AI Risk Wire

Cases › operational mistake › LR-2026-0432

Customer misidentified by Sainsbury's facial recognition system

Preliminary Why: 1 report: BBC · subject to change · 1 independent report

Status: fix reported

Severity minor
Reported 5 Feb 2026
Developer and model Facewatch
Industry Grocery retail

No source states: loss or records, agent tool, could do, deployer.

Severity minor: Test: contained to one deployer (one store) with one person affected; the sources state no count of other affected parties

Sainsbury's rolled out Facewatch facial recognition in six London stores, where cameras compare shoppers' faces against a database of recorded offenders and alert store managers to verify matches. At its Elephant and Castle store, staff approached a customer, Warren Rajah, and told him to leave after wrongly identifying him as a flagged offender. Sainsbury's said the error was in human verification, not the technology. Facewatch later confirmed Rajah was not on its database. To verify this, Rajah had to send a copy of his passport and a photo. Sainsbury's apologised and offered him a £75 voucher, and said management at the store would receive additional training.

What happened

1 · What went wrongStaff wrongly identified a customer as a flagged offender and asked him to leave the store.
2 · What it reached or didThe customer was told to leave the supermarket and was not given a reason at the time.
3 · How it was caughtFacewatch confirmed the customer was not on its database after he contacted it.

What was done

Sainsbury's apologised and offered a £75 voucher; store management is to receive additional training.
Fix reported

“Additional training for management at the Elephant and Castle store”

Same developer, same risk, after the fix: LR-2026-0560

Risks

Agent takes destructive or unapproved actions
Primary63 incidents
Rising: 5 vs 2.2 a week

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Tool allow-list · Fail-closed defaults · Stop control

Application

Human approval for high-impact actions · Change review and separation of duties · Least-privilege access for the agent · Production kept apart from test · Activity logs · Adversarial testing before deployment

Infrastructure / target

Backups and recovery

Similar incidents

Shoppers falsely identified by Facewatch facial recognition in UK stores2026-05-03
Facial recognition watchlist error leads to wrongful shoplifting accusation at a Cardiff retail park2025-11-20
Sainsbury's ejects innocent man after facial recognition mix-up2026-01-30
Sainsbury's facial recognition wrongly accuses customers of shoplifting; scanners suspended2026-08-17

All cases of this kind ›

Evidence

No source states: what the AI was doing, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.

Show the full account: 7 items from the primary sources

What happened, in order

  1. January Sainsbury's announced it would expand Facewatch use to five London stores, including Elephant and Castle.

Not dated in the sources:

  • Customer was approached by staff at the Elephant and Castle store and told to leave after being wrongly identified.
  • When the customer asked why, he was directed to a poster and told to contact Facewatch.
  • Facewatch confirmed the customer was not on its database.
  • To verify he was not on the system, the customer had to send Facewatch a copy of his passport and a photo.
  • Sainsbury's apologised and offered the customer a £75 shopping voucher.
  • Sainsbury's said management at the Elephant and Castle store would receive additional training.
Show every field, with its source and grade

The AI system

Developer
Facewatch
C one secondary source states it

What happened

Earliest source we hold
2026-02-05
D inferred by us from the described behaviour, reason shown
Cause
a human check that existed was skipped or failed
C one secondary source states it
Cause in detail
Error at the second stage of human verification
C one secondary source states it
Who was responsible
the organisation using it
C one secondary source states it
What was done
Additional training for management at the Elephant and Castle store
C one secondary source states it
What went wrong
operational mistake
D inferred by us from the described behaviour, reason shown

Impact

Severity
minor
D inferred by us from the described behaviour, reason shown
Who was affected
One customer, Warren Rajah, at one Sainsbury's store in Elephant and Castle, London
C one secondary source states it
Why this severity
Test: contained to one deployer (one store) with one person affected; the sources state no count of other affected parties
D inferred by us from the described behaviour, reason shown

Context

Industry
Grocery retail
C one secondary source states it
Country
United Kingdom
C one secondary source states it

Notes on gaps

The 99.98% accuracy claim is disputed by the complainant and not verified. The Byron Long case at a B&M store is another incident and is excluded. Sainsbury's statement that Facewatch did not identify anyone is reported as its claim.

LR-2026-0432 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON