Computer-implemented method for determining a potential for anomalous activity by a suspect user, comprising the steps of: a) receiving a plurality of user profiles, each user profile associated to a user and comprising a plurality of transactions associated to said user, each transaction comprising a plurality of transaction attributes; b) calculating an anomaly score for each of the received plurality user profiles by means of an anomaly detection algorithm which is trained based on one or more transaction attributes of a plurality transactions comprised by a plurality of user profiles, wherein the trained anomaly detection algorithm is at least one or more of an unsupervised anomaly detection algorithm or a supervised classification algorithm; characterized in that the method further comprises the steps of: c) determining a community structure for the received plurality of user profiles based at least in part on the transactions comprised by said user profiles, wherein the determined community structure comprises a plurality of nodes interconnected via weighted edges, wherein each node is associated to a user profile and the calculated anomaly score for said user profile, wherein the weight of each edge interconnecting two or more nodes is at least based in part on a number of transactions between the user profiles associated with the interconnected nodes; d) calculating a network anomaly score for a user profile associated to the suspect user, wherein said user profile is comprised by the received plurality user profiles, wherein the network anomaly score for said user profile is based at least in part on the anomaly score calculated for one or more user profiles associated with nodes in the determined community structure which are interconnected via an edge to the node of said user profile and the weight of each respective interconnecting edge; and e) calculating a potential for anomalous activity by the suspect user by means of combining the calculated anomaly score and the network anomaly score of the user profile associated to said suspect user. a) receiving a plurality of user profiles, each user profile associated to a user and comprising a plurality of transactions associated to said user, each transaction comprising a plurality of transaction attributes; b) calculating an anomaly score for each of the received plurality user profiles by means of an anomaly detection algorithm which is trained based on one or more transaction attributes of a plurality transactions comprised by a plurality of user profiles, wherein the trained anomaly detection algorithm is at least one or more of an unsupervised anomaly detection algorithm or a supervised classification algorithm; c) determining a community structure for the received plurality of user profiles based at least in part on the transactions comprised by said user profiles, wherein the determined community structure comprises a plurality of nodes interconnected via weighted edges, wherein each node is associated to a user profile and the calculated anomaly score for said user profile, wherein the weight of each edge interconnecting two or more nodes is at least based in part on a number of transactions between the user profiles associated with the interconnected nodes; d) calculating a network anomaly score for a user profile associated to the suspect user, wherein said user profile is comprised by the received plurality user profiles, wherein the network anomaly score for said user profile is based at least in part on the anomaly score calculated for one or more user profiles associated with nodes in the determined community structure which are interconnected via an edge to the node of said user profile and the weight of each respective interconnecting edge; and e) calculating a potential for anomalous activity by the suspect user by means of combining the calculated anomaly score and the network anomaly score of the user profile associated to said suspect user.