To catch a thief with a recognition test: The model and some empirical results