How to Catch an Employee Stealing From the Register

You suspect an employee is stealing from the register. Maybe the cash is consistently short. Maybe you've noticed behavioral changes — nervousness around the drawer, reluctance to let anyone count their till, or suddenly living beyond their means. Whatever triggered your suspicion, what you do next matters enormously.

Handle it wrong, and you lose your evidence, expose yourself to a wrongful termination lawsuit, or tip off the employee before you can build a case. Handle it right, and you'll have documented, provable evidence that protects your business and holds up in court if needed.

This guide walks you through the complete process — from initial suspicion to confrontation — using methods that work for convenience stores, gas stations, restaurants, and any cash-handling business.

Warning Signs of Register Theft

Before diving into investigation methods, know the behavioral and data-driven indicators that an employee may be stealing from the register:

Behavioral Red Flags

• Protective of their drawer: Refuses to let others use their register or becomes anxious during cash counts.
• Always volunteering for closing shifts: Overnight and closing shifts have the least supervision, making them ideal for theft.
• Lifestyle inconsistencies: New car, expensive purchases, or frequent spending that doesn't match their income level.
• Resistance to policy changes: Pushes back against new camera installations, POS upgrades, or reconciliation procedures.
• Close relationships with specific customers: Certain people always come in on the same employee's shift and transactions are unusually quick.
• Irregular voiding patterns: Processing voids immediately after a customer leaves, or voiding items at unusual times.

Data-Driven Red Flags

• Consistent cash shortages on specific shifts: If Tuesday night is always $30-50 short and the same cashier works every Tuesday night, that's a pattern.
• High void rate: One cashier processes 3x more voids than peers on comparable shifts.
• Excessive no-sale drawer opens: The drawer opens without a transaction more frequently than normal.
• Low items-per-transaction average: May indicate sweethearting — items being handed to customers without scanning.
• Refund anomalies: Processing refunds when no customer is present, or refunding items to the same "customer" repeatedly.
• Declining sales on specific shifts: If revenue drops when a particular employee works but customer traffic appears normal, items may not be rung up.

Step-by-Step Investigation Process

Step 1: Document the Pattern (Days 1-7)

Before taking any action, spend one full week documenting the data. Pull the following reports from your POS system:

• Daily over/short reports broken down by cashier and shift
• Void and refund logs with timestamps and cashier IDs
• No-sale drawer open frequency by cashier
• Items-per-transaction averages by cashier
• Discount and override logs

Create a simple spreadsheet that tracks: Date | Shift | Cashier | Over/Short | Voids | No-Sales | Notes. One week of data gives you enough to identify whether this is a pattern or a coincidence.

Step 2: Review Video Footage (Days 3-7)

Once you've identified suspicious transaction patterns, pull the corresponding video footage. Focus on:

• Every void processed by the suspected employee. Was a customer present? Did merchandise return to the shelf?
• Every no-sale drawer open. What was the employee doing? Were they making change for a customer, or reaching into the drawer without a transaction?
• Transaction-to-customer matching. Watch 10-15 transactions from the suspect's shift. Count the items the customer puts on the counter and compare to what was scanned on the POS.
• Safe drop procedures. Did the employee make required safe drops? Did the amount appear reasonable compared to the cash sales for that period?

Step 3: Cross-Reference POS and Video Data

This is the critical step that transforms suspicion into evidence. For each suspicious transaction you've identified:

1. Print the POS receipt (showing items scanned, amounts, payment method)
2. Pull the synchronized video showing the same transaction
3. Document any discrepancy: items on counter vs. items scanned, cash tendered vs. cash recorded, void processed with no corresponding customer action
4. Note the timestamp, cashier ID, and terminal number

A single discrepancy could be a mistake. Three or more discrepancies showing the same pattern on the same employee's shift establishes intent.

Step 4: Conduct a Register Audit

Perform an unannounced mid-shift register audit on the suspected employee's shift. This involves:

1. Run a mid-shift X-report (subtotal report) from the POS without resetting counters
2. Count the drawer in the employee's presence with a witness
3. Compare the count to the X-report expected amount
4. Document the result with both the manager and a witness signing the count sheet

If the drawer is significantly short ($20+), you have real-time evidence. However, note that some theft methods (sweethearting, phantom voids) don't create cash shortages — the money was never in the drawer to begin with.

Step 5: Build the Evidence Package

Before any confrontation, compile your evidence into a structured package:

• Summary document: Timeline of events, pattern analysis, total estimated loss
• POS reports: Over/short data, void logs, transaction details — all specific to the employee
• Video clips: 3-5 clear clips showing the theft behavior, labeled with date, time, and description
• Register audit results: If conducted, the mid-shift count documentation
• Witness notes: Any observations from managers or co-workers (be careful about involving other employees prematurely)

Step 6: The Confrontation

When you have a documented, evidence-backed case, schedule a private meeting with the employee. Follow these rules:

1. Always have a witness present. A manager, HR representative, or trusted employee should be in the room.
2. Present facts, not accusations. "Our records show that on March 3rd at 9:47 PM, a $23 void was processed on your register. The video shows no customer was present during this transaction. Can you explain this?"
3. Let them respond. Some employees confess immediately. Others deny. Either way, you have the documentation.
4. Don't negotiate or threaten. State your findings, present the consequence (termination), and document the meeting.
5. Secure the employee's access immediately. Change POS passwords, collect keys, and disable alarm codes before the employee leaves the premises.

Legal Considerations

Investigating employee theft carries legal risks. Protect yourself by following these guidelines:

• Don't accuse without evidence. "I think you're stealing" without documentation can lead to defamation claims.
• Check your state's recording laws. Most states allow surveillance cameras in the workplace with reasonable notice (usually a posted sign). Audio recording laws vary — some states require all-party consent.
• Review your employee handbook. Ensure your theft and cash-handling policies are documented and signed by the employee. This strengthens your termination case.
• Don't physically detain an employee. You can ask them to stay for a conversation, but you cannot physically prevent them from leaving. Unlawful detention opens you to significant liability.
• Consult an employment attorney before termination if the case involves amounts over $5,000, if the employee is in a protected class, or if you plan to pursue criminal charges.

Prevention: Stop Theft Before It Starts

The best approach to register theft is making it difficult and detectable from day one:

1. Daily POS + video auditing. When every transaction is reviewed against video daily, employees know theft will be caught. DohShield's managed audit service costs a fraction of what a single theft incident costs.
2. Per-shift reconciliation. Count the drawer at every shift change. Document over/short by cashier, every shift.
3. Void and refund approval policies. Require manager approval for any void over $5 and any refund. This creates a two-person accountability layer.
4. Safe drop policies. Require safe drops every time the drawer exceeds a threshold (typically $300-500). This limits the amount available to steal at any given time.
5. Camera signage. Post visible signs that all transactions are video-recorded and audited daily. Deterrence prevents more theft than detection.
6. Background checks. Screen all cash-handling employees before hire. A previous theft conviction doesn't automatically disqualify, but it should influence register assignment and supervision level.

Frequently Asked Questions