1. A system comprising: a receiver configured to receive a set of rules for use in detecting fraudulent transactions; a server, operatively connected to the receiver, the server configured to: identify a set of accounts that facilitated the detected fraudulent transactions; generate a new rule set based on an intersection of at least two respective rules of the set of rules, the new rule set to identify fraudulent accounts based on a series of transactions; determine a fitness of the new rule set with respect to other new rule sets based on computing expected economic savings of using the new rule set and expected economic savings of using the other new rule sets, and comparing the expected economic savings of using the new rule set to the expected economic savings of using the other new rule sets; and provide the new rule set to a rules engine of the server according to the fitness of the new rule set.