Cash skimming and no-sale drawers: how AI video can catch them

What cash skimming and no-sale drawer abuse are

Every cash movement at a register is supposed to have a POS counterpart: a sale, a refund, a paid-out, a pickup, a no-sale. Cash skimming and no-sale drawer abuse exploit the moments when that counterpart is missing or says nothing about the money. They take five common forms.

Unrung cash sales

The customer pays cash and leaves with the item, but no sale is entered. The cash goes straight into a pocket, into a drawer that is still open from the previous sale, or into the drawer to be taken out again later. Nothing in the log says a sale happened, and because the POS never expected that cash, the count at close still matches.

"No Sale" drawer openings

Almost every POS has a "No Sale" key. It opens the cash drawer without ringing anything up: to give change for a large note, to open a coin roll, to swap cash with another register. The POS logs the time, the register and the employee ID — but no amount, because officially no money moved. That is what makes it useful for theft. In one pattern, a customer pays cash, the sale is not rung up, and a no-sale opens the drawer to put the money in and hand back change. The drawer is now over by the price of the item; later, when the counter is quiet, another no-sale opens the drawer and the extra cash comes out. In another, the cashier opens the drawer with no sale and takes cash the POS has already recorded. That leaves a shortage, so it is usually kept small enough to pass as a counting error, or covered later with a false void or refund.

Drawers opened with a key or left open

A drawer can also be opened with a key, or simply left open between customers. Cash then goes in and out with no POS event at all — not even a no-sale line to count.

Unlogged payouts and pickups

Cash leaves the drawer to pay a supplier, a courier or a small expense without a paid-out entry; a mid-shift pickup goes from the drawer towards the safe without being recorded. Each of these is routine — but without an entry, nobody can later say how much moved, when, or who moved it.

Change swaps, the safe and the change fund

Change is brought from the safe or swapped with another register on trust; safe drops and change-fund movements happen away from the register, often recorded only on paper or in a separate safe log. Cash taken here never passes through a sale at all.

Not every unlogged cash movement is theft. Some stores record change swaps or petty cash on paper, and busy shifts produce honest shortcuts. What these movements share is that the POS cannot account for them — which is also why skimming happens there.

The Association of Certified Fraud Examiners' (ACFE) 2024 Report to the Nations does not single out no-sale openings, payouts or change funds by name, but these cases fit what the ACFE calls skimming, cash larceny and cash-on-hand misappropriation. Skimming is a scheme in which an incoming payment is stolen before it is recorded — the report's example is an employee who accepts payment from a customer but does not record the sale and pockets the money. That is the unrung cash sale. Cash larceny is the theft of a payment after it has been recorded, which fits taking recorded cash from the drawer, or part of a pickup of recorded sales that never reaches the safe. Cash-on-hand misappropriation is the theft of cash kept on the organization's premises — the report's example is cash stolen from a company vault — which fits cash taken from the safe or the change fund.

This guide is about cash an employee keeps out of the store's records. A business that chooses not to record its own sales is a tax matter and a different topic.

Why traditional methods miss cash skimming

• POS reports give a count without context — or nothing at all. A no-sale report shows how many times each register or employee opened the drawer without a sale. A no-sale has no amount, so the report can't tell an opening that gave change for a large note from one that took the same note out. Cash handled with no POS event at all doesn't appear on any report.
• The drawer balances. With an unrung sale, the money taken was never recorded, so the count at close matches what the POS expected and over/short reports stay clean.
• A cash difference shows the total, not the moment. When an unlogged payout or pickup does leave the drawer short or over, the end-of-shift difference says how much — not when, or who handled the cash. Small differences are often written off as counting mistakes.
• Paper logs don't tie to the system. Pickups, safe drops and change swaps written on paper or in a separate safe log can't be matched line by line with the POS. And when logins or keys are shared, the employee ID on a no-sale doesn't say who was at the drawer.
• Manual CCTV review doesn't scale. At a busy register, drawer openings without a sale can be frequent, and for good reasons. Checking each opening means finding the right camera and the right minute; across every register, shift and store, that review happens only after a loss is already suspected — if at all.
• Classic object detection sees objects, not actions. A detector can say a person is at the register or a drawer is open. It can't say whether cash went in or came out, whether it was handed across the counter, or that the POS recorded nothing at that moment.

The POS shows what was entered. Whether cash moved with nothing entered, or what happened when the drawer opened, is visible only on the camera above the register.

