Methods, apparatuses, and devices, including computer programs encoded on computer storage media, for recognizing an unauthorized behavior are provided. One of the methods includes: obtaining, through machine vision, body movement pattern data of a user; obtaining feature data of an object; comparing the body movement pattern data with a preset body movement pattern; and determining that the user's behavior is unauthorized in response to the body movement pattern data matching the preset body movement pattern and that: a distance between the user's body and the object is within a distance threshold over a preset length of time, the attribute category of the object is a preset category, and the external surface image data does not match a default external surface image of the object. The feature data may include: position data of the object based on a radio frequency identification tag on the object, attribute category data of the object, and external surface image data of the object.