A processor-implemented method, system, and/or computer program product detects illicit activities in micro-commerce transactions. An historic transaction pattern of known legitimate past micro-commerce transactions by a cohort is identified. A current transaction pattern for a current set of multiple micro-commerce transactions is also identified. The current transaction pattern and the historic transaction pattern are compared. In response to determining that the current transaction pattern deviates from the historic transaction pattern beyond a predetermined level, a determination is made that the current set of multiple micro-commerce transactions are being used for money laundering.