ArtsAutosBooksBusinessEducationEntertainmentFamilyFashionFoodGamesGenderHealthHolidaysHomeHubPagesPersonal FinancePetsPoliticsReligionSportsTechnologyTravel

Internal Theft Investigations

Updated on February 8, 2018
michelleonly3 profile image

M. D. Jackson has studied psychology since 1989. While her specialty is family relations, she also loves neuroscience and behaviorism.


It would be difficult to explain how I know what I know without the backstory on what happened right before I was hired. These events are true and I have taken care not to include names or diminish stores reputation.

On the morning of September 6, 2011 a man entered the International House of Pancakes (IHOP) in Carson City Nevada and opened fire on the occupants of the restaurant. The IHOP shared a parking lot with a department store. People scattered from the IHOP running to the department store for cover that day. Several store employees were close to being caught in the crossfire. The gunman took his own life in the middle of the parking lot after claiming the lives of four people and injuring 14 others (Reno Gazette Journal, 2014). On that day I was unpacking our house in a town nearby. The events of that day resulted in the turnover of several employees from the store including the Loss Prevention Supervisor.

On September 9, 2011, I was hired to be the Loss prevention supervisor for a department store in Carson City. At that time the district was looking to move people around. I was told that within six months (the time required by the company) I would be moved to the district auditor position, a job considered more suited to my education and management experience. I inherited a staff with various degrees of post traumatic disorder, and 2.1% shrink. I was isolated for eight months (in a tiny office) with minimal training and basically told there was no point in putting me through that training because, I was not going to stay in that position. In those eight months I did not apprehend even one shoplifter (I was not cleared to do so). Although I could have done nothing for that eight months, I chose to focus on what I could do; internal investigations and organized retain crime.

What is Shrink?

For those of you who do not know what shrink is: shrink or shrinkage is the difference between what you should have in inventory and what you actually have in inventory. Simply stated if you are supposed to have 20 apples and when you count your inventory you only have 15 apples, you are missing 5 apples. The five apples is your shrink. The Carson City store was missing $210,000 in merchandise from the yearly inventory in August (two weeks before I was hired).

My Background

A little background on me, I took out my first internal theft at the age of 18 (Without giving my age away that was a very long time ago). During my first management job at 19, I prosecuted the entire crew of another location who were stealing cash through return fraud. I have taken out employees in everything from casino’s to retail. My other gift is in human behavior. I can watch a cashier’s video and tell who is taking by their behavior. This came from years of watching cashier video in the casinos. The fastest internal I ever had, took me five minutes to track down the cashier (out of 130 employees) who was taking cash from the registers ($1,500 total loss to the company). The largest internal I had was a $35,000.00 cash case. Some of the situations described are from employers other than the department store.

Internal Theft vs External Theft

Shoplifters are a problem for retailers, Shoplifters are nothing compared to the damage that can be done by one employee who is stealing. Companies that focus on shoplifters hinder the ability of Loss prevention professionals to see the theft going on under their noses. There are two kinds of Loss Prevention people; 1. LP’s good at catching shoplifters and 2. LP’s Good at catching internal theft. Rarely do you see a balance between the two in the same person. Skills for either can be developed. Hopefully, you can use this information to develop your internal theft skills and lower your shrink.

Shrink Your Shrink

Let’s start with preventative measures. SCARE YOUR STAFF. I don’t mean act tough, I don’t mean talk tough. Convince your staff you could be anywhere and that you are AWARE. The more comfortable and isolated an employee feels, the greater the chance that they will steal. Take for instance your cashier who is left alone at the front of the store, in an office to count money, or your crew who stocks the store at night. Another opportunity for theft is employees working the fitting rooms. Fitting room employees are out of site in an area not typically covered by cameras. If you supervisory staff are so busy that they ignore employees, an employee will use that time to steal. All employees should be monitored. Your Loss Prevention team should have the option to contact a supervisor when they see employees excessively standing around doing nothing.

Radios are a double edged sword in loss prevention. Having an entire store on radio helps to prevent time card fraud and is a great safety net in emergency situations. Loss Prevention can monitor store activities through the radio traffic without divulging that they are in the building. Some of my best cases came from listening to radio traffic. Employees who were supposed to be working somehow ended up in the break room after stocking expensive merchandise. If Jane tells her supervisor she is stocking and she really is in another area or in the break room, something is up. Employees who spend time shopping during their shift instead of working are also prone to theft. An employee can easily miss tag merchandise, set up merchandise for theft, or conceal merchandise under clothing if they are left alone.

