One or more computing devices obtains service data of a user payment service. The one or more computing devices determines whether the service data of the user payment service falls within a service indicator range. In response to determining that the service data does not fall within the service indicator range, the one or more computing devices obtains location information of a target customer corresponding to the service data. The one or more computing devices obtains one or more local events corresponding to the location information. The one or more computing devices determines, based on the one or more local events, whether to output an alarm for the service data. In response to determining to output the alarm for the service data, the one or more computing devices outputs the alarm for the service data.