AI fraud detection at the POS: voids, refunds, ghost orders
By LOOP Editorial
Last updated:
AI fraud detection at the POS: voids, refunds, ghost orders
Most POS fraud in F&B is not theft from the register. It is small, patterned, and invisible in a daily report. A waiter who voids one out of every twenty orders and pockets the cash. A manager who refunds card transactions to a friend''s wallet. A cashier who rings up a Coke as water. Individually these are rounding errors. Aggregated across 12 branches and 18 months, they sink margins.
AI is uniquely good at this problem because it is fundamentally an anomaly-detection problem at scale. Here is how a modern AI POS catches it.
2026 benchmark: Median food cost across SEA QSR chains: 30–34% in 2026.
The three patterns that account for 80% of POS fraud
Pattern 1: Void clustering
A waiter rings up an order, takes cash, then voids the order before close. The receipt looks normal during the meal. The void looks normal in isolation. The pattern only emerges when you compare void rates across staff, shifts, and items.
LOOP flags any staff member whose void rate exceeds 1.5σ above their peer-group baseline, weighted by shift and station. We use a robust z-score (not mean/stdev) so a single bad shift doesn''t trigger noise.
Pattern 2: Refund-to-self
A manager processes a "refund" on a card transaction that was actually paid in cash, then takes the cash. Hard to catch from the POS alone — you need to cross-reference the acquirer settlement file. AI helps by surfacing refund timing patterns: refunds that cluster in the last 30 minutes of a shift, refunds without a matching original transaction in the last 24 hours, refunds that round to nice numbers.
Square''s research on small-business fraud puts internal refund fraud at 0.7–1.2% of revenue in unmanaged QSR — a number we routinely see operators reduce to under 0.1% within a quarter.
Pattern 3: Item substitution
The cashier rings up a higher-priced item as a lower-priced one and pockets the difference, often in collusion with the customer. Catching this requires comparing the POS ticket against an independent signal — kitchen display tickets, weight scale data, or in our case, a small computer-vision model on the order-prep camera that classifies actual drinks/dishes vs. what was rung.
What the AI is doing under the hood
Three layers, all running in real time:
- Per-staff baseline. A rolling 90-day model of normal void/refund/comp rates per staff member, station, and time-of-day.
- Anomaly scoring. Each transaction gets a fraud score (0–100) based on isolation forest + simple rules.
- Pattern detection. A nightly batch job clusters anomalies across time. The most-actionable output is not "this transaction is fraud" — it is "this staff member has a 95th-percentile void rate three weeks running."
The output goes to a manager dashboard, not directly to HR. A human reviews every flag.
A real example
A 7-branch coffee chain we work with had been losing roughly $1,200/month for 8 months — they knew margins were off but couldn''t pinpoint why. LOOP''s first nightly batch flagged two patterns:
- A cashier at the central branch with a 4.8% void rate (peer average: 1.1%), heavily concentrated in the 15-minute window before shift handoff.
- A floor manager processing refunds on Sunday evenings without matching tickets in the kitchen display log.
Both were confirmed via CCTV review within a week. Recovery wasn''t the headline outcome — eliminating the recurring leak was. Annualized impact: ~$15k.
See the ACFE''s annual fraud report for industry benchmarks; F&B sits in the top three sectors for occupational fraud loss as a percentage of revenue.
What to look for in an AI fraud feature
- Per-staff baselines. A chain-wide threshold catches nothing.
- Robust statistics. Mean/stdev is too noisy at low sample sizes.
- Cross-signal validation. POS data alone has too many false positives. Pair with KDS, scale, or camera.
- Human-in-the-loop. Auto-suspending staff is a lawsuit waiting to happen.
- Explainability. The dashboard must show why a staff member was flagged, with raw transactions.
How LOOP does it
Fraud detection in LOOP runs continuously. Operators get a weekly digest by email plus real-time push alerts for severity-high anomalies (refund > 500k VND without an original ticket). The full audit trail is kept for 7 years to meet Vietnamese tax inspection requirements.
FAQ
Will this generate false positives? Yes, especially in the first 30 days as the baseline builds. We tune severity thresholds with the operator during onboarding.
Can the AI take action automatically? By default, no. Some operators enable auto-suspension of refunds above a threshold pending manager approval. We do not recommend automatic disciplinary action.
Does it work with cash-heavy operations? Yes — cash fraud is actually easier to catch because the void/refund patterns are starker.
What about staff privacy? Only managers and owners see the dashboard. Staff get a generic monthly performance summary that does not surface fraud scoring.
Related reading
- AI demand forecasting for Tet and peak season in F&B
- AI fraud detection for voids and refunds on POS: catching ₫30–80M/month leaks
- AI loyalty segmentation that doubles repeat visits
Why this matters in 2026
Multi-outlet F&B operators across Vietnam and Southeast Asia are running into the same wall in 2026: aggregator commissions compress margins, food-cost drift compounds across outlets, labour cost climbs faster than ticket size, and a traditional POS only surfaces the damage at month-end when the only response left is firefighting. Operators who win in 2026 close the loop in hours, not weeks — variance flags before the next shift, demand forecasts before purchasing, daypart promos drafted automatically for slow slots, and a single morning brief instead of five dashboards. That is the bar this guide is written against, and the reason LOOP exists. The cost of a missed signal is no longer a single bad week — it is the difference between a chain that compounds outlet-level profitability and a chain that opens new outlets to mask the leaks at the old ones.
