Disclosed is a method and system for detecting a fraudulent financial transaction including collecting, by processing circuitry, transaction details from a financial institution, classifying, by the processing circuitry, each of a plurality of users into a respective set of groups among a plurality of groups for each of a plurality of transaction action types, the plurality of users corresponding to the transaction details, and determining, by the processing circuitry, whether a first user among the plurality of users is in a risk group based on a first set of groups among the plurality of groups into which the first user is classified.