GB2407194A

GB2407194A - Detecting fraud at a POS terminal by comparing actual and expected cash data

Info

Publication number: GB2407194A
Application number: GB0324163A
Authority: GB
Inventors: Christopher Lare
Original assignee: Tellermate Group Ltd; Tellermate PLC; Tellermate Ltd
Current assignee: Tellermate Group Ltd
Priority date: 2003-10-15
Filing date: 2003-10-15
Publication date: 2005-04-20
Also published as: GB0324163D0; WO2005043428A1

Abstract

In a cash-handling point of sale (POS) environment, a method of fraud detection involving comparison of cash actually held, represented as CASH data, with cash expected to be held, derived from POS data, the method comprising capturing and caching items of CASH data; capturing and caching items of POS data: determining the difference between the CASH data and the POS data; determining the absolute value of said difference; and using said absolute value of said difference in identifying fraudulent activity.

Description

24071 94 Improvements in fraud detection This invention concerns

improvements in detecting fraud, especially to detecting fraud in a retail environment wherein cash registers are susceptible to theft.

Within a retail environment, it is a longstanding problem that fraud committed by a cash register operator, referred to as a cashier, is often difficult to detect. As an example, a customer orders three items but the cashier only enters two items into the electronic Point Of Sale (POS) terminal. The cashier then charges the customer for all three items and issues appropriate change to the customer.

The cashier has therefore gained the cash allocated to the third and unrecorded item sale - this fraudulent practice is often called 'under ringing'. Other methods include overcharging a customer or providing insufficient change to a customer.

The cashier will usually store fraudulently obtained cash in the cash register drawer as any other activity, such as putting the cash in a pocket or bag would normally invoke suspicion, especially if done repeatedly during a shift. The stolen money is retrieved at a later time during the cashier's working shift, or at go the end of the day. Another common method of fraud is for cashiers to remove cash from the drawer at the start of a shift and build back to the expected value during the shift by theft methods similar to or the same as those described above.

as It will be appreciated that the term 'cash' used herein does not merely refer to banknotes and coins but also to any type of accepted tender or cash item, for example promissory notes, vouchers, tokens and the like.

To assist in the detection of fraud, retail operators have at their disposal various statistical means of detecting fraud which typically involve analysis of data produced by the POS terminal, referred to as POS data, and identify particular patterns which indicate fraudulent activity by a cashier. To enable this, modern POS terminals have an ability to store and retrieve at a later time data relating to each sale registered through the POS terminal. The POS data may be stored in the POS terminal itself, or offloaded to an external data store accessible by multiple POS terminals and other users.

By analysing POS terminal information, unusual transactions, such as large numbers of low value transactions or a higher than average number of voided (cancelled) transactions, may be identified and singled out for further investigation as signs of possible fraud. However, this method has drawbacks as such analysis will only make sense when conducted after a number of transactions have passed, by which time several fraudulent acts may have already been committed and it is too late to catch the perpetrator. Statistical analysis also requires significant time to conduct, during which time typically the cash register upon which analysis is being conducted cannot be used.

It is now known that 'intelligent' cash registers are able to produce data showing the cash value held in a cash register drawer. An example of an intelligent cash register is disclosed in European patent application EP 0724242 to Tellermate Plc., which describes a cash register comprising weighing means arranged to take weight readings from the cash compartments of the cash register. The weight readings of each compartment may then be converted to a cash value by a processing unit so that the total cash value contained in the register may be obtained without manual intervention. This data, referred to as CASH data, may be stored and retrieved at a later data for analysis, and stored either in the intelligent cash register of offloaded to an external data store, similar to the POS data. - The facility of an intelligent cash register to provide up-to-date CASH data throughout a shift enables real-time fraud detection. For example, by starting the shift or working day with a known amount of cash and processing POS data, the expected cash value present in an intelligent cash register drawer after each so transaction may be determined by analysis. The CASH data can be used to reconcile between the actual cash value transacted by the cashier and expected cash value determined by the POS data analysis. This reconciliation helps to reduce fraud by ensuring that the actual and expected cash value match. In particular, it helps to prevent fraud by detecting when the cashier stores "stolen" cash in the cash register for later collection. Conversely, such a system can immediately detect if the cashier removes cash from the drawer at an early stage in their shift.

Whilst the intelligent cash register provides a ready solution to the problems of fraud perpetrated by removing a large quantity of cash at the start of, end of or during a shift, it is much more difficult to detect frequent addition or removal of to relatively small quantities of cash that together amount to an equally significant fraud.

