# US 10,769,896 B1 · Counter-fraud measures for an ATM device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,769,896 B1 - Document ID: US10769896B1 - Status: Granted - Kind: B1 - Application number: 16/400,791 - Filed: 2019-05-01 - Granted: 2020-09-08 - Earliest claimed: 2019-05-01 - Assignees: Capital One Services, LLC - Applicants: Capital One Services, LLC - Inventors: Reza Farivar; Kenneth Taylor; Austin Walters; Joseph Ford, III; Rittika Adhikari - Web page: https://patentgrep.com/patent/US10769896B1 ## CPC - G07F 19/207: {Surveillance aspects at ATMs} - G06F 18/217: {Validation; Performance evaluation; Active pattern learning techniques} - G06V 20/52: Surveillance or monitoring of activities, e.g. for recognising suspicious objects (recognising microscopic objects G06V20/69) - G06V 40/107: {Static hand or arm} - G06V 40/28: {Recognition of hand or arm movements, e.g. recognition of deaf sign language (static hand signs G06V40/113)} - G08B 3/10: using electric transmission; using electromagnetic transmission - G08B 5/36: using visible light sources - G08B 13/19602: {Image analysis to detect motion of the intruder, e.g. by frame subtraction} - G08B 21/182: {Level alarms, e.g. alarms responsive to variables exceeding a threshold} - G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00}) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - G06V: IMAGE OR VIDEO RECOGNITION OR UNDERSTANDING - G08B: SIGNALLING SYSTEMS, e.g. PERSONAL CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS ## Abstract An ATM device may receive a request to process an ATM transaction; dispense, via an instrument dispenser, a plurality of instruments based on the request; perform image segmentation of one or more images of an area surrounding the instrument dispenser, wherein the image segmentation is performed using a deep learning network trained using synthetic models of hands; detect, based on performing the image segmentation, that a user's hand approaches the instrument dispenser after dispensing the plurality of instruments; determine, after dispensing the plurality of instruments and after detecting that the user's hand approaches the instrument dispenser, that a portion of the plurality of instruments is present at the instrument dispenser; and perform one or more actions based on determining that the portion of the plurality of instruments is present at the instrument dispenser. ## Claims ### Claim 1 An automated teller machine (ATM) device, comprising: an instrument dispenser; one or more memories; and one or more processors, communicatively coupled to the one or more memories, configured to: receive information associated with a target area of the ATM device by capturing images of the target area, the target area being associated with potentially fraudulent activity targeting the ATM device; perform image segmentation of one or more images of the target area to detect one or more conditions, wherein the one or more conditions include at least one of: a hand being located proximate to a portion of an enclosure of the ATM device for longer than a threshold period of time, or a hand moving proximate to a portion of the enclosure of the ATM device in a particular manner indicative of fraudulent activity, and wherein the image segmentation is performed using a deep learning network trained using synthetic models of hands, the deep learning network being trained by analyzing sequences of images in which fraudulent activity occurs, and the deep learning network being trained to determine specific hand motions indicative of fraudulent activity associated with a portion of the enclosure of the ATM device; detect, based on performing the image segmentation, the one or more conditions; generate, based on detecting the one or more conditions, a fraud score associated with the one or more conditions, the one or more conditions including: a first condition, and a second condition, the second condition being weighted differently than the first condition when the fraud score is generated; determine whether the fraud score meets a threshold; and perform one or more actions based on whether the fraud score meets the threshold. ### Claim 2 (depends on 1) The ATM device of claim 1, wherein the one or more processors, when performing the one or more actions, are configured to: store a log regarding an ATM transaction associated with the potentially fraudulent activity. ### Claim 3 (depends on 1) The ATM device of claim 1, wherein the one or more processors, when performing the one or more actions, are configured to: cause the ATM device to intake a portion of a plurality of instruments from the instrument dispenser; and divert the portion of the plurality of instruments to a storage area separate from an area in which other instruments are stored. ### Claim 4 (depends on 3) The ATM device of claim 3, wherein the one or more processors are further configured to: store information that identifies an association between transaction information, associated with an ATM transaction associated with the potentially fraudulent activity, and the storage area. ### Claim 5 (depends on 1) The ATM device of claim 1, wherein the one or more processors are further configured to: cause one or more image sensors, associated with the ATM device, to capture the images of the target area. ### Claim 6 (depends on 5) The ATM device of claim 5, wherein the one or more processors, when causing the one or more image sensors to capture the images, are configured to: cause the one or more image sensors to capture the images before dispensing a plurality of instruments. ### Claim 7 (depends on 1) The ATM device of claim 1, wherein the one or more processors, when performing the one or more actions, are configured to: cause a door used to access a location where the ATM device is located to be temporarily locked. ### Claim 8 A method, comprising: monitoring, by an ATM device, a target area of the ATM device by capturing images of the target area using one or more image sensors, the