A method of generating a model for performing account-level fraud detection is disclosed, and includes obtaining a plurality of candidate rules for referrals of financial transactions, calculating a savings density for each of the plurality of rules, selecting a rule from the plurality of rules having the maximum savings density, iteratively rebalancing savings densities for the remaining rules of the plurality of rules and selecting a next rule until a volume constraint is satisfied, and applying the selected rules to one or more financial transactions.