By way of indication of this problem, reference is now made to Figure 1 which is a graphical representation of the real and expected cash values in an intelligent cash register in common theft scenarios: the Expected Cash line shows the cash that the store would normally expect to be in the cash drawer, given honest operation, derived from POS data; the Shift End Theft line shows how cash is built up during the shift and then removed in one action close to the end of the shift, bringing that line back to the Expected Cash line; s the Shift Start Theft line shows how the cashier might alternatively remove cash close to the start of the shift and then 'build back' to the expected value, steadily converging with the Expected Cash line; and the Incremental Theft line shows how a cashier can remove the same amount of cash as depicted by the Shift End Theft and Shift Start Theft lines without arousing suspicion by removing cash only in small amounts - often referred to as 'slow theft'. It will be noted that the variance between CASH and POS data is never great and may be below alert thresholds, in contrast to the Shift End Theft and Shift Start Theft scenarios where there is a large variance near the start or end of the shift.

As dishonest cashiers learn that Shift End Theft and Shift Start Theft can be so readily detected by intelligent cash registers, it is to be expected that they will slow theft' instead. In addition to the problems of detecting very small variances between CASH and POS data, there is also the problem that when averaged to over any reasonable period of time, such variances if positive and negative will tend to cancel each other out and hence be all the more difficult to detect. The present invention provides a solution to the problem of detecting slow theft.

It is with a view to solving the above problems that we provide, in a cash handling point of sale (POS) environment, a method of fraud detection involving comparison of cash actually held, represented as CASH data, with cash expected to be held, derived from POS data, the method comprising capturing and caching items of CASH data; capturing and caching items of POS data; determining the difference between the CASH data and the POS data; determining the absolute value of said difference; and using said absolute value of said difference in identifying fraudulent activity.

The invention also comprises cash-handling point of sale (POS) apparatus for fraud detection involving comparison of cash actually held, represented as CASH data, with cash expected to be held, derived from POS data, the apparatus comprising means for capturing and caching items of CASH data; means for capturing and caching items of POS data; means for determining the difference between the CASH data and the POS data; means determining the absolute value of said difference; and means for using said absolute value of so said difference in identifying fraudulent activity.

Further optional features to the invention are described in the appended claims.

In order that the invention may be more readily understood, reference will now be made, by way of example, to the accompanying figures, in which: Figure 2 shows a typical retail environment checkout apparatus able to generate data for cash values and transaction details; Figure 3 is a functional block diagram showing a first method of the invention, wherein absolute values of the difference between real and to expected cash values are used to detect fraudulent practice; and Figure 4 is a graphical representation derived from Figure 1 but adapted to show how using the method of the invention facilitates fraud detection, normalised along the Expected Cash line and plotting the variances s between each theft scenario and the normalised Expected Cash line.

Figure 2 shows a typical retail environment checkout system comprising a POS terminal 2, an intelligent cash register 4, a data store 6 and alerting means 8, e.g. a display monitor. The data store 6 in this instance also comprises go processing means able to process CASH and POS data and generate warning signals when an erroneous or fraudulent transaction is detected. By way of background, modern POS terminals and POS systems are able store or make the expected cash information available, either as a total or on a transaction by transaction basis. The information may be exchanged by such techniques as z receipt capture where the printed details of the customer receipt are retained' access (by some method) to a central database held within the EPOS terminal or central server or access (by some method) to the EPOS terminal itself. As shown in Figure 2, both the POS terminal 2 and the intelligent cash register 4 are able to communicate with the data store/processor 6.

On a basic level, one method of detecting cashier fraud is to measure the difference between the cash holding (the CASH data) within the cash drawer of the intelligent cash register 4 and the expected cash derived from the POS data provided by the POS terminal 2, and creating an alarm situation (or warning) when a threshold is exceeded. The alarm threshold may be fixed or, more usefully, the alarm threshold above which an alert signal is generated by combined data store/processor 6 is related to the number of transactions undertaken and the average value of those transactions. Typically, this analysis is undertaken by a computer in preference to manual analysis.

