Item images and item information for an item identified as being associated with a potential theft during a transaction at a transaction terminal are sent in real time to an alert controller of a management terminal. The item images and item information with transaction details are presented on a display for resolution by a clerk operating the management terminal. A timer is also set and a confidence score calculated representing a confidence level that the item is the subject of theft. When the timer expires and there is still no resolution provided by the clerk a decision is made as to whether to interrupt the transaction processing on the transaction terminal for assistance or whether to permit the transaction to complete on the transaction terminal based on the calculated confidence score.