Identity theft detection has a lag problem. The fix is a camera, not a credit bureau.

Because identity theft almost always begins with a physical act. A mail thief pulls a pre-approved credit card offer out of a mailbox. An intruder walks into an apartment mailroom at 2 a.m. and opens a tenant's cluster box. A package containing a new debit card disappears from a lobby. A wallet gets lifted from a parked car. The financial fraud that a credit monitoring product eventually alerts on is downstream of that event, usually by a week or more. A DVR on a mailroom or parking area is the only system that records the moment the identity was actually compromised. Putting a detection layer on top of that DVR turns the camera into the earliest possible warning.

It varies by target. A stolen debit card from a mailroom typically sees its first fraudulent use in 3 to 5 days, after the thief confirms the card activates. A stolen SSN or W-2 fragment takes longer, often 14 to 45 days, because the thief is assembling a synthetic identity. Tax refund fraud from a stolen 1099 can lag months, surfacing only when the victim's own return gets rejected. Credit bureau monitoring and dark web scanning operate on that trailing edge. A camera alert at the moment of physical entry operates at t = 0. The gap is the entire window in which a lock change, a mailbox reseal, a police report filed same-day, and a proactive credit freeze can still stop the loss.

Cyrano watches for a person, inside a drawn zone, for longer than the dwell threshold, during a time window that zone is armed. At a cluster mailbox, that zone is the alcove in front of the boxes, the dwell threshold is 15 to 20 seconds, and the time window is outside normal mail pickup hours. A resident walking past in 3 seconds never crosses the line. A resident grabbing their mail at 6 p.m. is outside the armed window. A stranger standing in front of the cluster box for 45 seconds at 2:40 a.m. clears all three filters. The filter stack is zone plus dwell plus time, not pose classification.

Cyrano taps the DVR or NVR's HDMI multiview output. That is the signal that already drives the guard monitor and already has every camera on the recorder mosaiced into tiles. One HDMI cable in, one HDMI cable out to the monitor, one network cable, one power plug. Under two minutes of physical install on a running DVR. There is no ONVIF negotiation, no per-camera credential, no firmware change. It works on analog cameras, IP cameras, and any brand of DVR or NVR that outputs HDMI, which covers Hikvision, Dahua, Lorex, Amcrest, Reolink, Uniview, Swann, Night Owl, and every rebrand of those.

A DVR composite signal is not a clean feed. Every recorder draws a clock, a per-tile camera name strip, and a channel bug onto the mosaic before output. A detection model without overlay masking will occasionally score a bounding box on the camera name text or fire a spurious detection at the colon glyph inside the clock. In a mailroom context, where the ratio between real incidents and resident traffic is already low, one false positive a night is enough to get the WhatsApp thread muted, and a muted thread is a dead detection system. Cyrano runs an overlay mask per DVR layout id, once at install time, so the model only sees the scene inside each tile.

A cropped thumbnail of the offending tile, the camera label, the zone name, how long the actor has been in the zone, and a timestamp. That is it. No dashboard, no login. The message lands in the same WhatsApp thread staff already use for maintenance tickets and vendor coordination. For identity theft scenarios the label is explicit: mail_alcove_after_2200, package_lobby_overnight, amenity_locker_pry. The payload is intentionally boring so it can be read in two seconds while walking between units.

No. They operate on different timelines and different signals, and a household or property should run both. Credit monitoring is a backstop that fires when fraud has already been attempted. Cyrano is a front-stop that fires when the physical precursor happens. For multifamily properties in particular, the physical-first detection layer also sets up a clean evidence chain: a time-stamped thumbnail of the zone entry, tied to the DVR recording, gives USPS Postal Inspectors and local police a starting point that credit bureau logs do not provide. The two layers are complements, not substitutes.

The categories where the physical event is geometric and scheduled: cluster mailbox fishing in apartment mailrooms, package theft of items containing new cards or statements, overnight cluster box pry attempts at the curb, USPS Arrow key attacks, storage locker pry at amenity rooms and basements, vehicle break-ins in apartment parking at 2 to 4 a.m., and dumpster dives of paper shred bags on trash night. Every one of these has a defined polygon, a repeating time window, and a dwell threshold. Credit bureau alerts do not watch any of these. A camera pointed at the zone does.

Up to 25 tiles per unit off a single DVR multiview. A mid-size apartment property typically has 16 to 24 cameras on one DVR, so a single unit covers the entire site: mailroom, lobby, amenity rooms, parking entries. If the DVR is set to a 4x4 grid the unit runs inference across 16 tiles in parallel. If the operator switches the DVR to fullscreen on the mailroom camera during an active incident, the unit re-scopes to that single camera at full resolution for higher per-tile accuracy.

No frames are uploaded for the normal event path. Inference runs on the edge unit, and only the thumbnail of an alert-level event is attached to the WhatsApp message. The full video remains on the existing DVR under the existing retention schedule the property is already operating. That keeps the compliance posture identical to what property ownership already has in place: DVR retention policy, existing camera policy, existing guard procedures. No additional cloud dataset is created.