Sweethearting and missed scans: how AI checkout monitoring works

What sweethearting and missed scans are

A missed scan (or no-scan) is an item that leaves the checkout without being registered by the POS. Some are honest: a barcode that did not read, a busy lane, a distracted cashier. Sweethearting is the deliberate version — a cashier who lets a friend, relative or accomplice take goods without paying for them, or pay less than the price. At a staffed register it takes three forms; self-checkout adds a fourth case.

The unscanned item

The item is moved around or over the scanner instead of across its window, so there is no beep and no line, and it goes straight into the bag. The customer pays for everything else; the transaction closes normally with fewer lines than items.

The under-ring

The item is rung up, but for less: a cheaper product code is keyed in for a more expensive item, or the price is overridden. The POS shows a valid sale — just of the wrong product, or at the wrong price.

Improper discounts for friends

A discount the customer is not entitled to — a staff discount, a promotion that does not apply, a manual percentage — is keyed in for a familiar customer. Discounts are a normal part of selling, which is exactly why one more rarely stands out.

Missed scans at self-checkout

At a self-checkout lane the customer does the scanning, so sweethearting by a cashier does not apply in the strict sense — but missed scans do. An item goes from the basket into the bag without crossing the scanner, whether by mistake or on purpose, and the result in the log is the same: a transaction with fewer lines than items.

The Association of Certified Fraud Examiners' (ACFE) 2024 Report to the Nations does not single out sweethearting, but cashier sweethearting fits what the ACFE calls noncash misappropriation: an employee stealing or misusing the organization's noncash assets, such as inventory. No cash is taken from the drawer — which is what sets sweethearting apart from void and refund fraud and cash skimming, where cash itself leaves the register.

Why traditional methods miss sweethearting

• POS reports count events that exist — a missed scan does not. Void, refund, no-sale and discount reports are built on entries in the log. An item that was never scanned creates no line, no amount and no employee ID. The transaction looks like a normal, smaller basket.
• The drawer balances. The customer pays for what was rung up, so the cash count matches the POS exactly and over/short reports stay clean.
• Under-rings and discounts look like normal sales. A cheaper code or a discount is a valid entry. A discount report can show that one cashier gives more discounts than others — a count without context. It can't show what was actually on the counter, or who was on the other side of it.
• The loss shows up somewhere else, later. The missing goods surface weeks later as inventory shrink at a stock count — with no register, no hour and no cashier attached.
• Manual CCTV review doesn't scale. Checking whether every item in every basket crossed the scanner means watching every transaction at every register. In practice, footage is pulled only after a loss is already suspected — if at all.
• Classic object detection sees objects, not actions. A detector can say there is a person at the register and an item on the counter. It can't say whether that item crossed the scanner, went around it, or was rung up as something else.

In the log, a sweethearted basket is just a normal transaction with fewer lines, or with a cheaper product on one of them. The difference is in what crossed the scanner on camera in that same moment and what reached the POS.

How vision-language models make it solvable

Primarch builds on and enhances vision-language models (VLMs): models that read video and language together. Instead of detecting objects frame by frame, the model reads a scene at the checkout the way an experienced loss-prevention auditor would — and does it at every register, every hour.

• It understands the action, not just the objects. A VLM reads a window of time, so the before and after of an action are read together. It can tell an item passed across the scanner window from one moved around or over it, and see where the item goes next — into the bag.
• It joins the video moment with the POS line — or notices there is none. Each item that crosses the checkout on camera is checked against the transaction log in the same second. An item with no matching line is a missed scan. An item whose line names a different, cheaper product is an under-ring. A discount line is matched with the motion on camera, so a reviewer sees what was sold and how. The log says what was recorded; the video says what happened. A camera alone produces suspicion; with the POS it produces evidence.
• It writes the finding in plain language, with a clip. The result is a sentence a manager can read — what happened, at which register, and why it doesn't match the log — with a time-stamped evidence clip and the matching transaction lines.
• It chains repeated events into patterns. Events are linked by store, register, cashier and hour into 30-day patterns. A single missed scan can be an honest mistake; each one is alerted for review, and the 30-day pattern shows whether the same thing repeats at the same register, with the same cashier, at the same hours.

