Patent ID: 8638916

Claim:
A method for detecting unauthorized use of data services associated with an account, the method comprising the steps of: tracking number of data calls, corresponding to a host identifier, for access to a data network over a predetermined time period; determining a cumulative duration of the data calls; determining whether the number of the data calls and the cumulative duration satisfy a combination of, respectively, a first threshold and a second threshold; setting the first threshold corresponding to the number of the data calls based on an access type and the second threshold corresponding to the cumulative duration based on another access type, wherein the access types include one or more of: 800 number access, access corresponding to a particular hostUserID, access from a particular geographical region, access from a logical partition, and access from an originating network; and indicating a potential fraudulent use of the account via a single alarm, if the combination of thresholds is satisfied, wherein the first threshold and the second threshold are assigned different levels of precedence.