Three abuse patterns at unattended machines in the data

An unattended machine does not steal. The people around it do: whoever holds the cash box key, the service button or the admin panel. A camera helps less than people expect — it shows who stood next to the machine, not what they did with the money. The data does. Below are the three that come up most often and the trace each one leaves in the books. They apply to car wash bays, vacuums, vending and any other machine where money and service pass through a controller.

What it takes for a pattern to be visible at all

Everything below depends on one condition: each device reports separately, with three independent numbers — what the controller recorded, what the money channel confirmed (acquirer, bank, the note count inside the acceptor) and what went into fiscal records. We cover how that reconciliation works in a separate article. If revenue is only visible as one total per site, none of the three patterns will show — it dissolves among the other devices.

Pattern 1. Starts without payment

On site. A bay or machine is started through service mode, a test button or a jumper on the controller. A "friend" gets the service, and the money goes into a pocket instead of through the terminal, or does not exist at all.

In the data. More starts than payments. The gap sits on one device, at certain hours or shifts, and stays steady rather than jumping around. Service starts are normal in themselves — after a repair, during a check. What is suspicious is their schedule: a "check" every day at the same hour on the same bay is no longer a check.

What helps. Every service start is its own event in the log, with a reason and a person, not a silent switch. Then the summary shows not just how many, but who and why.

Pattern 2. Short cash collections

On site. Between the note acceptor and the owner's till stands a person who takes the cash out. If cash accounting starts with what that person brings in, it starts with their word.

In the data. When the acceptor counts every note and coin itself and sends the total to the server before the cash box is opened, collection becomes a check: the system already knows what should be inside. A gap within the acceptor's error margin is normal. A systematic gap on the same machines and the same collector is the signature. It is especially telling when card and QR payments at the same site match to the cent and only cash drifts.

What helps. Counting inside the acceptor, and an immutable log of every cash box opening: who, when, what the system expected, what was delivered.

Pattern 3. Breakdowns on a schedule

On site. The machine is "out of order", customers are told it broke — and are served off the books. Or refunds are issued to customers who never asked for one.

In the data. A real fault is random: spread over time, hitting different devices, with a technical trace in the logs — a dropped link, an acceptor error, a controller restart. A scheduled "breakdown" repeats: same device, same shifts, and no technical trace. Downtime exists, but the controller log shows no error. Refunds behave the same way: tied to one person or shift rather than spread evenly.

What helps. Device-state telemetry that does not depend on what staff report, and refunds only by a rule written down in advance, never at a manager's discretion.

The system does not diagnose

It is worth being clear about what the records do. They do not accuse anyone; they show repetition — the device, the hours, the shift, the size of the gap. The owner draws the conclusion by checking it against the rota. A repeated gap can have an honest explanation too: a worn acceptor, a misconfigured controller, a bug in the accounting itself. That is why every discrepancy needs a status — seen, explained, closed — with the explanation recorded next to it.

Why the camera sees it last

A camera shows who stood at the machine, not how many notes passed through the acceptor or how many starts the controller issued. People usually reach for the footage once they already know which date and which device to look at — and they learn that from the data. The camera confirms; it does not detect.

Frequently asked

How quickly does a pattern show up?

It depends on how often it repeats and whether each device is reconciled daily. With daily per-device reconciliation, a repeated gap on one device is usually visible within a few shifts; with a monthly per-site report it may never be visible.

Can abuse be told apart from a fault without a site visit?

Often, yes: a fault leaves a technical trace in the controller log, abuse does not, but it is tied to people or shifts. A person still makes the final call, not the system.

Do we need new equipment to see this?

Usually not. What is needed is access to controller and acceptor data; if they have a documented interface, the accounting is built on top of existing hardware.

Cards reconcile but cash does not — where to start?

Check whether cash is counted inside the acceptor before collection. If it is not, change that first: without it, short collections are invisible by design.