Abstract: In an embodiment, a system contains a payee data database configured to store payee data that contains intended payee information and a fraud marker engine configured to determine a fraud marker based on the payee data, wherein the fraud marker identifies an activity including performing a transaction benefiting a payee account, wherein a plurality of payor accounts have, within a defined time frame, changed their intended payee information to include the payee account. The system also contains a fraud marker scoring engine that determines a fraud score for the fraud marker based a likelihood that the activity is fraudulent or a severity of the activity, and an activity monitoring and matching engine configured to monitor activity of a first payee account and a first payor account, determine that the monitored activity matches the fraud marker, and institute a block, cancellation, or hold on the monitored activity based on the fraud score.