1. A computer system, comprising: a non-transitory memory storing instructions; and one or more hardware processors coupled to the non-transitory memory and configured to read the instructions from the non-transitory memory to cause the computer system to perform operations comprising: receiving data for a first account; analyzing the data based on a clustering model; assigning the first account to a peer group associated with the clustering model, the peer group comprising one or more second accounts; determining a scatteredness score for the first account, the scatteredness score being determined in view of a neighborhood of accounts in the peer group; determining whether the scatteredness score exceeds a predetermined threshold; and automatically disabling the first account when the scatteredness score exceeds the predetermined threshold.