However, as mentioned above, a cashier may choose to replace money stolen to from the cash drawer in small increments after the initial theft has taken place. It is also possible for a cashier to allow small amounts of stolen money to accumulate in the cash drawer and to remove any excess repeatedly during a shift. In a simplistic example, a cashier may be stealing 1 per transaction, and choose to remove a 5 note every five transactions. Conversely, the cashier 46 may start by removing a 5 note and then steal 1 on each of the next five transactions, leaving that 1 in the cash drawer each time until the CASH data and POS data correspond once again. Such activity will not be detected by threshold monitoring if the threshold is set higher than 5 in a single transaction as the difference between CASH and POS data never exceeds the threshold.

Even if the threshold were reduced to, say, 1, occasional variances of + /- 5 could be ignored if the system looks for an average variance over time. Say, for example, that the system looks for average variances between 10:00am and 1 1:OOam and finds that from 1 O:OOam to 1 0:30am there was a variance between CASH and POS data of +5 and that from 1 0:30am to 11:OOam there was a variance between CASH and POS data of -5. In this admittedly simplistic example, the average variance over the sample time would be zero.

More realistically, even if the average variance was not zero, the combination of positive and negative variances between CASH and POS data would tend to reduce the average variance, possibly below any threshold value and hence below the level at which an alert condition will exist.

Figure 3 is a flowchart depicting a method of the invention wherein the absolute values of the variances after each transaction are summed together, without regard to whether the variances are positive or negative, such that cash added and removed in unauthorized transactions is easily monitored.

It will clearly be shown later in Figure 4 that using the absolute value of the difference between the expected cash (POS data) and the actual cash (CASH data) provides a significant improvement in fraud detection. For avoidance of doubt, the term 'absolute value' of an amount refers to the magnitude of that to amount only, without reference to whether the amount is positive or negative.

At 10 a new transaction is registered and the procedure initiates. At the end of the transaction, when the POS and CASH data items have been generated by the POS terminal and intelligent cash register respectively (or these data values are taken from the data store 6 at a later time after transaction completion), a check is carried out at 12 to determine whether the expected cash value in the cash register drawer (obtained from POS data) matches the actual cash value obtained from the CASH data. If the check at 12 is positive and the two cash values match exactly (or are within an accepted error margin and deemed a go 'close match'), no further action is required. The procedure then reverts to 10 and awaits a new transaction.

If, however, the check step 12 produces a negative result in that the two cash values are different (or differ by a margin outside an acceptable level deemed to be a 'close match'), the difference between these two values is determined at 16, and the absolute value of this difference is added to the sum of all previous absolute differences since the start of the shift or working day at steps 18 and 20. Specifically, it will be noted that step 18 removes the sign of the difference (whether positive or negative) and step 20 adds the resulting difference to the sum of the differences.

Following 20, a check is carried out at 22 to determine whether a predetermined maximum threshold for the sum of cumulative absolute differences has been reached. If this threshold has not been reached, all pertinent data are recorded at 24 (e.g. to the data store 6 shown in Figure 2) and the process reverts to 10 to await a new transaction. The recording of all pertinent data enables further processing and analysis to be carried out, perhaps at a later time or using other analytical tools. Conversely, if the check at 22 determines that the threshold value has been reached then an alert signal is generated at 26 and shown on the display monitor 8 of Figure 1. Typically, further transaction processing on the affected POS terminal and associated intelligent cash register is suspended until a supervisor has reset the alert signal. However, it will also me possible to allow continued use of the affected POS terminal if, having detected possible fraud, it would be advantageous to monitor the cashier in question by, for example, watching the cashier on a closed circuit surveillance system.

So, it is the summation of absolute differences, i.e. magnitudes of variance between CASH and POS data that defines the level of potentially fraudulent behaviour. To illustrate this, Figure 4 shows the same scenario as that shown in Figure 1, but with the method of Figure 3 applied to the analysis of POS and CASH data.

In Figure 4, the graph of Figure 1 is changed to show how the absolute differences between the expected POS data and the actual CASH data makes theft easier to detect.

It should be noted that the overall value of the cash discrepancies is likely to be larger, for this system will measure both the original fraud and the removal of the cash as individual discrepancies. This is not, in practice, a limitation, but the effect of overstating the actual level of fraud could be resolved by adding factors into the result to reduce the deviation. For example, in a case wherein an expected increase in cash data is matched by a decrease in actual cash data, the absolute difference found may be moderated by dividing the absolute difference by a factor of two to account for the nature of the transaction and subsequently detected fraud.

