Systems, methods, and apparatus for dynamically providing an incentive to a customer of a service based on a detected unexpected behavior of the customer are presented herein. A model component can create a model associated with a service based on information associated with a use of the service. Further, a prediction component can predict, based on the model, a behavior of a user associated with the use of the service. Furthermore, a scoring component can identify a deviation from the behavior and determine an action associated with the user based on the deviation from the behavior. In an aspect, the action can be communication of an incentive directed to a network-enabled device.