Embodiments described herein provide approaches for detecting anomalies in electronic communications. Specifically, a set of response metrics is obtained from each of a plurality of communications. Each of the plurality of communications is part of a communications batch. Based on an aggregation of the response metric over the plurality of communications, a response metric value for one or more of the set of response metrics is computed. This response metric value is compared to a predicted metric value corresponding to the response metric. Based on this comparison, it is determined whether the response metric value is anomalous. If the response metric value is anomalous, a remediation activity is performed.