Patent attributes
Image analysis is performed on a user at a transaction terminal. Based on behaviors, expressions, and activities of the user, fraud or potential fraud is flagged. When fraud is flagged, the transaction terminal stops processing an active transaction on behalf of the user and alerts are sent. When potential fraud is flagged, images/video associated with the active transaction are sent for review and the active transaction may be suspended or permitted to proceed at the transaction terminal. In an embodiment, a same user conducting multiple transactions with different accounts at a same transaction terminal or multiple different transaction terminals within a configured period of time is automatically identified as fraud based on a fraud rule.