A method, system, and medium are provided for detecting fraud, the method comprising: initializing a fraud hypothesis variable associated with a communications device, receiving data that describes a plurality of outgoing communication records that are associated with said communications device, wherein the data is related to activity that took place over a given period of time, extracting a plurality of destination identifiers from said plurality of communication records, for each of at least a portion of said plurality of destination identifiers, modifying said fraud hypothesis variable based on a fraud metric associated with said destination identifier, comparing said fraud hypothesis variable to a first predetermined threshold, and when said fraud hypothesis variable exceeds said first predetermined threshold, generating a fraud indication that is related to said communications device.