Employee Theft Signs: A Manager’s Detection Checklist

Employee theft costs U.S. retailers an estimated $50 billion annually, and the hardest part isn't the loss itself — it's the not knowing. Most managers have a gut feeling long before they have evidence. A drawer that's consistently $20 short. A category that bleeds out every week. An employee who gets twitchy whenever you mention a register audit.

This checklist is built from 125,000+ investigated incidents across convenience stores, gas stations, restaurants, and franchise retail operations. It covers the three categories of warning signs that matter most: behavioral patterns, POS anomalies, and inventory red flags. Use it as a systematic framework — not a reason to accuse anyone — and follow the investigation guidance before you act.

1. Behavioral Warning Signs

Behavioral signs are the earliest indicators of employee theft — visible before any POS data analysis. These patterns don't prove theft on their own, but they establish the context that makes POS anomalies meaningful. Watch for any employee who displays two or more of these behaviors consistently.

Sign 1: Insists on Working Alone or Refuses Help at the Register

An employee who steals needs time and privacy. When a coworker offers to jump on a second register during a rush, a theft-risk employee will often decline or find reasons to keep others away from their station. They may claim they "have a system" or that they "work better alone." In a convenience store setting, this behavior is particularly significant — the register is the primary theft vector, and isolation is a prerequisite for most POS manipulation schemes.

What it could mean: The employee is protecting a transaction sequence they've established — specific void timing, a particular customer flow, or a method of not scanning items that requires no witnesses.

Sign 2: Lives Beyond Apparent Means

A new car, designer clothing, frequent dining out, or expensive electronics on an entry-level wage isn't automatically suspicious — but when it appears alongside POS anomalies or inventory discrepancies, it becomes corroborating evidence. This sign requires context: an employee who received an inheritance or has a second job is different from one with no explained income source whose lifestyle inflated suddenly.

What it could mean: Cash skimming, unreported refunds, or systematic sweethearting can generate $200–$500 per week in undocumented income. Over months, that produces visible lifestyle changes. Cross-reference schedule data: did the lifestyle change correlate with a change in shift assignment or register access?

Sign 3: Resistant to Register Audits or Inventory Counts

Legitimate employees may find audits inconvenient. Employees who steal find them threatening. Watch for disproportionate resistance — complaints that go beyond inconvenience, attempts to delay or reschedule a count, "forgetting" to participate, or volunteering to handle the count themselves (to control the results). This sign is especially meaningful if the resistance is selective: the employee is cooperative about everything except inventory or register reviews.

What it could mean: There's something in the count that will reveal a pattern. For register audits, this often means void or no-sale rates. For inventory, it typically means category-specific shrinkage in high-value items like tobacco, energy drinks, or lottery tickets.

Sign 4: Always Wants to Close / Handle End-of-Day Cash

Closing shifts are the highest-risk period for cash theft. The customer volume drops, there's reduced oversight, and the person handling the cash-out reconciles the drawer against the POS — creating an opportunity to manipulate both. An employee who consistently volunteers for closing duty, resists being rotated off closing shifts, or becomes visibly uncomfortable when a manager handles the end-of-day themselves is exhibiting a control behavior that warrants investigation.

What it could mean: Cash skimming at close, manipulation of the reconciliation report, or holding voided transactions until the final register audit window. See why your cash register is short every day for specific mechanics of how end-of-day theft works.

Sign 5: Unusually Defensive When Shortages Are Discussed

Most employees who aren't stealing will be curious or mildly concerned when you mention a shortage. Employees who are stealing react differently — with deflection, excessive blame-shifting toward other employees, or disproportionate emotional responses. Note whether the defensiveness appears only when shortages from their shifts are discussed, versus a general anxiousness about the topic.

What it could mean: Guilt triggers a threat response. The employee knows their transactions are the source of the shortage and reacts to protect themselves before any formal investigation begins. This is often the most reliable single behavioral indicator when it correlates with specific shift timing.

2. POS Pattern Signs

POS data is where suspicion becomes evidence. These six patterns are the most reliable POS exception reporting signals for employee theft. Each one can have an innocent explanation in isolation — but three or more from the same employee over a two-week period is a strong indicator that warrants video review.