Obviously, the expected value shown in Figure 4 now shows no deviation and the effects of the Shift End Theft and Shift Start Theft are very clear. Equally, the saw-tooth characteristic of 'slow theft' incremental fraud is shown, but again it is clear that this will average to zero, or almost zero, if positive and negative differences are allowed to cancel out. However, the Cumulative Absolute line shows very clearly that the cash in the drawer is not as expected, indicating a to total deviation that is easy to detect.

In the above method, the use of fixed thresholds for fraud detection is possible.

If, for example, the threshold is fixed at 5, then once the cumulative level of discrepancy reaches 5 an alert would be initiated. The alert could be in many forms such as warning light, SMS, pager or other electronic or audiovisual form.

The warning may also just be recorded pending further investigation. However, fixed threshold fraud detection makes no allowance for the number or value of transactions undertaken. For example, a 5 discrepancy in a cash drawer that has taken 200 in a shift could be of concern, but not so in a drawer that has go transacted 2000 in a shift. It is found that this evaluation method generally works well with a modification of the threshold absolute difference value moderated by number of transactions, in which case the average transaction value generally remains within a tight band.

cs It is therefore preferable that the threshold warning be set at a variable level based on the transaction volume or value (or various combinations of volume or value) to afford a more appropriate threshold level, and hence, generate warning alerts more accurately. In other words, an improvement on a fixed threshold level would be to determine the threshold based on the transactions, such that the threshold increases automatically as the number of transactions or the value of those transactions increases. This enhancement will allow the threshold to be effective in periods of low level trading as well as during busy periods.

In most practical applications of the invention, the sum of the absolute differences will be cleared at that start of every cashier shift. However, other methods, such as human intervention or periodic automatic clearing, would be suitable to clear this information.

Claims

Claims 1. In a cash-handling point of sale (POS) environment, a method of

fraud detection involving comparison of cash actually held, represented as CASH data, with cash expected to be held, derived from POS data, the method comprising: capturing and caching items of CASH data; capturing and caching items of POS data; determining the difference between the CASH data and the POS data; determining the absolute value of said difference; and using said absolute value of said difference in identifying fraudulent activity.

co
2. The method of Claim 1 wherein identifying fraudulent activity comprises: adding said absolute value to a sum of previously determined absolute values to form a new sum of absolute values; and as comparing said new sum of absolute values with a predetermined threshold for absolute values.
3. The method of Claim 2 further characterized in that the threshold varies according to the number of transactions undertaken.
4. The method of Claim 2 or Claim 3 further characterized in that the threshold varies according to the value of transactions undertaken.
5. The method of Claim 1 wherein comparison of cash actually held with cash expected to be held is undertaken at a predetermined time using CASH and POS data corresponding to that predetermined time.
6. The method of Claim 1 wherein comparison of cash actually held with cash expected to be held is triggered by a cash transaction.
7. The method of Claim 1 further characterized in that fraud detecting steps are avoided if the difference between CASH and POS data is below a to predetermined level.
8. The method of any preceding claim wherein an alert signal is generated upon fraudulent activity being identified.
9. The method of Claim 8 further characterized in that a POS terminal is suspended after an alert signal is generated.
10. The method of Claim 8 further characterized in that a POS terminal is monitored after an alert signal is generated.
11. The method of Claim 2 or any dependent claim wherein the sum of absolute values is reset at predetermined intervals.
12. The method of Claim 2 or any dependent claim wherein the sum of absolute values is reset at the start of each working shift.
13. Cash-handling point of sale (POS) apparatus for fraud detection involving comparison of cash actually held, represented as CASH data, with cash expected to be held, derived from POS data, the apparatus comprising: means for capturing and caching items of CASH data; means for capturing and caching items of POS data; means for determining the difference between the CASH data and the POS data; means determining the absolute value of said difference; and means for using said absolute value of said difference in identifying fraudulent activity.
14. The apparatus of Claim 13 wherein means for identifying fraudulent activity further comprises: means for adding said absolute value to a sum of previously determined absolute values to form a new sum of absolute values; and means for comparing said new sum of absolute values with a predetermined threshold for absolute values.
15. The apparatus of Claim 14 further comprising means for varying the threshold according to the number of transactions undertaken.
16. The apparatus of Claim 14 or Claim 15 further comprising means for varying the threshold according to the value of transactions undertaken.
17. The apparatus of Claim 13 further comprising comparing means adapted to compare CASH and POS data at a predetermined time using CASH and POS data corresponding to that predetermined time.