I know what you are thinking; you can’t be everywhere and your right. You can appear to be everywhere. Here are a couple of ways I convinced the staff that I knew everything that was going on all the time.

  • When you get a new employee make at least two over the radio contacts where you ask them to do something in their area that they would normally think you can’t see. An example was, I called a new employee over the radio to tell her merchandise was abandoned on the top of a rack she was standing beside. This makes employees think you are watching them, do this twice and they will think you are always watching them.
  • Watch your sales floor, when you see a customer needing help call an employee in the area to help them, this makes the employee think you are watching everyone.
  • If you don’t have a radio system call a cashier station and ask the cashier to move something in the cashier station. This lets them know you are watching.
  • Take advantage of opportunities. At one point a customer lost her keys on the sales floor. An employee (thinking I see everything) called me to see if I could see the keys. I backed up the camera to see the department the customer was in, then I went and looked on foot, dumb luck I found her keys. At that point there was no going back the employees were convinced I knew everything. Take advantage of these opportunities.

Most of your employees have no idea how the cameras work, what they see or what they don't see. Use that to your advantage.

Behavior & Attitude

Your first indication of an issue with an employee is behavior and attitude. Employees stressed out about home or work issues are more likely to steal. Pay attention to employee’s moods, are employees talking casually about someone who is having a hard time or giving them attitude? NEVER rule out management staff or people who are nice. Thieves can be anyone. Ethnicity, family background, and mannerisms are not indicators of who is a thief. One of my biggest external cases was the ex-wife of a cop. Setting your mind to a type, limits your ability to see what is really happening.

I was in another store and saw an employee who sent up huge red flags and the LP in the building told me “ oh that’s Marie she couldn’t steal, she’s fine”(name changed) that statement indicated to me that the LP was easily swayed by people who kiss up, and was going to be ineffective at internal cases. Which brings me to the next type of thief, the thief who will play nice with your LP team while they steal a company blind. Did I mention my first internal was the maid of honor from my wedding. I wish I could say that is a joke. She was a close friend and they did pull her out of the store in handcuffs.

Tells of Someone Stealing From the Register

To catch a thief you have to think like one. Just as a good LP knows the tells of a shoplifter, you can learn the tells of employees stealing. An employee stealing from the register can create a shortage or an overage depending on their method. A good LP is not fooled by cash drawer overages. Any difference in the register balance should be investigated.

My $35,000.00 case was an employee who was consistently over in the register. This happens from the employee losing track of cash differences for the day, in an attempt to not draw attention to themselves, the employee takes less cash than they have compensated for in the register. In this case, an employee would ring up a large number of copies for the customer. Once the employee saw the customer was paying with cash, the employee took the cash and changed the number of copies from the original total down to something nominal like 10 copies. Most people do not look at their receipt so the employee was able to siphon $35,000.00 out of that location within six months. A giveaway in this scenario is an employee who constantly has deleted/edited items on the register.

Here is a list of things to look for when watching a cashier:

  • Leaving the cash drawer open too long. Employees who steal need time to figure out what and how they are going to take, they will often leave the drawer open for longer than needed.
  • Unnatural movements like using more than one hand to pull cash out of the drawer for change.
  • The intentional placing of random items in close proximity to the register. In some cases, in other words a place to ditch the cash so they can retrieve it later.
  • Constant fidgeting. People who steal seem to move around more and mess with things a lot more than necessary.
  • Playing with items around the register after the cash drawer is open and closed. I once had a cashier use a sign out book to cover the area of the counter where she was taking $100.00 bills.
  • Opening and closing the drawer when no one is around.
  • Playing in the cash drawer, these people tend to pull bills out and count them a lot.
  • Does the person act nervous when supervisors approach?

Watch cashiers for a couple of days, you will start to see patterns in movement. Your eye will start to catch things you never noticed before.

