the Squad API integration, the agent core, the RAG layer, the cross-merchant fingerprint network, and the retraining pipeline — with a genuine production mindset despite the hackathon clock.
Problem
Nigeria loses an estimated ₦52 billion to payment fraud annually. Squad merchants receive transaction webhooks but have no native fraud intelligence: no scoring, no investigation tooling, no way to act on suspicious activity or learn from confirmed fraud.
Solution
ShieldPay sits behind Squad's payment webhooks, deliberately outside the transaction path — scoring happens post-settlement, asynchronously, with zero latency impact on checkout. Each webhook is HMAC-SHA512 verified, enriched via Squad's transaction API, and checked against a cross-merchant behavioral fingerprint network; three or more fingerprint hits trigger an instant block.
Everything else goes to the FraudAgent: a Groq-hosted Llama 3.3-70b agent with RAG over a ChromaDB corpus of fraud patterns, calling shared tools — velocity checks, ML anomaly scores (IsolationForest + XGBoost), amount deviation, merchant profile. If the LLM is unavailable, a deterministic orchestrator runs the same tools, so the system degrades gracefully rather than failing open. Verdicts (SAFE / SUSPICIOUS / BLOCK) land in the merchant dashboard; scores above 0.92 trigger an automatic refund through Squad's API; merchant confirm/dispute labels queue a retrain that must pass shadow testing before new models deploy.
Architecture
Webhook ingress → HMAC verification → enrichment → fingerprint network → agent dispatch (LLM or deterministic) → shared tool harness → verdict store → dashboard feed → feedback → shadow-tested retrain. Backend is FastAPI/Python; the dashboard is a JavaScript front-end polling the verdict feed.
Squad webhook ──► HMAC verify ──► enrich (Squad API)
│
cross-merchant fingerprints
│ 3+ hits │ no match
▼ ▼
instant BLOCK FraudAgent dispatch
│
┌───────────┴───────────┐
▼ ▼
Groq Llama 3.3-70b deterministic
+ RAG (ChromaDB) orchestrator
└───────────┬───────────┘
▼
tools: velocity · anomaly (IF+XGB)
deviation · merchant profile
▼
verdict ──► dashboard ──► feedback
│ score > 0.92 │
▼ ▼
auto-refund shadow-tested retrainTech stack
Challenges
- Making the LLM optional: the deterministic orchestrator had to produce credible verdicts through the same tool harness, so a missing API key or Groq outage never disabled the product.
- Cross-merchant fingerprinting needed to catch repeat offenders without leaking one merchant's data to another.
- A retraining loop in hackathon time: shadow testing new models against held-out verdicts before promotion, so a bad feedback batch couldn't silently degrade scoring.
Lessons learned
- Graceful degradation is an architecture decision, not an error handler — designing the deterministic path first made the LLM an enhancement instead of a dependency.
- Staying out of the transaction path removed the entire latency conversation and made the system deployable behind any webhook.
- Team seams matter: clean ownership boundaries (API/agent, backend, ML, frontend) let four people ship a system this wide in a hackathon window.
Future improvements
- Production hardening: multi-tenant auth, rate limiting, and audit trails.
- Streaming feature computation instead of per-request calculation.
- Expanding the RAG corpus from 12 seed fraud patterns to a living, feedback-grown library.