What a camera cannot see is the relationship between a cashier and a customer. The check doesn't depend on it: what it compares is the action at the checkout with the POS record, and what it surfaces is where the two don't match — repeatedly.

What to look for in a solution

Whichever vendor you talk to, these are fair questions to ask about a system meant to catch sweethearting and missed scans:

• Works on your existing cameras. Can it connect to the IP cameras already above your registers and self-checkout lanes, or does it need new hardware?
• Integrates with your POS transaction log. Ask which POS exports it can read, how the integration is validated, and whether it can flag an item that has no line in the log — not only events that are in it. For under-rings, ask whether it compares the product on camera with the product on the line.
• Produces evidence usable in HR processes. A time-stamped clip together with the matching transaction lines, so a finding can be reviewed and discussed fairly — not a bare alert.
• Respects privacy. Is there an on-premise option where footage never leaves the site? Is anonymization applied, is analysis limited to the checkout zone, and does it meet GDPR and other data-protection requirements?
• Can be piloted on your own footage. Your registers, camera angles, products and POS — not a demo video.
• Handles false alarms openly. Barcodes fail and busy lanes make mistakes. Ask how findings are reviewed by a person, and how single events are separated from repeating patterns.
• Gets alerts to the right role. An instant alert to the store manager, a digest for loss prevention, a dashboard for area and head-office teams — each person sees what they need to act on.

Example use cases

The walk-throughs below are illustrative examples of how a finding is built. They are not customer cases and contain no performance figures.

Example 1: a book passed around the scanner

1. 01

   Moment

   A bookshop register, 18:15 on a Friday.

2. 02

   What the camera shows

   A customer puts three books on the counter. Two cross the scanner window one by one; the third is moved around the scanner and goes straight into the bag.

3. 03

   What the POS log shows

   A transaction with two lines. The customer pays the total; the drawer balances.

4. 04

   The finding + evidence clip

   "At 18:15 three books went into the bag at register 1, but only two were scanned. The third was passed around the scanner and has no line in the transaction." The clip covers the whole transaction, with its two POS lines.

5. 05

   Who is alerted

   The store manager receives an instant alert; the finding also appears in the loss-prevention team's weekly digest.

6. 06

   What the 30-day pattern shows

   In this illustration, the flagged no-scans add up to 23 in 30 days at the same register, falling on the same cashier's evening shifts — a repeat that deserves a closer look, rather than a single mistake.

Example 2: an under-ring at a fashion boutique

1. 01

   Moment

   A fashion boutique register, 15:40.

2. 02

   What the camera shows

   A leather jacket is folded and bagged at the register.

3. 03

   What the POS log shows

   One line: a basic T-shirt, entered by product code. No jacket appears in the transaction.

4. 04

   The finding + evidence clip

   "At 15:40 a leather jacket was bagged at register 2, but the transaction line is for a T-shirt. The product on camera does not match the product on the POS line." Clip and transaction line attached.

5. 05

   Who is alerted

   The store manager, instantly; loss prevention in the periodic digest.

6. 06

   What the 30-day pattern shows

   Whether mismatched product lines repeat at the same register or on the same cashier's shifts — or stay a one-off, such as a wrong code keyed in a hurry.

Example 3: a staff discount at the register

1. 01

   Moment

   A souvenir shop register, 12:10.

2. 02

   What the camera shows

   Several items are scanned and handed across the counter to a customer; the cashier keys an entry at the terminal before closing the sale.

3. 03

   What the POS log shows

   The lines for the items, then a staff discount on the whole sale.