How vision-language models make it solvable

Primarch builds on and enhances vision-language models (VLMs): models that read video and language together. Instead of detecting objects frame by frame, the model reads a scene at the register the way an experienced loss-prevention auditor would — and does it at every register, every hour.

• It understands the action, not just the objects. A VLM reads a window of time, so the before and after of an action are read together. During a no-sale it can tell cash going into the drawer from cash coming out, and whether it was handed across the counter. It can recognize a customer paying cash, a drawer opened with a key or left open, and notes counted out for a payout or pickup.
• It joins the video moment with the POS line — or notices there is none. Each no-sale in the transaction log is matched with what the camera at that register shows in the same second. Just as important, cash handled at a moment when the POS has no matching entry is itself a finding. The log says what was recorded; the video says what happened. A camera alone produces suspicion; with the POS it produces evidence.
• It writes the finding in plain language, with a clip. The result is a sentence a manager can read — what happened, at which register, and why it doesn't match the log — with a time-stamped evidence clip and the matching transaction line, or the note that there was none.
• It chains repeated events into patterns. Events are linked by store, register, cashier and hour into 30-day patterns. A single no-sale can have an innocent explanation; no-sales or unlogged cash at the same register and hour, week after week, are a pattern worth a closer look.

In the log, a no-sale is only a timestamp, a register and an employee ID — and an unrung sale is nothing at all. Whether cash went in, came out or crossed the counter is decided by what happened at the drawer in that same second, and that is on the camera.

What to look for in a solution

Whichever vendor you talk to, these are fair questions to ask about a system meant to catch cash skimming and no-sale abuse:

• Works on your existing cameras. Can it connect to the IP cameras you already have, including any that cover the safe or back office, or does it need new hardware?
• Integrates with your POS transaction log. No-sales, paid-outs and pickups live in the log. Ask which POS exports it can read, how the integration is validated, and whether it can flag cash handled when the log shows nothing — not only events that are in it.
• Produces evidence usable in HR processes. A time-stamped clip together with the matching transaction line, so a finding can be reviewed and discussed fairly — not a bare alert.
• Respects privacy. Is there an on-premise option where footage never leaves the site? Is anonymization applied, is analysis limited to the cash-handling zone, and does it meet GDPR and other data-protection requirements?
• Can be piloted on your own footage. Your registers, camera angles, cash-handling rules and POS — not a demo video.
• Handles false alarms openly. Many drawer openings and cash movements are honest. Ask how findings are reviewed by a person, and how single events are separated from repeating patterns.
• Gets alerts to the right role. An instant alert to the store manager, a digest for loss prevention, a dashboard for area and head-office teams — each person sees what they need to act on.

Example use cases

The walk-throughs below are illustrative examples of how a finding is built. They are not customer cases and contain no performance figures.

Example 1: an unrung sale hidden behind two no-sales

1. 01

   Moment

   A souvenir shop register, 13:20 and 13:48 on a weekday.

2. 02

   What the camera shows

   At 13:20 a customer hands over cash and leaves with an item; the drawer opens, the cash goes in and change comes out. At 13:48 no customer is at the register; the drawer opens, cash comes out and is not handed across the counter.

3. 03

   What the POS log shows

   No sale transaction at 13:20 — only a "No Sale" event with no amount. Another "No Sale" at 13:48.

4. 04

   The finding + evidence clip

   "At 13:20 a customer paid cash and took an item, but no sale was rung up; the drawer was opened with No Sale and the cash went in. At 13:48 the drawer was opened with No Sale again, with no customer present, and cash was taken out." The clip covers both openings, with the matching no-sale lines.

5. 05

   Who is alerted

   The store manager receives an instant alert; the finding also appears in the loss-prevention team's weekly digest.

6. 06

   What the 30-day pattern shows

   Flagged no-sale pairs at the same register fall on the same cashier's afternoon shifts.

Example 2: a drawer left open between customers

1. 01

   Moment

   A bookshop register, 17:05, a busy stretch.

2. 02

   What the camera shows

   After a rung-up sale the drawer stays open. The next customer pays cash for a book; the cash goes into the open drawer and change comes out.

3. 03

   What the POS log shows

   The drawer opening belongs to the earlier sale. Nothing records the second payment.

4. 04

   The finding + evidence clip

   "At 17:05 a customer paid cash into a drawer left open from the previous sale. No transaction was entered for this payment." Clip and the surrounding transaction lines attached.

5. 05

   Who is alerted

   The store manager, instantly; loss prevention in the periodic digest.

6. 06

   What the 30-day pattern shows

   Asked in plain language — "show cash handled with no POS entry at register 2 in the last 30 days" — the event memory returns the flagged moments, each with its clip.

