This invention concerns improvements in detecting fraud, especially to detecting fraud in a retail environment wherein cash registers are susceptible to theft.

Within a retail environment, it is a longstanding problem that fraud committed by a cash register operator, referred to as a cashier, is often difficult to detect. As an example, a customer orders three items but the cashier only enters two items into the electronic Point Of Sale (POS) terminal. The cashier then charges the customer for all three items and issues appropriate change to the customer. The cashier has therefore potentially gained the cash allocated to the third and unrecorded item sale.

In another common theft scenario, a customer orders a set of items, for example a meal combination consisting of three items which when sold as a combination is discounted compared to the sum of the prices of the individual items, and the cashier enters the order into the POS terminal as only two of the items from the combination at a price lower than the cost of the discounted combination. The remaining item is provided to the customer without any POS record and the cashier gains the price difference between the cost of the combination meal charged to the customer and the cost of the two single items entered into the POS.

In both of the above examples the customer has paid for and received all three items and so is unlikely to query the purchase. Moreover, if a receipt is issued - which is not universal practice - it is unusual for a customer to examine the receipt in detail. Consequently, the fraudulent activity of the cashier is unlikely to be noticed. These types of fraud are commonly referred to, and will be referred to hereafter as 'under-ringing' fraud. All these fraudulent practices taken together represent a significant loss to retail operators.

Furthermore, from a distance, the cashier appears to transact with the customer normally as cash arising from the sale of the under-rung items will be placed in the cash drawer as though it was a legitimate transaction. This makes detection of the cashier's fraud by visual inspection of checkout counters very difficult.

It would, of course, be possible, in the illustration above for the cashier to place the additional cash directly into his or her pocket. However, this type of activity is more likely to be observed by either the store management or by the customer, and is therefore not the preferred method of fraud. Consequently the norm is for the fraudulent cashier either to withdraw an amount from the cash register and 'work towards' the amount withdrawn over the course of their shift, or to build up a reserve of fraudulently obtained cash and withdraw it in a single operation at or towards the end of their shift. Additionally, in a busy retail environment it is sometimes difficult to identify genuine mistakes from the deliberate frauds of the types illustrated above. A cashier may also remove the 'extra1 cash in small amounts every few transactions, but in such a manner as not to arouse suspicion.

It will be appreciated that the term 'cash' used herein does not merely refer to banknotes and coins but also to any type of accepted tender or cash item, for example vouchers, tokens and the like.

To assist in the detection of fraud, retail operators have at their disposal various statistical means of detecting fraud which typically involve analysis of transaction data produced by the POS terminal, referred to as POS data, and identify particular patterns which indicate fraudulent activity by a cashier. To enable this, modern POS terminals usually have an ability to store and retrieve at a later time data relating to each sale registered through the POS terminal. The POS data may be stored in the POS terminal itself, or offloaded to an external data store accessible by multiple POS terminals and other users.

It is also known that 'intelligent' cash registers are able to produce data showing the cash value held in a cash register drawer in real time. An example of an intelligent cash register is disclosed in European patent application EP 0724242 to Tellermate PIc, which describes a cash register comprising weighing means arranged to take weight readings from the cash compartments of the cash register. The weight readings of each compartment may then be converted to a cash value by a processing unit so that the total cash value contained in the register may be obtained without manual intervention. This data, referred to as CASH data, may be stored and retrieved at a later time for analysis, and stored either in the intelligent cash register or offloaded to an external data store, similar to the POS data. The facility of an intelligent cash register to provide up-to-date CASH data throughout a shift assists in real-time fraud detection.

It is with a view to solving the above problems that we provide in a cash- handling point of sale (POS) environment, a method of fraud detection following a transaction, the method involving comparison of cash actually held, represented as CASH data, with cash expected to be held, derived from POS data, the method comprising capturing and caching items of CASH data corresponding to the transaction; capturing and caching items of POS data relating to the transaction; determining the difference between the CASH data and the POS data; matching the difference with a known set of differences; and identifying an illegitimate transaction when the difference matches an item from the set. In another aspect of the invention, there is also provided apparatus for detecting fraud in a cash-handling point of sale (POS) environment following a transaction, the apparatus comprising means for capturing and caching items of CASH data corresponding to the transaction; means for capturing and caching items of POS data relating to the transaction; means for determining the difference between the CASH data and the POS data; means for matching the difference with a known set of differences; and means for identifying an illegitimate transaction when the difference matches an item from the set.

Further optional features to the invention are described in the appended claims.

In order that the invention may be more readily understood, reference will now be made, by way of example, to the accompanying figures, in which:

Figure 1 shows a typical retail environment checkout apparatus able to generate data for cash values and transaction details;

Figure 2 is a functional block diagram showing the method of the invention, wherein matches are attempted between a cash value discrepancy and transaction items; and

Figure 3 is a functional block diagram showing a refinement of the method shown in Figure 2.