4. 04

   The finding + evidence clip

   "At 12:10 a staff discount was keyed on a sale at register 1. The clip shows the items sold and handed across the counter, and who received them." Clip and transaction lines attached, so the manager can check whether the buyer was a staff member entitled to the discount.

5. 05

   Who is alerted

   The store manager, in the daily digest.

6. 06

   What the 30-day pattern shows

   Asked in plain language — "show staff discounts at register 1 in the last 30 days" — the event memory returns the list with clips; repeats with the same cashier at the same hours stand out.

Example 4: a missed scan at a self-checkout lane

1. 01

   Moment

   A self-checkout lane in a store, 19:30.

2. 02

   What the camera shows

   A customer scans several items, then moves one more from the basket into the bag without crossing the scanner.

3. 03

   What the POS log shows

   The self-checkout transaction has a line for each scanned item, but none for the last one.

4. 04

   The finding + evidence clip

   "At 19:30 an item went from the basket into the bag at self-checkout lane 2 with no matching line in the transaction." Clip attached.

5. 05

   Who is alerted

   The staff member responsible for the self-checkout area, instantly, so the customer can be offered help while still at the lane.

6. 06

   What the 30-day pattern shows

   Whether missed scans at self-checkout cluster on certain lanes or hours — useful for deciding where staff support is needed.

How Primarch's Retail Fraud Expert helps

This section is about our product. The Retail Fraud Expert is the Primarch expert module for the checkout. It recognizes actions at the register — scan, skip, void and refund — and cross-checks each one against the POS record in the same second. For sweethearting and missed scans it:

• Recognizes an item passed around or over the scanner and checks in the same moment whether the POS has a matching line. If it does not, the event is flagged with time-stamped evidence.
• Spots under-rings by comparing the item on camera with the product on the POS line.
• Matches discount-key anomalies with the motion on camera, so deliberate skip-scans and improper discounts for familiar customers show up as repeating behavior on the person–register–time axis.
• Applies the same camera + POS check to self-checkout lanes.
• Chains events by store, register, cashier and hour into 30-day patterns: each single event is alerted for review, and the POS-validated 30-day pattern shows what repeats.
• Produces an evidence file for each finding: a time-stamped clip plus the POS record, usable in HR processes.

It works in any store with a register — fashion and luxury boutiques, souvenir shops, bookshops, coffee shops — and at restaurant and quick-service counters, where nothing is scanned and it compares what is handed over with the lines on the ticket. When cash leaves through a paid sale that is cancelled, see void and refund fraud; when cash is taken before it is recorded, see cash skimming and no-sale drawers. For a sector view, see retail store loss prevention and restaurant and café loss prevention.

Putting it to work

1. 01

   Connect

   Connect your existing RTSP cameras and the POS transaction log export; no new cameras or special hardware. It is designed to work with any common POS system that can export transaction logs; the integration is validated together during the pilot.

2. 02

   Pilot on your own footage

   Run it on your own registers, camera angles and POS data, and review the findings together.

3. 03

   Roll out

   Extend to more registers and stores, with central monitoring across the chain.

• Alerts, digests and dashboards. Instant notifications, periodic digests and role-based dashboards, so each finding reaches the person who acts on it.
• Ask the past in plain language. Findings are written into a queryable event memory: "Which no-scans were flagged at register 3 last week?"
• Evidence for HR. Every finding carries its time-stamped clip and the matching transaction line.
• Privacy by design. With on-premise deployment, footage never leaves the facility. Analysis focuses on the checkout zone with privacy-compliant anonymization; the goal is action–transaction consistency, not tracking people.

Industry figures

There is no reliable public figure for sweethearting or missed scans on their own. The closest published data covers employee theft of noncash assets, such as inventory, as a whole — the ACFE category these schemes fit. None of these categories is limited to the checkout.

An item that is never scanned leaves no trace in the POS and only a delayed one in stock counts. Checking the motion at the scanner against the POS lines turns that into specific moments that can each be reviewed on the footage — and repeats at the same register and hour stand out as a pattern.