target area being associated with potentially fraudulent activity targeting the ATM device; performing, by the ATM device, image segmentation of one or more of the images using a deep learning network that is trained to perform the image segmentation using images of synthetic hand models, the image segmentation being performed to detect one or more conditions, the one or more conditions include at least one of: a hand being located proximate to a portion of an enclosure of the ATM device for longer than a threshold period of time, or a hand moving proximate to a portion of the enclosure of the ATM device in a particular manner indicative of fraudulent activity, the deep learning network being trained by analyzing sequences of images in which fraudulent activity occurs, and the deep learning network being trained to determine specific hand motions indicative of fraudulent activity associated with a portion of the enclosure of the ATM device; detecting, by the ATM device, the one or more conditions; generating, by the ATM device and based on detecting the one or more conditions, a fraud score associated with the one or more conditions, the one or more conditions including: a first condition, and a second condition, the second condition being weighted differently than the first condition when the fraud score is generated; determining, by the ATM device, whether the fraud score meets a threshold; and performing, by the ATM device, one or more actions based on whether the fraud score meets the threshold. ### Claim 9 (depends on 8) The method of claim 8, wherein the target area includes a portion of an access panel of an enclosure of the ATM device. ### Claim 10 (depends on 8) The method of claim 8, wherein the target area includes a portion of an enclosure, of the ATM device, proximate to an internal computing device of the ATM device. ### Claim 11 (depends on 8) The method of claim 8, wherein performing the one or more actions comprises: generating an audible alert and/or a visual alert. ### Claim 12 (depends on 8) The method of claim 8, wherein performing the one or more actions comprises: instructing the one or more image sensors to capture additional images of the target area and/or of a vicinity of the ATM device. ### Claim 13 (depends on 8) The method of claim 8, wherein performing the one or more actions comprises: deactivating the ATM device. ### Claim 14 (depends on 8) The method of claim 8, wherein performing the one or more actions comprises: issuing a notification, that identifies the potentially fraudulent activity at the ATM device, to a local law enforcement authority and/or to an entity associated with the ATM device. ### Claim 15 (depends on 8) The method of claim 8, wherein performing the one or more actions comprises: causing a door used to access a location where the ATM device is located to be temporarily locked. ### Claim 16 A non-transitory computer-readable medium storing instructions, the instructions comprising: one or more instructions that, when executed by one or more processors of an automated teller machine (ATM) device, cause the one or more processors to: receive information associated with a target area of the ATM device by capturing images of the target area, the target area being associated with potentially fraudulent activity targeting the ATM device; perform image segmentation of one or more images of the target area to detect one or more conditions, wherein the one or more conditions include at least one of: a hand being located proximate to a portion of an enclosure of the ATM device for longer than a threshold period of time, or a hand moving proximate to a portion of the enclosure of the ATM device in a particular manner indicative of fraudulent activity, and wherein the image segmentation is performed using a deep learning network trained using synthetic models of hands, the deep learning network being trained by analyzing sequences of images in which fraudulent activity occurs, and the deep learning network being trained to determine specific hand motions indicative of fraudulent activity associated with a portion of the enclosure of the ATM device; detect the one or more conditions; generate, based on detecting the one or more conditions, a fraud score associated with the one or more conditions, the one or more conditions including: a first condition, and a second condition, the second condition being weighted differently than the first condition when the fraud score is generated; and perform one or more actions based on whether the fraud score meets a threshold. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: cause one or more image sensors, associated with the ATM device, to capture the images of the target area; and wherein the one or more instructions, that cause the one or more processors to cause the one or more image sensors to capture the images, cause the one or more processors to: cause the one or more image sensors to capture the images after dispensing a plurality of instruments. ### Claim 18 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: cause one or more image sensors, associated with the ATM device, to capture the images of the target area; and wherein the one or more instructions, that cause the one or more processors to cause the one or more image sensors to capture the images, cause the one or more processors to: cause the one or more image sensors to capture the images upon or after receiving an ATM transaction request. ### Claim 19 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the one or more instructions, when executed by the one or more processors, further cause the one or more processors to: cause one or more image sensors, associated with the ATM device, to capture the images of the target area. ### Claim 20 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein the one or more instructions, that cause the one or more processors to perform the one or more actions, cause the one or more processors to: generate an audible alert and/or a visual alert.