Figure 1 shows a typical retail environment checkout system comprising a POS terminal 2, an intelligent cash register 4, a data store 6 and alerting means 8, e.g. a display monitor. The data store 6 in this instance also comprises a 'multiple factor' counter (not shown) and processing means able to process CASH and POS data and generate warning signals when an erroneous or fraudulent transaction is detected. By way of background, modern POS terminals and POS systems are usually able to store or make the expected cash information available, either as a total or on a transaction by transaction basis. As shown in Figure 2, both the POS terminal 2 and the intelligent cash register 4 are able to communicate with the data store/processor 6.

On a basic level, one method of detecting cashier fraud is to measure the difference between the cash holding within the cash drawer of the intelligent cash register 4 (from CASH data) and the expected cash present in the cash drawer derived from the POS data provided by the POS terminal 2, and creating an alarm situation (or warning) when a threshold is exceeded. The alarm threshold may be fixed or, more usefully, the alarm threshold may be adaptive to the number of transactions undertaken and the average value of those transactions. There may be a lower and/or an upper threshold to filter out on one hand genuine mistakes of an extremely small value made by a cashier, and on the other hand management-authorised removal of large sums of cash from a cash drawer which is full - known as a cash 'skim' or 'lift'.

It is worth noting that a common thread in many types of under-ringing fraud is that the discrepancy between the actual cash (obtained from CASH data) and the expected cash (calculated from POS data) is the same value as one or more items regularly sold, or is an exact multiple of the transaction value, or is a known difference (e.g. the price difference between a "set" of items and combinations of the items comprising that set if sold individually).

Thus it is desirable to determine the difference between the CASH data and the POS data and automatically compare the difference to both the transaction value and/or the known value of goods sold in that establishment to assist in identifying fraud, especially under-ringing fraud.

Furthermore it is found that under-ringing frauds generally involve only one or two items as the cashier needs to be able to quote prices to the customer using mental arithmetic.

It is a requirement of the invention that a comprehensive price list of items sold is drawn up, and preferable that this list is accessible to the automated systems of the POS terminal 2 and data store 6, the detailed list preferably being stored in the data store 6 itself. For clarification, each "price" in the price list is a reflection of what the customer would be expected to pay for their goods and may not accurately represent the published price displayed for reasons of local taxation or duties. Access to this price list by the POS terminal 2 and the data store 6 is only preferable as processing using data from the price list may be carried out by back-office systems using data received from the POS terminal. However, for purposes of clarity, the remainder of this description will be directed to the scenario wherein the POS terminal is able to access the list of items sold, and is also able to conduct processing of transaction data by referring to this detailed list.

The price list of items sold - hereafter referred to simply as the 'list' - may be composed, for example from an existing database for inventory control, or it may be bespoke for this application. Suitable lists may be obtained from a POS database or from obtaining copies of actual printed receipts. Irrespective of the method of obtaining data, an authoritative list of transaction item prices is made available to the system, as is means for manually editing data on the list. The stored list may also show the components of known combinations of items, such as the meal combination mentioned previously, that are typically sold. This information will be over and above that typically stored by the POS terminal systems. Furthermore, an enhancement to the usefulness of this list is to store the pricing of items sold as sets, such as meal combinations, minus specific items out of each set, to assist in the detection of items provided to the customer as part of a set that has not been entered onto the POS terminal.

Thus, any system to detect under-ringing fraud may be improved by considering sets of items as a collection of the individual items that make up the set. Additional combinations of the price list may therefore be used during any fraud detection process. For example, taking a case of a meal combination consisting of a main item and two side orders costing £3.99 as a meal combination, with individual prices of £2.00 for the main order and £1.00 and £1.50 for the two side orders respectively. 'Partial' combinations that should be stored in the list and used to compare any discrepancy against include:

Items Price Differential from Meal Combination Price Main + Side i -0.99 Main + Side 2 -0.49 Side i + Side 2 -1.49

Thus comparing the actual discrepancy to 'partial' combinations could be very effective.

With the foregoing in mind, a method of detecting under-ringing fraud is shown in Figure 2. It is assumed in Figure 2 that the cashier may defraud by more than one occurrence of a particular type of under-ringing fraud. Accordingly, the system starts by checking the value of the discrepancy against particular items of each category of under-ringing fraud - explained in more detail below - and then repeats the process for two items in each category and so on, up to and including the total value of the discrepancy. Although it is not shown on the following flow chart, it is noted that this type of checking procedure is initiated when a discrepancy is identified during reconciliation of CASH data and POS data.

