A method may include generating a vector from unstructured data included in an untransformed transaction, and determining, for the vector, a cluster ID of cluster IDs by matching the vector with a matching cluster vector of cluster vectors. The method may further include generating a query using the cluster ID and the untransformed transaction, and transforming, using the cluster IDs, untransformed transactions to transformed transactions. The transformed transactions may each include a cluster ID. The method may further include generating, using the query, a query result from features of the transformed transactions, generating a fraud score using the query result, and presenting the fraud score and the cluster ID.