How to catch employees stealing from the cash register

How employees steal from the cash register

Employee theft at the register — also called cashier theft or internal theft — is any scheme in which someone working the counter takes cash or goods and uses the register itself to hide it. It need not be a hand in the drawer: a legitimate POS function can be used at the wrong moment, or cash handled where the POS records nothing at all. Because the record is shaped to match the missing money, the drawer can balance at close and the loss surfaces later, if at all, as unexplained shrink. The schemes fall into a handful of families; each has its own guide.

Voids after payment and fake refunds

A paid sale is voided or deleted after the customer leaves, or a refund is entered with no customer and nothing coming back, and the cash is taken. The POS now expects less cash, so the drawer still balances. See void and refund fraud.

Skimming and no-sale drawer openings

A sale is never rung up and the cash goes into a pocket, or the drawer is opened with a no-sale and money moves without a record. Nothing is in the log to reconcile against. See cash skimming and no-sale drawers.

Missed scans and sweethearting

An item goes around the scanner instead of across it, or is rung up as something cheaper, for example, for a friend or relative at the counter. The goods leave the store; the POS never knew they were there. See sweethearting and missed scans.

Return fraud at the counter

Returns are processed for goods that never came back, exchanges are recorded as returns, or a real return pays out more than the customer received. See return fraud.

Discount, override and loyalty abuse

A staff discount is used for someone else, a price is overridden without reason, a coupon is applied with no coupon presented, or loyalty points and gift cards are moved where they don't belong. See discount, override and loyalty abuse.

By setting: restaurants, cafés and stores

The same schemes take different shapes depending on where the register stands. Counters, drive-thrus and delivery cash are covered in restaurant and café loss prevention; boutiques, bookshops, souvenir shops and self-checkout lanes in retail store loss prevention.

Signs of employee theft at the register

None of these signals proves theft on its own; each has innocent explanations. They tell you where to look, and they are worth reading together rather than one by one:

• Cash shortages that come and go. The drawer is short on some shifts and not on others, or small shortages repeat on the same register.
• Voids and refunds out of line with the shift. More voids, refunds or no-receipt returns at one register, on one person's shifts, or in quiet hours with few customers.
• No-sale openings with nothing to explain them. The drawer opens with no sale, change request or pickup that anyone can point to.
• Discounts and overrides that cluster. The same staff discount, price override or coupon appearing on the same shifts, or for the same visitors.
• Stock that disappears without sales. Shrink on items that rarely appear on tickets at the register they leave through.
• A drawer that balances while stock and margins don't. A balanced drawer only shows that the record matches the cash — not that the record matches what happened.

Exception reports turn these signals into a list. What the list can't do is say what happened at the counter. For how POS exception reporting and AI video differ, see POS exception reporting vs AI video.

Why traditional methods miss employee theft

• A balanced drawer proves little. When a void or refund lowers the cash the POS expects, the count matches. When a sale is never rung up, there is nothing to count against.
• POS exception reports give a count without context. They show how many voids, refunds and overrides, by whom and when. They can't show whether the customer was at the counter, whether goods came back, or whether cash changed hands.
• Manual CCTV review doesn't scale. Checking one entry means finding the right camera and minute. Across every register and shift that review happens only after a loss is suspected. The camera records; the footage waits until someone has a reason to look.
• Classic object detection sees objects, not actions. A detector can say a person or an item is at the counter. It can't say that an item went around the scanner, that cash was handed over, or what the POS recorded in that second.
• Audits and mystery shopping are snapshots. They see one shift on one day, and people behave differently when they know they are being checked.

How vision-language models make it solvable

Primarch builds on and enhances vision-language models (VLMs): models that read video and language together. Instead of detecting objects frame by frame, the model reads the register the way an experienced loss-prevention auditor would — at every register, every hour.

