TERMINAL OPERATOR THEFT DETECTOR AND ANALYZER

Features are extracted and tabulated for transactions on a per-operator basis. Metrics are derived from the features on a per-feature basis and on an aggregate bases for the features as a whole. Additional metrics are calculated on a per-feature basis and an aggregate bases for a group of operators. A current transaction being conducted in real time by a given operator has current features extracted and a risk score is generated. The risk score is compared against the metrics associated with the given operator and the group of operators. A determination is made as to whether the current transaction is fraud or is not fraud based on the comparison. When fraud is detected, an alert is raised, and the current transaction provided to a fraud system for further fraud evaluation.