An approach provides fraud detection in support of data communication services. A list of single-event attributes (e.g., hot or cold attributes) is generated and includes a network address of an end user host originating a data call or a calling party identification (e.g., Automatic Number Identification (ANI) or an originating Calling Line Identification (CLI)) for network access, wherein entries of the list specify values of the hot attributes. An attribute value associated with the data call is compared with the entries. A fraud alert is generated if the attribute value matches one of the entries.