• It understands the action, not just the objects. A VLM reads a window of time, so it can recognize that a sale was paid and handed over before a void, that an item passed the scanner without a matching line, or that cash went into or out of an open drawer.
• It joins the video moment with the POS line. Each void, refund, no-sale and discount in the transaction log is matched with what the register camera shows in the same second — and cash handled when the POS shows nothing at all is flagged too.
• It writes the finding in plain language, with a clip. Not a label or a score, but a sentence a manager can read, with a time-stamped evidence clip and the matching transaction line.
• It chains repeated events into patterns. Single events are alerted for review, and events linked by store, register, cashier and hour show what repeats over 30 days.

The useful question is not "how many voids did this cashier enter?" It is "what happened at the counter when each one was entered?" That answer is in the video at the moment of the POS entry.

What to look for in a solution

Whichever vendor you talk to, these are fair questions to ask about a system meant to catch employee theft at the register:

• Works on your existing cameras. Can it connect to the IP cameras you already have, or does every register need new hardware?
• Integrates with your POS transaction log. Voids, refunds, no-sales and overrides live in the log; ask which POS exports it can read and how the integration is validated.
• Covers the schemes with no POS entry. Unrung sales and no-sale cash movements leave nothing in the log; ask how they are found.
• Produces evidence usable in HR processes. A time-stamped clip with the matching transaction line, so a finding can be reviewed fairly — not a bare alert.
• Respects privacy. Is there an on-premise option where footage never leaves the site? Is anonymization applied, is analysis limited to cash-handling zones, and does it meet GDPR and other data-protection requirements?
• Can be piloted on your own footage. Your registers, camera angles and POS — not a demo video.
• Handles false alarms openly. Ask how findings are reviewed by a person, and how single events are separated from repeating patterns.
• Gets alerts to the right role. Store manager, loss prevention, area and head office — each sees what they need to act on.

How Primarch's Loss Prevention Expert helps

This section is about our product. The Loss Prevention Expert is the Primarch expert module for the checkout. It recognizes actions at the register — scan, skip, void and refund — and cross-checks each one against the POS record in the same second. Across the schemes above it:

• Recognizes on video that a sale was paid and handed over before it was voided, and checks whether a customer is at the counter or window when a refund is entered.
• Recognizes an item passing the scanner without a matching POS line, and compares the item on camera with the product on the POS line to catch under-rings — at staffed registers and self-checkout lanes alike.
• Tells cash going in from cash going out during a no-sale, and flags a drawer opened with a key or left open with no POS entry.
• Flags cash handled when the POS shows nothing at all: unrung sales, unlogged payouts or pickups.
• Checks returns, exchanges recorded as returns, discounts, overrides, coupons, gift cards and loyalty points against what happens at the counter.
• Chains events by store, register, cashier and hour into 30-day patterns, and produces an evidence file for each finding: a time-stamped clip plus the POS record, usable in HR processes.

It works at restaurant and quick-service counters and in any store with a register — coffee shops, fashion and luxury boutiques, souvenir shops, bookshops. At drive-thru windows it depends on camera placement and is confirmed per site.

Putting it to work

1. 01

   Connect

   Connect your existing RTSP cameras and the POS transaction log export; no new cameras or special hardware. It is designed to work with any common POS system that can export transaction logs; the integration is validated together during the pilot.

2. 02

   Pilot on your own footage

   Run it on your own registers, camera angles and POS data, and review the findings together.

3. 03

   Roll out

   Extend to more registers and stores, with central monitoring across the chain.

• Alerts, digests and dashboards. Instant notifications, periodic digests and role-based dashboards, so each finding reaches the person who acts on it.
• Ask the past in plain language. Findings are written into a queryable event memory: "Which no-sale openings were flagged at register 3 this month?"
• Privacy by design. With on-premise deployment, footage never leaves the facility. Analysis focuses on cash-handling zones with privacy-compliant anonymization; the goal is action–transaction consistency, not tracking people.

Industry figures

There is no reliable public figure for cashier theft on its own. The broadest published estimate covers occupational fraud of all kinds.