Embodiments disclosed herein are related determining a risk score for one or more data transactions. Current data transactions that are associated with one or more current attributes are received. Stored data transactions associated with stored attributes are accessed. A plurality of the stored attributes are selected. A first sliding window and a second sliding window are selected. A duration of the second sliding window is longer than a duration of the first sliding window and encompasses the duration of first sliding window. Risk information for those stored data transactions that are associated with the plurality of attributes is determined. The risk information is determined during the duration of both the first and second sliding windows and is indicative of a level fraud that is occurring. The determined risk information and the current attributes are used to generate a risk score for the current data transactions. The current data transactions are approved or rejected based on the risk score.