[HOLD] Report SendMoney new account creation to fraud protection backend#88064
[HOLD] Report SendMoney new account creation to fraud protection backend#88064cristipaval wants to merge 1 commit intomainfrom
Conversation
Made-with: Cursor
melvin-bot
bot
requested review from
JmillsExpensify and
Krishna2323
and removed request for
a team
|
@Krishna2323 Please copy/paste the Reviewer Checklist from here into a new comment on this PR and complete it. If you have the K2 extension, you can simply click: [this button] |
|
No C+ review is needed here |
cristipaval
changed the title
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| const newAccountCountAttribute = responseData?.newAccountCount ? {key: 'new_account_count', value: responseData?.newAccountCount as string} : undefined; | ||
| return {event: FRAUD_PROTECTION_EVENT.NEW_EMAILS_INVITED, attribute: newAccountCountAttribute}; | ||
| }, | ||
| [WRITE_COMMANDS.SEND_MONEY_ELSEWHERE]: (_, responseData) => { |
There was a problem hiding this comment.
❌ CONSISTENCY-3 (docs)
The same factory function body is now duplicated 4 times across INVITE_TO_GROUP_CHAT, INVITE_TO_ROOM, SEND_MONEY_ELSEWHERE, and SEND_MONEY_WITH_WALLET. Extract a shared helper and reuse it.
Suggested fix:
const createNewAccountCountSignal: FraudSignalFactory = (_, responseData) => {
const newAccountCountAttribute = responseData?.newAccountCount ? {key: 'new_account_count', value: responseData?.newAccountCount as string} : undefined;
return {event: FRAUD_PROTECTION_EVENT.NEW_EMAILS_INVITED, attribute: newAccountCountAttribute};
};
// Then in the map:
[WRITE_COMMANDS.INVITE_TO_GROUP_CHAT]: createNewAccountCountSignal,
[WRITE_COMMANDS.INVITE_TO_ROOM]: createNewAccountCountSignal,
[WRITE_COMMANDS.SEND_MONEY_ELSEWHERE]: createNewAccountCountSignal,
[WRITE_COMMANDS.SEND_MONEY_WITH_WALLET]: createNewAccountCountSignal,Reviewed at: 4b4f959 | Please rate this suggestion with 👍 or 👎 to help us improve! Reactions are used to monitor reviewer efficiency.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4b4f959f50
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| [WRITE_COMMANDS.SEND_MONEY_ELSEWHERE]: (_, responseData) => { | ||
| const newAccountCountAttribute = responseData?.newAccountCount ? {key: 'new_account_count', value: responseData?.newAccountCount as string} : undefined; | ||
| return {event: FRAUD_PROTECTION_EVENT.NEW_EMAILS_INVITED, attribute: newAccountCountAttribute}; |
There was a problem hiding this comment.
The SEND_MONEY_ELSEWHERE and SEND_MONEY_WITH_WALLET factories always return NEW_EMAILS_INVITED, and FraudMonitoring unconditionally sends any returned event. That means every successful send-money call (including payments to existing users where newAccountCount is 0/missing) is now reported as a new-email invite, which can pollute fraud telemetry and skew downstream risk decisions. These commands should only emit this event when newAccountCount indicates that a new account was actually created.
Useful? React with 👍 / 👎.
Codecov Report❌ Looks like you've decreased code coverage for some files. Please write tests to increase, or at least maintain, the existing level of code coverage. See our documentation here for how to interpret this table.
|
2 participants
Held on https://github.com/Expensify/Web-Expensify/pull/52148
Held on https://github.com/Expensify/Auth/pull/21111
The SendMoney flow can create new accounts for unknown recipients via getAccountOrCreateClosed, but unlike other commands like InviteToRoom, InviteToGroupChat, it wasn't reporting this to the Fraud Protection backend.
Explanation of Change
Fixed Issues
$ https://github.com/Expensify/Expensify/issues/621551
PROPOSAL:
Tests
Offline tests
QA Steps
// TODO: These must be filled out, or the issue title must include "[No QA]."
PR Author Checklist
### Fixed Issuessection aboveTestssectionOffline stepssectionQA stepssectioncanBeMissingparam foruseOnyxtoggleReportand notonIconClick)src/languages/*files and using the translation methodSTYLE.md) were followedAvatar, I verified the components usingAvatarare working as expected)StyleUtils.getBackgroundAndBorderStyle(theme.componentBG))npm run compress-svg)Avataris modified, I verified thatAvataris working as expected in all cases)Designlabel and/or tagged@Expensify/designso the design team can review the changes.ScrollViewcomponent to make it scrollable when more elements are added to the page.mainbranch was merged into this PR after a review, I tested again and verified the outcome was still expected according to theTeststeps.Screenshots/Videos
Android: Native
Android: mWeb Chrome
iOS: Native
iOS: mWeb Safari
MacOS: Chrome / Safari