Restaurant and café loss prevention with AI video: a guide

Restaurant employee theft: where the cash flows open gaps

A restaurant or café handles cash differently from a shop. Orders are built and changed while the customer waits, tickets are opened before the food is made and closed once it is paid, and a single shift can take money at the front counter, at a drive-thru window and from delivery drivers coming back with cash. Each of these points has its own routines — and its own ways for a deleted, refunded or unrung order to look normal in the POS.

Front counter and quick-service

Orders are rung, changed, comped and discounted at speed, sometimes with a manager code that is shared across the shift. The cashier who takes the money also operates the drawer, so a void, a refund or a no-sale opening needs no one else's help. Nothing is scanned: the ticket is keyed in by hand, and the food comes from the kitchen, not from a shelf with a barcode.

Coffee shops and cafés

In a coffee shop the same person often takes the order, takes the payment and makes the drink, with a queue in front and a tip jar next to the register. Many sales are small and paid in cash or by card in seconds, and regulars are known by name. That speed and familiarity are part of good service — and also what lets an unrung coffee, a drink rung up as a cheaper one, or a cash payment that never reaches the drawer pass without notice.

Drive-thru

The customer stays in the car and pays at a window, which may not be the window where the food is handed over. Taking the order, taking the money and handing out the food can be three different people, and the customer may drive off without looking at the receipt.

Pizza delivery, takeaway and phone orders

For delivery orders paid in cash, the money is collected at the customer's door, away from any store camera, and reaches the store later when the driver settles up. Phone and online orders can be marked as paid by card, paid in cash or cancelled after the food has already left, and the driver's cash-out at the end of the shift is counted against a summary from the POS or the delivery system. A refund on a delivery or phone order has no customer at the counter to begin with, so it is checked against the order record and the driver's settlement rather than the counter view.

Table service

Where guests pay at the table, the payment is taken away from the register and brought to it afterwards. A camera at the register sees the entry and the drawer; it does not see the table.

None of this is suspicious on its own. The difficulty is that the POS log records only what was keyed in. For everything that happens at the counter, the window or the settlement point, the context — who was there, whether food or cash crossed the counter, where the cash went — is on the camera.

Three ways cash and food go missing in a restaurant or café

Each of these has its own detailed guide. Here is what it looks like in food service.

Void and refund fraud: deleted orders and refunds with no customer

The customer pays, takes the order and leaves; later the paid ticket is deleted or voided, so the sale disappears and the drawer still balances at close. Or a refund is entered with no customer at the counter or window and nothing coming back, and the refunded cash is kept. A manager override on the entry says little when the code is shared or entered on request. The check is the order of events — payment and handover on camera first, a deletion in the POS after — and, for a refund, whether anyone was at the counter or window when it was entered. More in void and refund fraud.

Cash skimming and no-sale drawers

A cash order is taken but never rung up; the money goes into a pocket, into a drawer left open from the previous sale, or into the drawer behind a "No Sale" opening, to be taken out later. Cash also leaves the drawer for a supplier or a delivery driver without a paid-out entry, and change-fund movements and pickups to the safe happen away from the register. With an unrung sale the drawer still balances, because the POS never expected that cash. More in cash skimming and no-sale drawers.

Sweethearting and unrung food at the counter

Sweethearting is an employee giving goods away free or cheap to a friend, relative or accomplice. In a shop it means items passed around the scanner; at a restaurant or café counter, where nothing is scanned, it means food or drinks handed over without being rung up, rung up as something cheaper, or discounted with no reason. It applies to counter and drive-thru service (drive-thru depends on camera placement), where the employee and the customer meet at the till. More in sweethearting and missed scans.

In all three, the POS log either has an entry with no context — a deletion, a refund, a no-sale, a discount — or no entry at all. The context is on the camera at the same moment.

