1. A computer-implemented method comprising: receiving, at a fraud management device, at least one base station identifier (BSID) associated with communication data from at least one machine type communication (MTC) device; determining a location associated with the at least one BSID; selecting relevant data elements from the communication data; applying known domain rules to the communication data; identifying a connectivity pattern for the at least one MTC device based on the communication data; applying an anomaly detection model to particular communication data associated with a particular MTC device based on the connectivity pattern; and detecting at least one anomaly from the identified connection pattern based on the anomaly detection model.