Use real-time anomaly detection reference patterns to combat fraud