Abstract: A method for increasing computer network security. A first request to attach a first user account for a software program to an external secure account is received. The first request includes a first set of user credentials for accessing the external secure account and a first unverified email address, the external secure account controlled by a second external computer. After receiving the first request, features having metrics is received. The metrics describe at least creation of the first user account and include at least the first unverified email address. A machine learning model processing the features calculates a probability score that the first request is fraudulent. The probability score is compared to a threshold to form a comparison result. A security action is performed with respect to attaching the first user account to the external secure account in response to the comparison result.