3. Inventory Red Flags

Inventory discrepancies are the downstream evidence of employee theft — they show you the financial impact after the fact. These four red flags help you determine whether what you're seeing is ordinary variance or a systematic theft pattern.

Red Flag 1: Specific Product Categories Consistently Short

Random variance in inventory shows up across multiple categories without a pattern. Theft creates category-specific shrinkage. If tobacco, lottery, alcohol, energy drinks, or other high-value items consistently come up short on your counts — particularly during counts that follow specific employee shifts — that pattern is directional. The most commonly stolen items in convenience and retail share two characteristics: they're small, high-value, and easy to conceal or give away without obvious physical evidence.

Track shrinkage by SKU and by category over 4+ weeks. If one category runs 5–10% short every single period while others are within normal variance, the category itself is telling you where to look. For c-stores, 10 common convenience store theft methods covers the specific mechanics for each high-risk category.

Red Flag 2: Shrink Rate Above Industry Benchmark (>2% for C-Stores)

The industry benchmark for total shrinkage in convenience stores is approximately 1–2% of revenue. For grocery retail, it's closer to 1.5%. If your shrink rate is consistently above 2% — and especially if it's creeping upward quarter-over-quarter — that excess is almost certainly not explained by vendor error or shoplifting alone. A shrink rate of 3–4% in a $2M annual revenue store represents $20,000–$40,000 in unaccounted losses per year.

Calculate your shrink rate by dividing total inventory loss (cost of goods) by total sales, then multiply by 100. If you haven't been tracking shrink rate systematically, see our retail shrink reduction guide for a setup process. The benchmark comparison is your most actionable first step.

Red Flag 3: Inventory Discrepancies Correlate with Specific Employee Schedules

This is the single most powerful investigative signal in inventory analysis. If your shrinkage numbers are worse during weeks when Employee A works closing shifts — and better when they're off — that correlation is not a coincidence. To find this pattern, overlay your inventory count results or daily sales variance against employee schedule data. Most managers don't do this because it requires combining two data sources, but the correlation, when it exists, is unmistakable.

Run a 6-week comparison: for each period, record which employees worked the relevant shifts and what the inventory variance was. If one employee's schedule presence consistently predicts higher variance in specific categories, that's the foundation of your investigation.

Red Flag 4: Missing or Tampered Inventory Count Sheets

Physical count sheets that go missing, contain obvious erasures, or show counts that are suspiciously round or identical across multiple periods are a direct indicator that someone is manipulating the count process. Legitimate inventory counts produce messy numbers — correction marks, recounts, occasional question marks. Suspiciously clean count sheets with perfectly round numbers are more likely to be fabricated than accurate.

Switch to electronic inventory counting when possible, which creates a timestamped audit trail. If you're still using paper, require count sheets to be photographed immediately after completion and submitted digitally. Any sheet submitted more than 30 minutes after a count was scheduled deserves scrutiny.

4. How to Investigate Without Accusation

If you've identified three or more signs from this checklist pointing to one employee, the instinct is to confront them immediately. Don't. A premature confrontation destroys your evidence, triggers denial, and — if you're wrong — exposes you to legal risk. Follow this investigation framework first.

Document Patterns Before Confronting Anyone

Create a dated log of every sign you've observed. Include specific POS transaction IDs, dates, times, and dollar amounts for every anomaly. Behavioral observations should be documented with dates, witnesses (if any), and specific context. This documentation serves two purposes: it protects you legally, and it forces you to distinguish between genuine patterns and confirmation bias. Aim for at least 2 weeks of documented data before any formal action.

Cross-Reference POS Data with Video for Specific Transactions

Every void, no-sale, or suspicious refund in your POS exception report has a timestamp. Use that timestamp to pull the corresponding video clip. The video will tell you definitively whether the transaction matches the physical reality at the register — whether the items on the counter match the items scanned, whether there's a customer present for a refund, and whether the employee's behavior is consistent with normal transaction flow. This POS-to-video correlation is the evidentiary core of any employee theft case.