Identifying Suspects

The easiest way to catch a thief is watching the returns. My first internal was four employees who were holding back receipts and returning items then pocketing the money (the maid of honor included). Know and understand customer behavior. Buyer’s remorse happens, although not to the tune of returning all the items purchased. High dollar returns and more than one item returns, should always be reviewed on video for authenticity. Also train yourself to look at the signatures on the return receipts. The signatures on a receipt can also indicate if a customer is doing pick up returns (we will discuss this later).

When employees are sharing a register it can be difficult to determine your thief especially when coincidences confuse the investigation. Here are a few simple ways to determine the thief.

  • List all the people who opened the drawer, this includes cash sales, no sales, and returns. Making this list will automatically eliminate anyone who only rang up credit/debit sales.
  • Look for an obvious theft, did a cashier open the cash drawer following a sale involving cash? Watch those transactions on video first. You would be shocked how often a novice thief uses the no sale button to steal.
  • If you still do not know who your person is, watch each cash drawer opening on video and match it up with the transactions by time.
  • Do any of the suspects have personal belongings in the register area, such as cigarette cases, cups, or sweaters with pockets? All of these items can be used to transport money out of the area without being detected. This can include your own sales ad! Cashiers should not remove objects from the register.
  • Still have no idea? Who is loading and unloading the drawer at night and in the morning? Who has keys to the drawer and doesn’t have to do a no sale to access the drawer?
  • Still no luck, watch the change given back to customers, a family member or friend can go through a person’s line and be given excessive change. Watch where the cashier puts money in the drawer and where they take money from.

In a normal store no more than three employees use a drawer in a day. It depends on the store. Your search shouldn't be log or hard. If you think you know who took it but, you don't see it on that tape. Get their schedule and watch them. If they didn't get caught the first time they will take again.

Return Fraud

Return fraud has to go down as one of the most common forms of theft. Strangely most employees happen upon this method by accident when they make a mistake. Employees sometimes forget to have customers sign the receipt, so they do it themselves to avoid a reprimand. This can trigger the idea to ring a return without a customer. Employees are just as likely to do a pick up return as a customer. An employee can hold back a receipt and then grab the receipted item returning it for cash. This is easy to spot if your computer system allows you to see who rang up the item.

I mentioned earlier that you should get familiar with your return receipts. Look at the signatures, do you have the same customer signature twice in one day? Do you have the same customer returning similar items? My first hour everyday was backing up returns on video to make sure the customer walked in with the item.

This also allowed me to see the customers and figure out if there was an Organized Retail Crime (ORC) issue. We closed two ORC cases using communication between stores and watching the returns. If the same people are returning items everyday, its time to start an investigation. In an ORC case often the merchandise is stolen from one store and returned at another for credit. Then they either sell or use the store credit.

Merchandise Theft

I touched briefly on employee “shopping” on the clock. Before someone decides to steal something they first have to admire that item. This happens in a more than casual glance. The employee might handle the merchandise more than needed, try the merchandise on, put the merchandise in an area it doesn’t belong. This includes ditching merchandise in back stock areas, in customer service, or on a random cart that is not in use.

Be aware of part-time employees who seem to develop a new wardrobe made up of clothing your store sells. Part time employees do not usually have the funds to support buying new clothes every week. It’s a good idea to randomly write down the outfits an employee has on when they enter for work and then look closely at what they are wearing before they leave work.

One of my best cases was a cleaning lady who was constantly admiring items, I always knew what she was going to steal because she handled the items during her shift. I just zoomed a camera on the item and then waited for her to take it.

Look for things that are out of the ordinary. Are procedures for high theft merchandise ignored by employees? Are you missing damaged out merchandise that was high dollar? We had a shady freight supervisor at one of my jobs, he was in during the early morning hours, I showed up at 3 am so he would forever question if I was around.

Another thing to look for is the same employee turning in a large amount of empty containers as theft. What a great way to cover up theft! I tracked who turned in what items to check for spikes that might lead to an internal case. After the seventh person that was walked out in handcuffs the employees caught on to the fact that anyone stealing would get walked out.

One Last Thing

Possibly the greatest tip I can give you is to be aware that internal theft is the cause of 75%-85% of your shrink. Catching shoplifters alone is not going to fix your problem. In one year I took out 18 employees district wide (they started sending me to other stores to do internal cases) and I was able to drop the shrink in my home location from 2.1% down to a .59%. With a little information any LP department can have similar results. I should mention that all of this happened by accident. The District Auditor position was deleted in my fifth month of employment leaving me stuck in the Loss Prevention job. Some things happen for a reason.

