Data-Driven Machine-Learning Theft Detection

Abstract

A machine-learning algorithm is trained with features relevant to basket data for items of transactions. The trained algorithm is trained to predict whether a given transaction is more or less likely to be associated with theft being engaged in by a transaction operator for the transaction. The trained algorithm is then provided basket data for a given transaction and produces as output a theft prediction value. When the theft prediction value exceeds a configured threshold value, the transaction is flagged for manual intervention or the transaction is flagged for subsequent manual verification.

2 . A method, comprising:
 assigning item classifications and cluster identifiers to each item in a basket of items being processed at a transaction terminal during a transaction;   capturing metrics for the basket of items and transaction actions during the transaction;   providing the item classifications, the customer identifiers, and the metrics to a machine-learning algorithm;   receiving as output from the machine-learning algorithm a theft prediction value; and   integrating the theft prediction value into a transaction workflow associated with the transaction.   
     
     
         3 . The method of  claim 2 , wherein integrating further includes causing the transaction workflow to perform exception processing when the theft prediction value is greater than a threshold value. 
     
     
         4 . The method of  claim 3 , wherein causing further includes causing an override to be required at the transaction terminal in order to complete transaction based on the exception processing. 
     
     
         5 . The method of  claim 2 , wherein capturing further includes identifying the transaction actions as operations performed at the transaction terminal by an operator of the terminal during the transaction. 
     
     
         6 . The method of  claim 5 , wherein identifying further includes identifying at least one metric as an operator identifier for the operator. 
     
     
         6 . The method of  claim 2  further comprising, linking video captured of the transaction to the theft prediction value and to the transaction. 
     
     
         7 . The method of  claim 2  further comprising, identifying an indication that no theft was present for the terminal when the theft prediction value exceed a threshold value for the transaction. 
     
     
         8 . The method of  claim 7  further comprising, initiating a training session with the machine-learning algorithm with the item classifications, the customer identifiers, and the metrics provided as input and with an expected output from the machine-learning algorithm being a new theft prediction value that falls below the threshold value. 
     
     
         9 . The method of  claim 2 , wherein integrating further includes interrupting the transaction workflow when the theft prediction value is greater than a threshold value. 
     
     
         10 . The method of  claim 9 , wherein interrupting further includes requesting manual review of the basket of items and transaction details of the transaction before the workflow is permitted to complete the transaction at the transaction terminal. 
     
     
         11 . The method of  claim 2  further comprising, retaining video captured for the transaction, item identifiers for the items of the transaction, transaction details for the transaction, the metrics, and the theft prediction value within a data store for subsequent review of the transaction. 
     
     
         12 . The method of  claim 2  further comprising, processing the method as a software-as-a-service to a transaction system associated with the transaction terminal. 
     
     
         13 . A method, comprising:
 training a machine-learning algorithm on transaction metrics, classifications, and cluster identifiers associated with baskets of items in transactions to produce theft prediction values for the transactions based on known fraudulent transactions associated with the transactions and known non-fraudulent transactions associated with the transactions;   receiving a current basket of items for a current transaction;   obtaining current item classifications for the current basket of items;   assigning current cluster identifiers for the current basket of items;   generating current transaction metrics for the current transaction;   providing the current item classifications, the current cluster identifiers, and the current transaction metrics as input to the machine-learning algorithm;   receiving a current theft prediction value as output from the machine-learning algorithm; and   flagging the current transaction for review when the current theft prediction value exceeds a threshold value.   
     
     
         14 . The method of  claim 13  further comprising, indexing and storing video associated with the current transaction, the current theft prediction value, current transaction details, and the current transaction metrics in data store for review and analysis after the transaction completes. 
     
     
         15 . The method of  claim 13  further comprising, continuously retraining the machine-learning algorithm based on actual theft detected in subsequent transaction and based on the corresponding theft prediction values provided by the machine-learning algorithm for the subsequent transactions. 
     
     
         16 . The method of  claim 13  further comprising, processing the method during a self-service transaction of a customer who is operating the transaction terminal. 
     
     
         17 . The method of  claim 13  further comprising, processing the method during a customer-assisted transaction where a cashier is operating the transaction terminal to process the transaction on behalf of a customer. 
     
     
         18 . The method of  claim 13  further comprising, generating a report associated with an operator of the transaction terminal, wherein the report comprises transaction identifiers for the transaction and for other transactions of the operator, and the report comprises the corresponding theft prediction values for each of the transactions. 
     
     
         19 . The method of  claim 13 , wherein flagging further includes interrupting the transaction before the transaction completes for immediate review based on the theft prediction value. 
     
     
         20 . A system, comprising:
 at least one server that comprises at least one processor;   a transaction terminal;   the at least one processor executes executable instructions that cause the at least one processor to perform operations that comprise:
 providing item details, transaction metrics, and operator information as input to a machine-learning algorithm for a transaction associated with a basket of items being processed on the transaction terminal by an operator; 
 receiving a theft prediction value as output from machine-learning algorithm; 
 determining whether to interrupt the transaction before the transaction completes on the transaction terminal based on the theft prediction value; 
 determining whether to flag the transaction for review after the transaction completes on the transaction terminal based on the theft prediction value; and 
 determining whether to let the transaction complete on the transaction terminal without flagging the transaction based on the theft prediction value. 
   
     
     
         21 . The system of  claim 20 , wherein one of: 1) the transaction terminal is a self-service terminal and the operator is a customer performing a self-checkout, or 2) the transaction terminal is a point-of-sale terminal and the operator is a cashier performing a customer-assisted checkout on behalf of the customer.