A reward card platform includes a database storing funding accounts, reward card purchase transactions, and aberrant activity rules. A first user interface enables purchasing reward cards, including controls to specify reward card parameters. A second user interface enables specifying rules to detect aberrant activity. The second user interface includes user interface controls to specify the rule parameters, including: specifying a moving window of time; specifying an aggregation type; specifying filtering; specifying aggregation grouping; and specifying a threshold value for triggering an alert. The platform includes a rules execution engine that runs periodically to evaluate each of the rules. For each rule, the engine identifies transactions whose timestamps fall within the moving window of time relative to a current time and satisfies the filters, then computes an aggregation of the transactions according to the aggregation type and aggregation grouping. When the aggregation exceeds the threshold value, the platform raises an alert.