1. A system comprising: a receiver to receive a set of rules for use in detecting fraudulent transactions; a server, operatively connected to the receiver, the server configured to identify a set of accounts that facilitated the detected fraudulent transactions and further configured to generate a new rule set based on an intersection of at least two of the respective rules, the new rule set to identify fraudulent accounts based on a series of transactions and the intersection including at least one of crossover or mutation of the respective rules.