The Flock That Fights Fraud

The $100 Billion Problem Nobody Built For

Retail shrinkage hit $112.1 billion in the United States in 2024. That figure — stunning in its scale — represents the cumulative erosion of value across millions of stores through external theft, internal fraud, administrative error, and vendor deception. Enterprise retailers combat it with platforms from Sensormatic, Agilence, and Appriss Retail. They deploy computer vision, exception-based reporting, and teams of data scientists. Their budgets start at six figures and climb from there.

Small and midsize retailers get none of it. The 33 million merchants running on Square, Clover, and Toast POS systems absorb shrinkage as a cost of doing business. They watch employees process suspicious refunds and wonder if it's theft or incompetence. They accept short deliveries from vendors because they don't have the data to prove it. They catch shoplifters and release them because there's no system to track repeat offenders across locations.

Canary LP was built to close that gap.

Canary Core The main dashboard surfaces real-time shrinkage metrics, RefundRadar alerts, and transaction anomalies across all merchant locations.

Thirty Years in the Making

Geoff Lyle — known to his team as Jeffe — didn't arrive at loss prevention through a startup accelerator pitch deck. He arrived through three decades of building the infrastructure that enterprise retail depends on, starting at PricewaterhouseCoopers in 1995 and moving through IBM's retail division before co-founding Sysrepublic, the company that built the largest private repository of retail sales data in the industry.

At Sysrepublic, Jeffe's team powered loss prevention analytics for 6,800 7-Eleven stores, IKEA, Stein Mart, and dozens of regional chains. They invented hosted retail SaaS before Amazon Web Services existed — building HP1080 servers with Fusion-IO backplanes in their own colocation cage, piping EDI feeds from retailers who couldn't get budget from their own IT departments.

In 2013, Sysrepublic's data forensics helped federal authorities uncover one of the largest human trafficking operations ever prosecuted — 50 exploited workers generating $182 million across 14 7-Eleven franchise locations. The DOJ called it one of the largest criminal employment investigations ever conducted. Jeffe and 7-Eleven's VP of Asset Protection Mark Stinde presented the findings at RILA in Dallas.

By 2014, Jeffe was mining Bitcoin on a Raspberry Pi in his closet — a Christmas gag gift that became an infrastructure conviction. The same SHA-256 cryptography securing his SOC2-certified data centers was securing the Bitcoin network. The blockchain wasn't just money to him. It was the immutable transaction log he'd spent his career trying to build for retail.

Four Modules. One Flock.

Canary LP is not a single product. It's a modular ecosystem where each component makes every other component smarter. Canary detects. Owl predicts. Fox investigates. Goose settles. Together, they form a closed-loop intelligence platform that turns raw Square POS data into actionable loss prevention for merchants who've never had it.

RefundRadar: The AI That Never Blinks

At the heart of Canary sits RefundRadar — a rules-based and machine-learning hybrid detection engine that scans every transaction flowing through Square's API. It doesn't wait for month-end reports. It doesn't rely on a manager noticing something wrong. It watches every refund, every void, every return, every discount — in real time, across every register, at every location.

When Employee #247 processes six refunds in twenty-two minutes at the Market Street location, RefundRadar doesn't just flag it. It calculates the total exposure ($412), cross-references the refund cards against the employee's personal payment methods, checks whether similar patterns exist at other locations, and auto-generates a Fox case if the threat score exceeds the configured threshold.

RefundRadar The alert feed shows every anomaly detected across locations — severity-scored, status-tracked, and one click from a Fox case file.

Fox: Where Alerts Become Investigations

Alerts without case management are noise. Every loss prevention professional knows this. A flag goes up, someone looks at it, nobody writes it down, and six months later the same employee has processed $12,000 in fraudulent refunds across three locations. Fox exists to make that impossible.

Every incident gets a case number (FOX-2026-SOMA-0012). Every case gets a timeline, an evidence locker, a loss calculation, and an action queue. Subjects — employees, customers, vendors — accumulate profiles that track their activity across every location in the merchant's network. A shoplifter who hits three franchise stores in a month doesn't get treated as three isolated incidents. Fox connects the dots.

Fox The Case Workbench: full investigation timeline, subject profile with prior incidents, threat scoring, evidence count, and pending action queue — all in one view.

The evidence locker is the technical backbone. Every uploaded file — CCTV stills, transaction exports, written statements — receives a SHA-256 hash at upload. The hash is stored in an INSERT-only table that rejects all UPDATE and DELETE operations at the database level via SQLite triggers. This isn't application-layer security that a determined actor could bypass. It's structural immutability enforced by the database engine itself. If a case ends up in court, the evidence chain is cryptographically verifiable.

