Systems for dynamic unauthorized activity detection are provided. In some arrangements, issue data may be received from, for instance, a customer of an enterprise organization. The issue data may include a data file containing metadata associated with a plurality of checks written or issued by the customer. As those checks are cashed, the checks may be evaluated for potential unauthorized activity. Accordingly, check data and/or check image data may be received by the enterprise organization. The check and/or check image data, as well as the metadata, may be analyzed using machine learning to determine whether unauthorized or potential unauthorized activity has occurred. Based on the determination, one or more actions may be identified and executed.