Terminal operator theft detector and analyzer

A method, comprising:

• maintaining first histograms on a per-feature basis and a per-operator basis, each first histogram associated with a unique feature of a plurality of features and extracted from transaction data for transactions performed by an operator;
• maintaining second histograms on the per-feature based and per-group basis, each second histogram associated with the unique feature of the plurality of features and extracted from the transaction data and other transaction data performed by a group of operators;
• calculating feature and operator specific intermediate scores for each of the plurality of features from the corresponding first histograms;
• calculating feature and group specific intermediate scores for each of the plurality of features from the corresponding second histograms;
• generating an operator-specific feature score from the feature and operator specific intermediate scores;
• generating a group-specific feature score from the feature and group-specific intermediate scores;
• generating a ratio as the operator-specific feature score to the group-specific score;
• extracting current features from current transaction data associated with a current transaction being performed by the operator;
• generating a current fraud score for the current features based on the first histograms;
• comparing the current fraud score to the ratio and raising an alert when a difference between the current fraud score and the ratio exceeds a threshold value.

A system, comprising:

• a server comprising a processor and a non-transitory computer-readable storage medium;
• the non-transitory computer-readable storage medium comprising executable instructions;
• the executable instructions when executed on the processor from the non-transitory computer-readable storage medium cause the processor to perform operations comprising:
• maintaining a first histogram profile for transaction features of transactions performed by an operator;
• maintaining a second histogram profile for the transaction features of other transactions performed by a group of operators;
• calculating a current fraud score for current features of a current transaction performed by the operator based on the first histogram profile;
• determining whether a transaction fraud is present for the current transaction based on comparing the current fraud score against a ratio derived from the first histogram profile to the second histogram profile;
• and
• sending a real-time alert to evaluate the current transaction data and the current transaction when the transaction fraud is present for the current transaction based on the determining.