Balancing fraud analytics with legal requirements