Note: signatures and company information intentionally was cropped out of the photos.



This website uses cookies

As a user in the EEA, your approval is needed on a few things. To provide a better website experience, uses cookies (and other similar technologies) and may collect, process, and share personal data. Please choose which areas of our service you consent to our doing so.

For more information on managing or withdrawing consents and how we handle data, visit our Privacy Policy at:

Show Details
HubPages Device IDThis is used to identify particular browsers or devices when the access the service, and is used for security reasons.
LoginThis is necessary to sign in to the HubPages Service.
Google RecaptchaThis is used to prevent bots and spam. (Privacy Policy)
AkismetThis is used to detect comment spam. (Privacy Policy)
HubPages Google AnalyticsThis is used to provide data on traffic to our website, all personally identifyable data is anonymized. (Privacy Policy)
HubPages Traffic PixelThis is used to collect data on traffic to articles and other pages on our site. Unless you are signed in to a HubPages account, all personally identifiable information is anonymized.
Amazon Web ServicesThis is a cloud services platform that we used to host our service. (Privacy Policy)
CloudflareThis is a cloud CDN service that we use to efficiently deliver files required for our service to operate such as javascript, cascading style sheets, images, and videos. (Privacy Policy)
Google Hosted LibrariesJavascript software libraries such as jQuery are loaded at endpoints on the or domains, for performance and efficiency reasons. (Privacy Policy)
Google Custom SearchThis is feature allows you to search the site. (Privacy Policy)
Google MapsSome articles have Google Maps embedded in them. (Privacy Policy)
Google ChartsThis is used to display charts and graphs on articles and the author center. (Privacy Policy)
Google AdSense Host APIThis service allows you to sign up for or associate a Google AdSense account with HubPages, so that you can earn money from ads on your articles. No data is shared unless you engage with this feature. (Privacy Policy)
Google YouTubeSome articles have YouTube videos embedded in them. (Privacy Policy)
VimeoSome articles have Vimeo videos embedded in them. (Privacy Policy)
PaypalThis is used for a registered author who enrolls in the HubPages Earnings program and requests to be paid via PayPal. No data is shared with Paypal unless you engage with this feature. (Privacy Policy)
Facebook LoginYou can use this to streamline signing up for, or signing in to your Hubpages account. No data is shared with Facebook unless you engage with this feature. (Privacy Policy)
MavenThis supports the Maven widget and search functionality. (Privacy Policy)
Google AdSenseThis is an ad network. (Privacy Policy)
Google DoubleClickGoogle provides ad serving technology and runs an ad network. (Privacy Policy)
Index ExchangeThis is an ad network. (Privacy Policy)
SovrnThis is an ad network. (Privacy Policy)
Facebook AdsThis is an ad network. (Privacy Policy)
Amazon Unified Ad MarketplaceThis is an ad network. (Privacy Policy)
AppNexusThis is an ad network. (Privacy Policy)
OpenxThis is an ad network. (Privacy Policy)
Rubicon ProjectThis is an ad network. (Privacy Policy)
TripleLiftThis is an ad network. (Privacy Policy)
Say MediaWe partner with Say Media to deliver ad campaigns on our sites. (Privacy Policy)
Remarketing PixelsWe may use remarketing pixels from advertising networks such as Google AdWords, Bing Ads, and Facebook in order to advertise the HubPages Service to people that have visited our sites.
Conversion Tracking PixelsWe may use conversion tracking pixels from advertising networks such as Google AdWords, Bing Ads, and Facebook in order to identify when an advertisement has successfully resulted in the desired action, such as signing up for the HubPages Service or publishing an article on the HubPages Service.
Author Google AnalyticsThis is used to provide traffic data and reports to the authors of articles on the HubPages Service. (Privacy Policy)
ComscoreComScore is a media measurement and analytics company providing marketing data and analytics to enterprises, media and advertising agencies, and publishers. Non-consent will result in ComScore only processing obfuscated personal data. (Privacy Policy)
Amazon Tracking PixelSome articles display amazon products as part of the Amazon Affiliate program, this pixel provides traffic statistics for those products (Privacy Policy)
ClickscoThis is a data management platform studying reader behavior (Privacy Policy)