The Anatomy of a Fuel Siphoning Event in Telematics Data

Detection accuracy in fuel telematics is not primarily a machine learning problem. It is a signal characterization problem. Before building any model, the question is: what does a siphoning event actually look like in the data stream, and how does it differ from the dozen other reasons a fuel level reading can drop?

Getting that characterization right is most of the work. A model built on a poorly characterized signal will produce a high false positive rate regardless of its sophistication, because it is learning to recognize the wrong pattern. Here is what the correct characterization looks like.

Normal Fuel Consumption Curves: The Baseline

Understanding the theft signature requires understanding what normal fuel consumption looks like in the data stream first. Detection is about deviation from normal, not about absolute values.

Under normal motorway driving at a consistent speed, a loaded commercial vehicle shows a smooth, declining fuel level curve. The rate of decline is approximately proportional to engine load, which correlates with speed, gradient, and payload. On a flat 90 km/h run, a Euro 4 diesel engine in a 15-ton truck will decline roughly 0.30 to 0.40 percent tank capacity per minute, depending on tank size and specific engine calibration.

In urban stop-and-go conditions, the decline rate is less predictable but still correlates with movement: periods of heavy acceleration show faster decline; idle periods at traffic signals show slower decline. The key property of normal consumption is that fuel level drops correlate with engine activity and vehicle movement. Every significant decline is preceded and accompanied by engine operation.

A legitimate refill shows a rapid level increase, typically rising from the fill-start level to full or near-full within 5 to 15 minutes depending on pump rate and tank size. The curve then resumes declining from the new starting point. The shape is distinctive: a sharp upward inflection followed by a return to the normal declining slope.

The Siphoning Signal: Four Discriminating Features

A siphoning event deviates from this baseline in a specific and identifiable way. The deviation has four discriminating features that together make it distinguishable from every legitimate fuel level drop pattern.

The first discriminator is the rate of change. A siphoning event produces a faster level drop than any consumption pattern can explain. A siphon with a typical hose will remove 15 to 30 liters in 10 to 20 minutes, depending on tank access and hose diameter. That rate, expressed as a tank percentage decline per minute, will exceed anything the engine alone can produce at any operating condition. A 200-liter tank losing 20 liters in 15 minutes is declining at approximately 0.67 percent per minute. At idle consumption of 2.5 to 4 liters per hour, the engine would take more than 4 hours to consume that volume. The rate signature is unambiguous.

The second discriminator is vehicle motion state. Siphoning requires access to the tank, which requires the vehicle to be stationary. The rate-of-change anomaly should appear while GPS speed is zero and the vehicle has not moved for a preceding period. If a fuel level drop at an anomalous rate occurs while the vehicle is traveling at 80 km/h, it is almost certainly a sensor fault or CAN bus anomaly, not a theft event.

The third discriminator is engine load. A vehicle consuming fuel through its engine will show engine load data consistent with the consumption. An idle engine running air conditioning might consume 3 liters per hour with low load readings. A stationary vehicle losing fuel at 20 liters in 15 minutes with engine load near zero is the characteristic pattern: the rate of loss is decoupled from any engine operation signal.

The fourth discriminator is the preceding refill absence. A siphoning event produces a level drop that is not preceded by a level increase. This distinguishes it from the pattern where a driver refuels at an unregistered pump (a level gain not in the logged system), immediately followed by consumption (a level decline). In the unregistered refuel case, the timeline shows an increase before the decrease. In the siphoning case, the timeline shows only a decrease from whatever the prior fuel level was.

Contextual Amplifiers: What Raises Confidence

The four signal features above are sufficient to classify an event as a candidate anomaly. The confidence score of the classification is then adjusted by contextual signals that increase or decrease the probability of a genuine theft interpretation.

Time of day is the strongest contextual amplifier. Events between 00:00 and 05:00 local time are substantially more likely to be genuine theft than events during business hours, given that there are few legitimate reasons for a commercial truck to be at an off-depot location in the early morning with fuel level declining rapidly. The confidence boost for this time window reflects that empirical prior.

Location relative to known depots and registered fueling stations is the second contextual amplifier. An event at the vehicle's home depot, or within a few hundred meters of a registered pump, has a meaningful chance of being a legitimate transaction that bypassed the fuel card system or a depot maintenance activity. The same signal at an industrial edge of a highway interchange at 02:00 carries a different probability weight.

Scheduled vs. unscheduled vehicle activity on the date in question is the third amplifier. A vehicle that is scheduled for a rest day, with no planned dispatching, showing a fuel anomaly event is more suspicious than a vehicle on an active route that was expected to be at that location. Fleet scheduling data integrated with the detection layer adds meaningful signal for this context check.

None of these contextual signals replace the primary fuel curve analysis. They adjust the confidence score up or down and determine whether an event is dispatched as a high-priority alert, a standard alert for review, or a flagged item held for manual investigation. The alert priority affects how quickly a fleet manager can respond, which in turn affects whether any operational response is possible.

The False Positive Landscape

Identifying the patterns that look like siphoning but are not is as important as identifying the genuine ones. Two patterns dominate the false positive space in real fleet data.

The first is the fuel sensor glitch. Modern CAN bus fuel level sensors occasionally produce single-frame readings that are wildly inconsistent with surrounding readings: a truck reading 63 percent, then 40 percent, then 64 percent in consecutive 15-second frames. These glitches are easy to identify because they are isolated and surrounded by consistent readings. The anomaly scoring window's requirement for sustained anomaly across multiple consecutive frames filters them out effectively.

The second is the legitimate unregistered refuel that appears suspicious in the data. If a driver refuels at an informal pump not in the fleet card system, the fuel card log shows no transaction while the tank level increases. In some data configurations, if the ingestion lag means the level increase is not yet correlated with any transaction, it can appear as a level change without a registered refuel, which superficially looks like the fourth discriminator pattern. The resolution is the direction check: the unregistered refuel produces a level gain, not a loss. The siphoning event produces a loss. The model's first-pass filter is always on the direction of the anomaly before evaluating its rate.

We are not claiming the detection model catches every event or produces zero false positives under all conditions. No sensor-based detection system does. The goal is a false positive rate low enough that a fleet manager treats alerts seriously, and a false negative rate low enough that patterns of recurring events are surfaced before they become an invisible monthly drain.