Use at Least 2 Weeks of Data to Establish a Pattern

A single voided transaction could be a genuine error. Thirty voided transactions over two weeks — all from the same employee, all cash transactions, all followed by register shortages — is a pattern that establishes intent. Courts, HR departments, and law enforcement all require pattern evidence for theft cases. Two weeks is the minimum; four to six weeks gives you a much stronger case and eliminates the possibility that a single bad day explains the data.

Never Accuse Without Evidence

Accusing an employee of theft without documented evidence is a wrongful termination and defamation risk. Even in at-will employment states, a false accusation of theft — made to the employee, to other employees, or in writing — can expose you to civil liability. Keep your investigation confidential. Do not discuss your suspicions with other employees, and do not confront the suspected employee until you have documented evidence from both POS data and video.

Understand Your State's Laws on Surveillance and Termination

Video surveillance in commercial spaces is generally legal in all U.S. states when disclosed to employees and limited to non-private areas (sales floors, registers, stockrooms — not bathrooms or break rooms). Recording audio without consent may be restricted in two-party consent states (California, Illinois, Washington, and others). For termination, consult your state's employment laws and your HR policies before acting. In unionized workplaces, additional procedural requirements apply. When in doubt, consult an employment attorney before proceeding.

When to Involve Law Enforcement

Involve law enforcement when: (1) the theft amount is significant enough to warrant criminal charges (typically $500+ for felony-level theft, though thresholds vary by state), (2) you have clear documented evidence, or (3) multiple employees are involved. For smaller incidents, most operators choose termination over prosecution — prosecution is time-consuming, results are uncertain, and restitution is rarely recovered. However, filing a police report — even without pursuing prosecution — creates a formal record that can be valuable if the employee contests unemployment or files a wrongful termination claim.

5. When to Deploy Managed Video Audit

If you're seeing three or more signs from this checklist, manual investigation is too slow. Here's why: manual POS review and manual video review are two separate processes that most managers try to run sequentially — pull the report, then watch the video. For a single store with one suspected employee, that might take 20–30 hours over two weeks. For multi-unit operators, it's not operationally feasible.

Managed POS + video auditing solves this by automating the correlation. Every flagged POS exception — every void, no-sale, suspicious refund, or discount outlier — is automatically matched to the video clip from that exact timestamp. Trained reviewers then review each clip against the transaction data and document what they find.

DohShield's managed audit service can review every flagged transaction from the past 30 days and deliver a complete evidence package in 24–48 hours. This gives you documented evidence — not suspicion — in less time than it would take you to manually review one week of transactions.

6. The DohShield Evidence Package Process

DohShield doesn't just flag suspicious behavior — it builds the complete evidence record you need to act. Here's what the evidence package includes and how it's assembled.

What DohShield Delivers

1. Timestamped POS data for each flagged transaction. Every exception — void, no-sale, refund, or discount — is documented with employee ID, register ID, transaction time, dollar amount, and the specific exception type. This forms the evidentiary backbone of the report.
2. Synchronized video clips for each flagged transaction. The video clip corresponding to each POS exception is extracted and labeled with the matching transaction data. You see exactly what happened at the register — what was on the counter, what was scanned, how the cash was handled — for every flagged event.
3. Pattern analysis report. DohShield's trained reviewers assess whether individual incidents represent isolated errors or a systematic theft pattern. The report identifies the highest-risk employee(s), the methods being used, and the estimated frequency.
4. Dollar loss estimate. Based on the documented incidents and pattern extrapolation, the report calculates an estimated total loss figure — both confirmed (directly evidenced) and probable (pattern-based). This number is useful for determining whether to pursue prosecution and for insurance documentation.
5. Evidence package formatted for HR action or law enforcement. The final deliverable is organized specifically for use in an employee termination meeting, a police report, or a formal HR proceeding. It includes a narrative summary, the transaction evidence, the video clips, and a timeline — everything a manager or attorney needs to proceed.

For operators managing multiple locations, DohShield runs daily across every store — so you're not waiting until a problem becomes obvious. You're catching it at the pattern stage, before months of compounding losses.

Frequently Asked Questions