What to look for in a solution for restaurants and cafés

Whichever vendor you talk to, these are fair questions to ask about a system meant to catch register fraud in food service:

• Works on your existing cameras. Can it use the cameras that already cover your counters, drive-thru window and the spot where drivers settle their cash, or does it need new hardware?
• Integrates with your POS transaction log. Deletions, refunds, no-sales, discounts and comps live in the log. Ask which POS exports it can read, and how delivery and phone orders are handled.
• Understands a counter where nothing is scanned. In food service there is no barcode beep to compare against; ask how it checks what was handed over against the lines on the ticket.
• Produces evidence usable in HR processes. A time-stamped clip together with the matching transaction line, so a finding can be reviewed and discussed fairly — not a bare alert.
• Respects privacy. Is there an on-premise option where footage never leaves the site? Is anonymization applied, is analysis limited to cash-handling zones rather than the dining room, and does it meet GDPR and other data-protection requirements?
• Can be piloted on your own footage. Your counters, camera angles, rush hours and POS — not a demo video.
• Separates single events from repeating patterns. Many deletions and refunds are honest. Ask how findings are reviewed by a person and how single events are separated from patterns that repeat.
• Gets alerts to the right role. An instant alert to the shift manager, a digest for the owner or area manager, a dashboard across sites — each person sees what they need to act on.

How Primarch's Retail Fraud Expert helps restaurants and cafés

This section is about our product. Primarch builds on and enhances vision-language models (VLMs), which read video and language together: they understand the action in the scene, not just the objects in it. The Retail Fraud Expert is the Primarch expert module for the checkout. It recognizes actions at the register — scan, skip, void and refund — and cross-checks each one against the POS record in the same second. It works at restaurant and quick-service counters, in coffee shops and cafés, and in any store with a register. In food service it:

• Recognizes on video that an order was paid and handed over before it was deleted or voided.
• Checks whether a customer is at the counter or window when a refund is entered, and flags a return entered with nothing on the counter.
• Matches no-sale drawer openings, back-to-back voids and discount-key anomalies with the motion on camera, telling cash going in from cash coming out and whether it was handed across the counter. A drawer opened with a key or left open with no POS entry is flagged.
• Flags cash handled when the POS shows nothing at all: unrung sales, unlogged payouts or pickups.
• Compares what is handed over at the counter with the lines on the ticket, where nothing is scanned — and the item on camera with the product on the POS line.
• Covers delivery-driver cash settlement where it happens on camera in the store, and checks safe drops, change-fund movements and pickups away from the register against their records, where a camera covers the area.
• Chains events by store, register, cashier and hour into 30-day patterns: each single event is alerted for review, and the POS-validated 30-day pattern shows what repeats.

Drive-thru windows depend on camera placement and are confirmed per site. The customer's doorstep, where delivery cash is collected, is outside any store camera; the store side — the POS entries and the settlement on camera — is what can be checked.

Putting it to work

1. 01

   Connect

   Connect your existing RTSP cameras and the POS transaction log export; no new cameras or special hardware. It is designed to work with any common POS system that can export transaction logs; the integration is validated together during the pilot.

2. 02

   Pilot on your own footage

   Run it on your own counters, windows, camera angles and POS data, and review the findings together.

3. 03

   Roll out

   Extend to more registers and sites, with central monitoring across locations.

• Alerts, digests and dashboards. Instant notifications, periodic digests and role-based dashboards, so each finding reaches the person who acts on it.
• Ask the past in plain language. Findings are written into a queryable event memory: "Which deleted orders were flagged at the front counter last week?"
• Evidence for HR. Every finding carries its time-stamped clip and the matching transaction line.
• Privacy by design. With on-premise deployment, footage never leaves the facility. Analysis focuses on cash-handling zones with privacy-compliant anonymization; the goal is action–transaction consistency, not tracking people.

For shops, boutiques and other stores with a register, see retail store loss prevention.

Industry figures: what fraud data shows, and what applies to food service

There is no reliable public figure for employee theft in restaurants and cafés on their own; widely repeated restaurant figures could not be traced to a primary source and are not used here. The closest published data comes from the ACFE's 2024 study of occupational fraud.

Skimming and register disbursement schemes ran more than a year at the median before they were detected. In a restaurant or café, the deletions, refunds, discounts and no-sale openings are already in the POS log; each can be checked against the footage, and repeats at the same register and hour stand out as a pattern.