Methods and apparatus according to the invention are directed towards providing means for identifying a selection of entity associates that may contain a perpetrator of claimed fraud against an entity account. Means are also provided for scoring the associates within the selection as to relative likelihood of being the perpetrator. Identification means and scoring means may include analyses of the number and nature of connections associates may have with the frauded account, with other entity accounts, with past claims of fraud, and with other associates.