1. A method for detecting unauthorized use of data services, the method comprising the steps of: generating a list of single-event attributes that include a network address of an end user host associated with a data call for network access, wherein entries of the list specify values of the single-event attributes; comparing an attribute value associated with the data call with the entries; and generating a fraud alert if the attribute value matches one of the entries.