# Fraud Audit Based on Visual Analysis: A Process Mining Approach
## 5 Use Case: Implementation at a Point of Sale of the Hospitality Sector
### Temporal Analysis  
We employed a view to analyze the instances' behavior over time using a dotted chart (It shows a graph of points on which each point represents an event with two dimensions. The time dimension is on the horizontal axis and the class to which the event belongs is on the vertical axis. The class may vary depending on the analyst's objectives (the originators, the activities, or the instances of the process can be selected as a class). The color and shape of each point (event) can refer to different attributes) (Figure 6). The figure presents a relative view of the moments in time (hours) of the operations (colored points according to the activity) performed on checks (rows).  
It shows a compact grouping of points (events) executed during the first two hours of each instance. This coincides with the logical amount of time that a client stays in a restaurant; however, the red box contains a significant number of unusual points, indicating the existence of multiple operations performed on checks that exceeded three hours. This behavior is suspicious, considering the restaurant operates in shifts of 3 h and a normal customer does not take more than three hours to eat at a restaurant.  
Using the capabilities of the filtering component (temporal logic filter), the data were pruned to visualize the behavior of the checks with an execution time that exceeded three hours (Figure 7). We detected a higher incidence of suppressed product activities (bright blue dots) and the subsequent closure of checks (yellow dots). One behavior was visually detailed in which, 27 h after the check was opened, two product deletions occurred, the check was printed (a voucher with the bill shown to the customer), and the check was subsequently closed in the system. The above behavior is highly indicative of fraudulent activity considering that a customer does not stay in a restaurant, receiving services, for more than a day.  
Figure 7 also shows the result of a \"value-based\" filter to detect instances lasting over three hours: restricting the payment is \"effective\". The indicated check behaves as follows: the bill is printed (last operation registered in the system in the customer's physical presence) and 23 h later, seven products are deleted, and the check is subsequently closed (with the corresponding record in the system's bill). This behavior could indicate the use of ghost clients to commit fraud; that is, records in the system associated with a customer that never existed (it does not make sense to modify a check whose consumption bill was printed for the customer on the previous day).  
Figure 6: View of the duration of the instances using a dotted chart.  
Figure 8 shows a relative view over time, with the operations on checks (points) executed by the originators (shown in each row). The objective is to evaluate the incidence of the different executors regarding the operations performed using the system.  
We then used filtering options to show the originators' behavior in relation to the exceptional \"Suppress product\" activity according to the date on which they occurred (in Figure 9, product cancellation activities are shown as points by each originator, according to the date on which they occurred). The results show that the user who canceled the greatest number of products was also the one who performed the biggest number of operations outside the established schedule.  
Figure 8: View by the originator of the executed operations.  
Figure 7: View of the instances operating outside service hours.  
As a result of performing the \"Temporal Analysis\" phase, we identified irregularities referring to operations performed outside service hours, with a high incidence of exceptional product elimination activities. We also detected workers who frequently operated outside established hours and who tended to execute multiple product eliminations for each check.