The SEA F&B operator landscape in 2026 also looks materially different from 2023. Aggregator commissions in Vietnam have settled in the 22–28% band; Thailand and the Philippines run higher, Singapore lower. Labour minimums have moved twice in eighteen months in Vietnam. E-invoice (TT78) is now non-negotiable and enforced. Loyalty has shifted from punch cards to messaging-native (Zalo OA, LINE, WhatsApp, Messenger) — and the chains that ride that shift are seeing repeat visits double inside ninety days. None of that lands as an upgrade on a legacy POS; it lands as a different operating model.
SEA benchmarks (2026)
- Median food cost across SEA QSR chains: 30–34% in 2026.
- Median labour cost across SEA F&B chains: 22–28% in 2026.
- Repeat-visit rate for loyalty-enabled cafés: 38–46% in 2026.
- Average ticket time for SEA QSR in peak: 6.8–9.2 minutes in 2026.
- Aggregator commission band in VN: 22–28% per order in 2026.
- AI demand forecast MAPE on LOOP cohorts: 14–22% per outlet in 2026.
- VAT e-invoice (TT78) compliance among LOOP outlets: 100% by 2026.
- Average POS uptime LOOP cohorts: 99.92% rolling-90-day in 2026.
Operator playbook — first 30 days on LOOP
Week 1 — Foundations. Import menu, recipes, modifiers, customers, loyalty balances and 24 months of sales via CSV. Connect aggregators (GrabFood, ShopeeFood, Be, foodpanda, Gojek). Configure e-invoice provider (MISA / Viettel / VNPT). Confirm payment rails (VietQR for VN; PromptPay / QRIS / DuitNow / PayNow / QR Ph for the rest of SEA). Train two staff per outlet on voice and text commands; the rest pick it up by observation in days 4–7.
Week 2 — Variance and forecast online. Switch demand forecasting on at daypart level. Set variance alert thresholds (default: food-cost ±3pp, labour ±2pp, void rate ±0.5pp). Let the system run a full week without intervention so the baseline calibrates. Review the morning brief each day; ignore the urge to override — by day 10 the forecast typically holds within MAPE 18% and stays there.
Week 3 — Promo and loyalty loop. Turn on daypart promo drafting for the two slowest hours per outlet. Connect Zalo OA / LINE / WhatsApp for delivery; start with a single segment (e.g. lapsed-30-day) and a single offer. Measure incremental visits, not coupon redemptions.
Week 4 — Compound. Roll the same flow to a second outlet, then a third. The operating model is the same at outlet 2 as outlet 20 — that is the point of LOOP.
KPI table — what to watch
| KPI | Target band 2026 | LOOP signal |
|---|---|---|
| Food cost % | 30–34% (QSR), 27–32% (café) | Variance alert within 6 hours of shift close |
| Labour cost % | 22–28% | Daypart staffing recommendation in morning brief |
| Repeat-visit rate (90d) | 38–46% (café), 28–36% (QSR) | Loyalty segment drafted weekly |
| Aggregator share of revenue | 18–32% | One queue across 5 aggregators; per-aggregator margin in dashboard |
| AI forecast MAPE per outlet | 14–22% | Recalibrates weekly per outlet |
| Ticket time (peak) | 6.8–9.2 min | KDS routing recommendation when over band |
| Void rate | <0.8% | Pattern-detection on staff/outlet/daypart |
Common pitfalls SEA operators hit in 2026
Treating aggregator orders as a separate business. Operators who keep five aggregator tablets running in parallel lose roughly 4–7 minutes per peak hour to context-switching alone, and miss the per-aggregator margin picture entirely. Unifying the queue (one tablet, one KDS, one accounting line per aggregator) is usually the single highest-leverage move in the first 60 days.
Letting variance live in spreadsheets. A weekly food-cost review is a 7-day reaction time on a 24-hour problem. Variance has to live in the operating layer — flagged, attributed and routed to the responsible manager within hours, not aggregated to a Friday email.
Loyalty as a punch card. A 2026 loyalty programme is a messaging channel with attribution. If the only metric is "points issued", the programme is a cost centre. If the metric is "incremental repeat visits per segment per month", it compounds.
Forecasting at the wrong resolution. Chain-level forecasts are wallpaper. Daypart-and-outlet is the smallest unit that pays back — coarser is too vague to act on, finer is noise.
How LOOP solves this
LOOP is an AI-native restaurant operating system built for SEA F&B chains. Operators run their venues by voice or text command instead of clicking through dashboards. AI forecasts demand per outlet at daypart resolution (MAPE 14–22% on LOOP cohorts), flags food-cost and labour variance within hours of the shift closing, drafts promos for slow daypart slots and pushes them to Zalo OA / LINE / WhatsApp, and delivers a three-item morning brief at 06:30 local time so the operator's first action of the day is informed. LOOP unifies GrabFood, ShopeeFood, Be, foodpanda and Gojek into one queue, supports VietQR / PromptPay / QRIS / DuitNow / PayNow / QR Ph, and ships VAT e-invoice (TT78) via MISA, Viettel and VNPT. Pairs with Peko loyalty (50% lifetime discount on LOOP for Peko customers).
Under the hood, LOOP is offline-first with a 90-second resync window so orders, payments and KDS keep firing through ISP drops; recipe-level COGS is computed at order time so every plate's contribution margin is visible before the shift ends; and the morning brief is generated from the previous day's variance, the current day's forecast and the next 14 days of bookings, weather and local events — not a static template. The result is fewer dashboards, faster decisions, and a noticeably calmer week for the operator.