1. A computer implemented method for evaluating a status of an unknown user account, the method comprising; accessing a set of features associated with a plurality of known anomalous user accounts stored in a database, wherein each feature accessed is present in an unknown status user account; computing for a given feature using code executing in a processor of a computer, a conditional correlation value corresponding to the probability of a specific feature occurring in a particular unknown user account and a dependence value corresponding to a conditional confidence that one feature is independent of at least one feature; generating a first subset of features in the unknown user account using code executing in the processor, in which each feature in the first subset has a correlation value above a minimum threshold value and a dependence value below a maximum correlation value; calculating a risk score for the unknown user account from at least one of the correlation values of the features in the first subset using code executing in the processor; tagging the unknown user account for review by an account reviewer when the risk score exceeds a threshold value using code executing in the processor; determining, by the computer, that the risk score exceeds the threshold value; and responsive to determining that the risk score exceeds the threshold value, temporarily withdrawing at least one resource from the unknown user account.