Example 3: an unlogged payout to a delivery driver

1. 01

   Moment

   A quick-service restaurant counter, 20:40. The delivery-driver cash settlement happens at the counter, on camera.

2. 02

   What the camera shows

   Notes come out of the drawer and are handed across the counter to a delivery driver.

3. 03

   What the POS log shows

   No paid-out entry, and no settlement entry, at that time.

4. 04

   The finding + evidence clip

   "At 20:40 cash was taken from the drawer and handed to a delivery driver. No paid-out or settlement was entered in the POS." Clip attached, with the note that no matching transaction line exists.

5. 05

   Who is alerted

   The shift manager on duty, instantly.

6. 06

   What the 30-day pattern shows

   Whether payouts with no entry repeat on the same shifts or registers — or stay a one-off, such as a payout logged later on paper under the store's own rules.

Example 4: a change-fund movement at the safe with no record

1. 01

   Moment

   The back office of a fashion boutique, where a camera covers the safe, 11:05.

2. 02

   What the camera shows

   The safe is opened and cash is taken from the change fund; it leaves the back office.

3. 03

   What the records show

   No change-fund movement or pickup is recorded for that time.

4. 04

   The finding + evidence clip

   "At 11:05 cash was taken from the safe's change fund. No change-fund movement is recorded for that time." Clip attached.

5. 05

   Who is alerted

   The area manager's dashboard and weekly digest. When the store manager is the one at the safe, the review belongs one level up.

6. 06

   What the 30-day pattern shows

   Whether change-fund movements without a record repeat at the same hour or on the same person's shifts.

How Primarch's Retail Fraud Expert helps

This section is about our product. The Retail Fraud Expert is the Primarch expert module for the checkout. It recognizes actions at the register — scan, skip, void and refund — and cross-checks each one against the POS record in the same second. For cash skimming and no-sale abuse it:

• Matches every no-sale drawer opening with the motion on camera and tells cash going in from cash coming out, and whether it was handed across the counter.
• Flags a drawer opened with a key or left open with no POS entry.
• Flags cash handled when the POS shows nothing at all: unrung sales, unlogged payouts or pickups. At restaurant counters where nothing is scanned, it compares what is handed over with the lines on the ticket.
• Checks safe drops, change-fund movements and pickups away from the register against their records, where a camera covers the area. Delivery-driver cash settlement is covered where it happens on camera in the store.
• Chains events by store, register, cashier and hour into 30-day patterns: each single event is alerted for review, and the POS-validated 30-day pattern shows what repeats.
• Produces an evidence file for each finding: a time-stamped clip plus the POS record, usable in HR processes.

It works at restaurant and quick-service counters and in any store with a register — coffee shops, fashion and luxury boutiques, souvenir shops, bookshops. When the cash leaves through a paid sale that is cancelled, see void and refund fraud; when items go through the register unscanned, see missed scans and sweethearting. For a sector view, see restaurant and café loss prevention and retail store loss prevention.

Putting it to work

1. 01

   Connect

   Connect your existing RTSP cameras and the POS transaction log export; no new cameras or special hardware. It is designed to work with any common POS system that can export transaction logs; the integration is validated together during the pilot.

2. 02

   Pilot on your own footage

   Run it on your own registers, camera angles and POS data, and review the findings together.

3. 03

   Roll out

   Extend to more registers and stores, with central monitoring across the chain.

• Alerts, digests and dashboards. Instant notifications, periodic digests and role-based dashboards, so each finding reaches the person who acts on it.
• Ask the past in plain language. Findings are written into a queryable event memory: "Which no-sales were flagged at register 3 last week?"
• Evidence for HR. Every finding carries its time-stamped clip and the matching transaction line.
• Privacy by design. With on-premise deployment, footage never leaves the facility. Analysis focuses on the cash-handling zones (registers and, where covered, the safe) with privacy-compliant anonymization; the goal is action–transaction consistency, not tracking people.

Industry figures

There is no reliable public figure for no-sale drawer fraud or off-POS cash on its own. The closest published data covers skimming, cash larceny and cash-on-hand schemes as a whole — the ACFE categories these cases fit. None of these categories is limited to the register.

Skimming schemes ran a year and a half at the median before they were detected, and at a busy register no-sale openings can be frequent, so a few extra can pass unseen. When cash moves with no POS record, the log has nothing to show; the footage of the register at that moment is where it can be checked, and repeats at the same register and hour stand out as a pattern.