Fox Case management dashboard — open cases, total loss, active subjects, threat scores

Fox Evidence Locker — immutable, SHA-256 hashed, chain-of-custody tracked

Owl: The Brain of the Flock

If Canary is the eyes and Fox is the hands, Owl is the brain. It sits on top of the entire data layer — Square transactions, Lightning payments, inventory counts, employee activity — and turns raw signals into predictions that no human analyst could produce at the speed retail demands.

The Total Retail Loss dashboard implements Adrian Beck and Colin Peacock's framework as a live, real-time breakdown. Shrinkage isn't just "theft" — it's external theft, internal theft, administrative error, vendor fraud, and process failure, each with its own trajectory, its own drivers, and its own intervention strategy. Owl shows merchants not just what they're losing, but why, where, and what's coming next.

Owl The Analytics Oracle — natural language insights, confidence-scored predictions, and automated escalation to Fox when threat scores spike.

Fraud ring detection uses graph neural networks to map relationships between customers, employees, cards, and transactions. When Employee #247's personal Visa card receives refunds processed by Employee #247's register login, Owl doesn't just flag it — it maps the entire network, calculates confidence scores, and generates a visualization that makes the pattern undeniable.

Owl Total Retail Loss — Beck & Peacock framework, live breakdown by category

Owl Fraud Ring Detection — graph neural network mapping entity relationships

Goose: The Bitcoin Money Machine

Square rolled out Lightning Network support in late 2025. That gave 4 million merchants the theoretical ability to accept Bitcoin payments. Goose turns theoretical into turnkey. A self-hosted BTCPay Server integration that plugs directly into Square's POS ecosystem, Goose lets merchants accept Lightning payments with instant settlement, zero chargebacks, and processing fees that make traditional card networks look predatory.

The merchant doesn't need to understand Lightning any more than they understand Visa's interchange network. Customer scans a QR code, pays in sats, merchant receives BTC or auto-converts to USD. The experience is seamless. Underneath, a silent micro-fee engine captures 0.1% arbitrage on conversion spread — revenue generation without merchant-facing friction. The Goose lays golden eggs while the merchant sleeps.

Goose Lightning volume, BTC treasury, node status, and micro-fee revenue

Goose Treasury management — auto-conversion rules, cold storage thresholds, DCA settings

The Flock Behind the Platform

Canary isn't built by a roomful of twenty-somethings who just discovered retail exists. It's built by a team that has collectively deployed POS systems across 4,000 stores in twelve countries, built fraud detection for the world's largest convenience chain, and shipped production code that processes billions of transactions.

Why Bitcoin-Native Matters

Canary isn't a fintech that bolted Bitcoin onto a traditional stack for marketing points. It's a platform built from the ground up on cryptographic principles that Jeffe has relied on since his IBM days. SHA-256 hashing secures evidence chains. INSERT-only tables enforce immutability the way a blockchain enforces consensus. Lightning micropayments create economic barriers to abuse. LNURL-auth eliminates password breaches.

This isn't ideology. It's infrastructure. Every design decision assumes cryptographic proof, instant settlement, and satoshi-gated access. When a Fox evidence file is uploaded, it gets the same hash verification that secures Bitcoin transactions. When a Goose payment settles, it settles with the same finality as a confirmed block. The principles are identical. The application is retail.

For the merchants Canary serves — especially the cash-heavy businesses that traditional banks and legacy LP vendors won't touch — Bitcoin-native isn't a curiosity. It's the answer to a banking system that abandoned them.

What's Next: The Roadmap

Fox Sprint 1 is complete. The case management schema is live — seven tables, eighteen API endpoints, thirty-five unit tests passing, and a test data pack seeded with realistic investigation scenarios. The team ships daily. Eva enforces it.

Next on the roadmap: the Dog coaching module (retention over rehire — the "least guilty" insight turned into software), Bull for DSD vendor accountability, Hawk for pharmacy fraud detection, and a Square Marketplace app submission that would put Canary in front of four million merchants overnight.

The conference roadshow is being planned: NRF Big Show, RILA, NRF PROTECT, Shoptalk, Money 20/20. Franchise channel development is underway with targets including Uncle Sharkii, Groucho's, and Bluestone Lane.

The clickable prototype you see in these screenshots represents the full vision — every page, every module, every workflow that a merchant will eventually interact with. It's the blueprint. The code is catching up to it, one sprint at a time.