A method for detecting fraud rings involves clustering unknown users into unknown user clusters based on a grouping attribute. The method further involves, for each of the unknown user clusters, determining aggregated features including at least one quantification of at least one homogeneity attribute across the unknown users in the unknown user cluster. The method also involves, for each of the unknown user clusters, determining a predictive suspiciousness score based on the aggregated features, determining that at least one of the unknown user clusters is suspicious based on the determined predictive suspiciousness scores, and taking a protective action for the at least one suspicious unknown user cluster.