In one example, a method includes receiving a feature vector that characterizes a call history for a telephone network subscriber, wherein the feature vector comprises respective categorical values for one or more categorical features and respective continuous values for one or more continuous features, and applying, to the categorical values, a first algorithm to determine a categorical score for the feature vector. The example method further includes applying, to the continuous values, an isolation forest algorithm to determine a continuous score for the feature vector, and outputting, in response to determining at least one of the categorical score for the feature vector and the continuous score for the feature vector indicate the feature vector is anomalous, an indication that the feature vector is anomalous.