A system and method for monitoring telephone calls to detect fraudulent activity and take corrective action is described. The system receives a group of telephone calls having associated call characteristics and analyzes the group of telephone calls to identify and store a first set of distributions of call characteristics that are indicative of normal activity, fraudulent activity, or indeterminate activity. The system receives one or more subsequent telephone calls to be analyzed. The system analyzes the received one or more telephone calls to identify a second set of distributions of call characteristics associated with the received telephone call. The system then compares the second set of distributions of call characteristics to the stored first set of distributions of call characteristics to assess a probability that the one or more received telephone calls represents normal, fraudulent, or indeterminate activity. If the assessed probability of fraudulent activity exceeds a threshold, the system takes appropriate corrective action, such a flagging the fraudulent call or withholding a financial incentive associated with the fraudulent call.