Systems and techniques for retail product transaction processing and security tag deactivation analysis. Upon detection of a security tag deactivation associated with entry of product information into a retail transaction, product information for the product is analyzed to determine whether the security tag deactivation is legitimate or possibly illegitimate. Upon identification of a deactivation as possibly illegitimate, an alert is issued to a retailer employee to investigate the transaction. The product information may be updated according to an entry made by the retailer employee identifying the deactivation as legitimate or illegitimate. Product information for a product may include a deactivation count for a product, with a deactivation being identified as possibly illegitimate if the deactivation count does not meet a predefined threshold, the deactivation count being incremented if a deactivation identified as unexpected is determined to be legitimate.