Abstract: Embodiments disclosed herein are related to computing systems and methods for detecting anomalies in a distribution of one or more attributes associated with data transactions. In the embodiments, data transactions are accessed that each include various attributes. The data transactions are grouped into a first subset associated with a first sub-type of a first attribute and a second subset including any remaining sub-types of the first attribute. Second attributes in the first and second subsets are compared to determine differences in the proportion of the second attributes between the first and second subsets, where the differences are indicative of an anomaly in an expected distribution of the second attributes. Based at least on a determination that there are differences in the proportion, subsequently accessed data transactions that are associated with attributes similar to the data transactions of the first subset are rejected or subjected to a further review process.