On the usage of behavior models to detect ATM fraud

The detection of ATM fraud is a key concern for both financial institutes and bank customers but also for ATM suppliers. This paper deals with the algorithmic learning of an ATM's behavior model given the data stream of status information produced by standard mechatronic devices embedded in modern ATMs. During operation, the observed status information is compared with the learned reference model to detect abnormal behavior—assuming that a significant anomaly is a strong indicator of a fraud attempt. In contrast to previous work on automatic ATM fraud detection, we apply a class of models that also capture the timing behavior, thus covering a broader range of fraud and manipulation. In particular, we present an approach to learn a tailored behavior model, called Probabilistic Deterministic Timed-Transition Automaton, in order to enable the detection of time-based anomalies. We also report on preliminary results of an empirical evaluation using a real-world data set recorded on a public ATM, indicating the practical applicability of our approach.