1. A server computer, comprising: a processor; and a non-transitory computer-readable medium, comprising code executable by the processor for implementing a method comprising: generating a development data set by sampling a first plurality of ascertained testing transactions and a first plurality of non-testing transactions, the first plurality of ascertained testing transactions including transactions for which fraud was reported within a predetermined time period; identifying, using one or more statistical analysis techniques, multiple features of the development data set based on the first plurality of testing transactions, the multiple features of the development data set being identified as being highly correlated to the first plurality of ascertained testing transactions and not highly correlated to the first plurality of non-testing transactions within the predetermined time period; generating at least one multi-level feature derived from a combination of the identified multiple distinct features, the multi-level feature being specific to the development data set; generating a testing model based at least in part on the at least one multi-level feature and the development data set, the testing model comprising a Bayesian model; receiving a first authorization message for a first transaction using an account; determining a testing transaction score for the first transaction using the testing model and based on a value for the multi-level feature associated with the first transaction, wherein the testing transaction score for the first transaction is determined in a batch process along with a plurality of other transactions; determining that the first transaction is a testing transaction based on the testing transaction score, the testing transaction being a transaction used by an unauthorized entity to test if the account is valid and usable for payment transactions; receiving a second authorization message for a second transaction using the account conducted after the first transaction; and declining the second transaction using the same account conducted after the first transaction based on the testing transaction score for the first transaction.