# Fraud Audit Based on Visual Analysis: A Process Mining Approach
## 5 Use Case: Implementation at a Point of Sale of the Hospitality Sector
### Sequence Analysis  
To identify irregular sequences according to the order in which the activities appeared, an overview of the process sequences was obtained using trace alignment (Figure 11). Figure 10: View by instances of the number of operations performed on checks. Figure 9: View by the originator of the executed product suppressions. Figure 11: View of the different sequences of the process activities. A preliminary examination of the sequences shown in Figure 11 reveals the existence of 73 different process execution sequences. Only one sequence conformed to the expected normal process sequence (Open \(\rightarrow\) Print \(\rightarrow\) Close). According to the trace alignment results, of the total, 3570 instances followed the regulated process. Over 2700 instances (accounting for 43% of attended customers) followed exceptional sequences. A high concentration of the exceptional operation \"suppress product\" (shown in red) could also be appreciated across the process's different sequences. This behavior could be interpreted as a high error rate of product registrations during the checks or as habitual fraud, related to the exceptional operation. In total, product eliminations occurred in approximately 30% of the total processed checks. In addition, an average of more than two products was canceled per check, which is a high value. We then analyzed the different patterns presenting the exceptional activity \"suppress product\" (and we also identified irregularities associated with this activity in the previous phase):  
* Checks that included product cancellations after printing the customer's consumer bill:  
We used ordering-based filters to obtain the sequences in which product deletions occurred after printing. The filter specification in LTL language using the temporal logic filter was as follows:  
ate.ACTIVITY as ACTIVITY = A equals \"suppress product\";  
ate.ACTIVITY as ACTIVITY = I equals \"print check\";  
formula := <>( (ACTIVITY == I / <>( ACTIVITY == A )));  
The visual output of the trace alignment with the filtered data is presented in Figure 12.  
Figure 12: View of the sequences of activities with product eliminations after printing. * Annulled checks without prior suppression of the inserted products. The cancellation of checks is an exceptional activity presenting the lowest frequency in the process. However, it is extremely risky because it can be used to charge the customer for a product or service and not leave records of the income in the system. We filtered the sequences that contained the \"Annul check\" activity and visually detected a group of sequences with check cancellations without the prior suppression of the products inserted before closing the check (a business rule established by the hotel to prevent fraud). This behavior is visualized using a temporary ordering-based filter, which returns 66 checks incurring the anomalous behavior explained above. The filtered data are subsequently processed using trace alignment (See Figure 13). Filter specification is expressed in the LTL language, using the temporal logic filter:  
ate.ACTIVITY as ACTIVITY =B equals \"Annul check\";  
ate.ACTIVITY as ACTIVITY =A equals \"Suppress product\";  
ate.ACTIVITY as ACTIVITY =C equals \"Close Check\";  
formula := (<>(ACTIVITY == B)/ {<>((ACTIVITY == A/ _O(ACTIVITY == C )))));  
Figure 13 shows two sequences containing the behavior described, (the first \"Open \(\rightarrow\) Close \(\rightarrow\) Annul_check\" and the second \"Open \(\rightarrow\) Print \(\rightarrow\) Close \(\rightarrow\) Annul_check\"). * Checks with product deletions, no consumer bill printing for the customer. We additionally employed visual analysis using trace alignment to identify a group of 211 checks in which products had been eliminated and the activity \"Print_Check\" was not executed (signifying that the user had paid without previously checking the consumption). This behavior could be used to commit fraud.