A system and method is disclosed for a remote activity detection process using an analysis of data streams of an entity such as an end user and/or a customer. In an embodiment, the detection process uses the data stream analysis to evaluate an entity's potential involvement in an activity based on individual measures for the entity such as comparison of the entity's data stream to the entity's peers, comparison of the entity's data stream to historical information for the entity, and/or comparison of the entity's data stream to data streams for a known second entity involved in the activity. The detection process may also use other information available which may impact the data points in a data stream, such as premises attributes associated with an entity, demographic attributes for the entity, financial attributes for the entity, and system alerts.