A system for anomaly detection in a self-checkout environment, comprising a processing unit for receiving transaction data from a self-checkout terminal: characterising an activity based on a set of features extracted from the received transaction data; defining a plurality of active intervals for each characterised activity; determining a meta-feature vector for each defined active interval of the plurality of active intervals; comparing each meta feature vector with a predefined set of vectors; and determining an anomaly based on the comparison.