According to one embodiment, a system includes a memory comprising instructions; an interface; and a processor communicatively coupled to the memory and the interface. The interface is configured to receive an indication of a trigger event associated with a user account. The processor is configured, when executing the instructions, to select one or more transactions of a plurality of transactions associated with the user account, determine, for each of the selected transactions using one or more rules, whether the transaction is potentially fraudulent, and generate, for each transaction identified as potentially fraudulent, a notification comprising an identification of the transaction.