so
18. The apparatus of Claim 13 further characterized by comparison triggered by a cash transaction.
19. The apparatus of Claim 13 further characterized in that fraud detecting means are avoided if the difference between CASH and POS data is below a predetermined level.
20. The apparatus of Claim 13 or any following claim comprising means for generating an alert signal upon fraudulent activity being identified.
21. The apparatus of Claim 20 further comprising means for suspending a POS terminal after an alert signal is generated.
22. The apparatus of Claim 20 further comprising means for monitoring a POS terminal after an alert signal is generated.
23. The apparatus of Claim 14 or any dependent claim further comprising s means for resetting the sum of absolute values at predetermined intervals.
24. The apparatus of Claim 14 or any dependent claim further comprising : means for resetting the sum of magnitudes at the start of each working shift. -

24. The apparatus of Claim 14 or any dependent claim further comprising means for resetting the sum of absolute values at the start of each working shift.

IS

Amendments to the claims have been filed as follows: 1. In a cash-handling point of sale (POS) environment, a method of fraud 6 detection involving comparison of cash actually held, represented as CASH data, with cash expected to be held, derived from POS data, the method comprising: capturing and caching items of CASH data; capturing and caching items of POS data; determining the difference between the CASH data and the POS data; : Fe determining the magnitude of said difference; and using said magnitude of said difference in identifying fraudulent activity. :

2. The method of Claim 1 wherein identifying fraudulent activity comprises: adding said magnitude to a sum of previously determined magnitudes to form a new sum of magnitudes; and comparing said new sum of magnitudes with a predetermined threshold for magnitudes.

3. The method of Claim 2 further characterized in that the threshold varies according to the number of transactions undertaken.

4. The method of Claim 2 or Claim 3 further characterized in that the threshold varies according to the value of transactions undertaken. b

5. The method of Claim 1 wherein comparison of cash actually held with cash expected to be held is undertaken at a predetermined time using CASH and POS data corresponding to that predetermined time.

6. The method of Claim 1 wherein comparison of cash actually held with cash expected to be held is triggered by a cash transaction.

7. The method of Claim 1 further characterized in that fraud detecting steps are avoided if the difference between CASH and POS data is below a to predetermined level.

8. The method of any preceding claim wherein an alert signal is generated upon fraudulent activity being identified. :- -

.16 9. The method of Claim 8 further characterized in that a POS terminal is suspended after an alert signal is generated. me. :e

: 10. The method of Claim 8 further characterized in that a POS terminal is monitored after an alert signal is generated.

11. The method of Claim 2 or any dependent claim wherein the sum of magnitudes is reset at predetermined intervals.

12. The method of Claim 2 or any dependent claim wherein the sum of magnitudes is reset at the start of each working shift.

13. Cash-handling point of sale (POS) apparatus for fraud detection involving comparison of cash actually held, represented as CASH data, with cash expected to be held, derived from POS data, the apparatus comprising: means for capturing and caching items of CASH data; 1+ means for capturing and caching items of POS data; means for determining the difference between the CASH data and the POS data; means determining the magnitude of said difference; and means for using said magnitude of said difference in identifying fraudulent activity.

14. The apparatus of Claim 13 wherein means for identifying fraudulent activity further comprises: means for adding said magnitude to a sum of previously determined magnitudes to form a new sum of magnitudes; and means for comparing said new sum of magnitudes with a predetermined : threshold for magnitudes. :

A. 20 15. The apparatus of Claim 14 further comprising means for varying the .

threshold according to the number of transactions undertaken.

16. The apparatus of Claim 14 or Claim 15 further comprising means for varying the threshold according to the value of transactions undertaken.

17. The apparatus of Claim 13 further comprising comparing means adapted to compare CASH and POS data at a predetermined time using CASH and POS data corresponding to that predetermined time.

18. The apparatus of Claim 13 further characterized by comparison triggered by a cash transaction. to

19. The apparatus of Claim 13 further characterized in that fraud detecting means are avoided if the difference between CASH and POS data is below a predetermined level.

20. The apparatus of Claim 13 or any following claim comprising means for generating an alert signal upon fraudulent activity being identified.

21. The apparatus of Claim 20 further comprising means for suspending a POS terminal after an alert signal is generated.

22. The apparatus of Claim 20 further comprising means for monitoring a POS terminal after an alert signal is generated.

23. The apparatus of Claim 14 or any dependent claim further comprising means for resetting the sum of magnitudes at predetermined intervals. .