Which techniques are most commonly used in a rules-based approach to transaction monitoring for detecting suspicious activities? (Choose two.)