In Figure 2, the fraud detection system recognises that a genuine discrepancy between the real cash value (CASH data) and calculated cash value (POS data) has occurred at 10 and determines the value of the discrepancy. Next, a 'multiple factor' counter is reset to zero at 12. At 14 the 'multiple factor' counter advances so that prices of single items are looked for. At 16 the procedure carries out a match between the discrepancy and the price of single items. This seeks for a match to any of the individually listed items in the transaction. This check is of use when a cashier has wrongly entered the quantity of an item sold. Subsequent passes of this step of the process will identify when more than one of the items has been omitted from the transaction record - i.e. when the 'multiple factor' increases.

Should a match not be found after the single item match at 16, the process carries on to 18 whereupon a match is attempted between the discrepancy and any item on the price list. This seeks for a match with any of the individually listed items in the price list. This match is of use when a cashier has simply not entered an item as part of the transaction. As with the previous match, subsequent passes of this step of the process will identify when more than one of the items has been omitted from the transaction record. Should a match still not be made, at 20 a further match is attempted with items from a list of commonly-known omissions. This list of commonly-known omissions may be drawn up manually, or can be determined by analysis of common errors made in the past. For instance, if a price of an item has recently changed, the difference between the new and old price may be manually entered onto this list. The matching step at 20 also seeks a match to any of the omitted items in sets of items, and is of particular value when a cashier has entered components of a set instead of the complete set as a single item. As previously, subsequent passes of this step of the process will identify when more than one of the combinations has been entered incorrectly.

If no match has been found at 20 the process increments the 'multiple factor' counter at 22 and checks to see whether any multiples of the matches attempted at any of steps 16, 18 or 20 are within the value of the discrepancy, and if any are, the process loops back to 14 to try further matches with multiples of the single items matched before.

If no match has been made and at 22 it is determined that no further multiples of items fall within the value of the discrepancy, the process continues to try to match the discrepancy against combinations of items at 24. This process is shown at Figure 3 and the accompanying narrative.

Returning to Figure 2, should at any time a match be made at steps 16, 18 or 20, the procedure then advances to 26 wherein the results of the match are displayed or otherwise communicated to the cashier and/or supervisor, and preferably logged. Next, steps 28 and 30 increment counters (not shown in Figure 1 ) each time a particular under-ring is detected and gives the system an ability to "learn" which under-ring methods are the most popular, and perhaps even which cashier is most prone to under-ringing. At this point the lists used in matching steps 28 and 30 are sorted according to popularity and the next time a match is sought at steps 28 and 30, the order of matching starts with the most popular items. At 32 the process finishes and awaits a further discrepancy to be identified whereupon the watch restarts at 10.

This implementation employs the concept of "match" to identify potentially fraudulent transactions. It may be the "match" is not exact and that some variance is required, allowing a single or combinations of items to be close in value to the known discrepancy, but not necessarily exact. The allowed variation would typically be controlled by threshold limits, typically placing an upper and lower threshold of acceptable variance defined in an appropriate manner. Such definitions may include, but not exclusively, a defined value or perhaps a percentage of the total discrepancy value.

The method shown in Figure 2 assumes that only one type of under-ring fraud will be performed per transaction, even if it is performed more than once. In practice it is possible for a cashier to perform multiple under-rings during a single transaction. It is desirable, therefore, that if the single under-ring detection method shown in Figure 2 does not identify any under-rung items, that the more advanced method shown in Figure 3 is used as this is aimed at detecting one or more different types of under-ring per transaction.

Starting at 40, the single under-ring matches attempted in Figure 1 have not yielded a result and so initiate the process of Figure 3. The 'multiple factor' is again reset at 42, and advanced at 44. Steps 46, 48 and 50 then create and store multiples of the price of items used in matching steps 16, 18 and 20 respectively of Figure 2. Between steps 52, 54 and 56 a recursive process is initiated to attempt matching the values found at 46, 48 and 50 to the discrepancy, up to the value of the discrepancy. The recursive process loops between 52, 54 and 56 until either a match has been made at 54, in which case the results are displayed at 60 and the match logged at 62 and the process completes at 64, or all combinations of multiple items have been assessed and no match is made, in which case the process ends at 58 and all pertinent data relating to attempted matches are logged. In either case the process finishes to await a further discrepancy at which point the process restarts at 40.

To assist the iterative matching procedure shown at steps 52, 54 and 56, previous knowledge, possibly in the form of a popularity factor attached to each combination of items, may be used to direct the matching step at 54 to start with the most popular combinations.

Furthermore, in the example shown in Figure 3 a table of values is built up using combinations of under-rings determined during application of the method shown in Figure 2. This table of values may be built in advance and kept up to date every time the price list changes or it may be generated as it is required.

Once the table of values has been assembled the discrepancy value is compared with the table until a match is found. Typically the "match" threshold for combination matching, as shown in Figure 3, will be narrower than with the single matching, as shown in Figure 2, as there will be a greater number of suitable values to match against.