Investigation-Ready Evidence Packages — Video + POS + Timeline
Suspecting theft isn't enough. Acting on suspicion without documentation is a liability. DohShield produces termination-ready and prosecution-ready evidence packages: synchronized video, POS receipts, timestamps, employee identification, and pattern documentation — everything HR, attorneys, and law enforcement need to take action with confidence.
The Evidence Gap: Why Most Theft Goes Unresolved
Most business owners know something is wrong before they can prove it. The cash register is short. Inventory doesn't reconcile. Food costs are higher than they should be. But knowing there's a problem and proving who's responsible are two fundamentally different challenges. According to the Association of Certified Fraud Examiners (ACFE), the median duration of employee fraud is 12 months before detection — and only 10.9% of losses are ever recovered.
The reason most theft goes unresolved isn't that business owners don't suspect it — it's that they lack the documentation to act. Terminating an employee without evidence exposes you to wrongful termination claims, unemployment insurance disputes, and potential discrimination lawsuits. Filing a police report without evidence gets you a case number and nothing else. And recovering losses through civil action requires demonstrable proof of the amount and method of theft.
DohShield's evidence packages close this gap. Every incident we document includes the corroborating evidence needed for three levels of action: internal HR proceedings (termination and disciplinary action), civil recovery (demand letters and small claims), and criminal prosecution (police reports and district attorney referrals). The packages are built to the documentation standards expected by employment attorneys, HR professionals, and law enforcement investigators.
The result: You don't just know someone is stealing. You have the documented proof to stop them, recover your losses, and send a clear message that theft will be prosecuted — not tolerated.
Wrongful termination claims: Average settlement cost of $40,000–$80,000 for out-of-court resolution. Litigation costs $100,000+ through trial.
Unemployment insurance: Without documented cause, terminated employees almost always receive UI benefits — increasing your employer tax rate.
EEOC complaints: If the terminated employee is in a protected class, lack of documentation makes discrimination allegations difficult to defend.
Anatomy of a DohShield Evidence Package
Every evidence package contains six core components — designed to meet the documentation standards required for HR proceedings, civil recovery, and criminal prosecution.
1. Synchronized Video Evidence
The centerpiece of every evidence package is a timestamped video clip showing exactly what happened during the incident. This isn't raw surveillance footage that requires scrubbing through hours of tape — it's a precisely clipped, relevant segment showing the employee's actions at the point of sale, safe, or back door during the flagged transaction. Video clips are synchronized to the POS data, so the viewer can see exactly what the employee did at the register while the transaction was being processed.
For prosecution-ready packages, we provide the video in standard law enforcement formats (MP4, AVI) with embedded timestamps that match POS records. For HR proceedings, we can provide annotated versions with key moments highlighted.
2. POS Transaction Record
A screenshot or export of the complete POS transaction record showing: the items scanned (or not scanned), any voids, refunds, or modifications applied, the payment method, the total amount, and the employee ID who processed the transaction. This is the data layer that establishes what the POS system recorded — which, when compared to the video showing what actually happened, reveals the discrepancy that constitutes the evidence of theft or policy violation.
For pattern cases involving multiple incidents, we provide a transaction summary table showing every flagged transaction by the same employee: dates, times, amounts, and transaction types — making the progressive pattern unmistakable.
3. Precise Timestamps & Location Data
Every evidence package includes exact date, time (to the second), register number, store location, and camera ID. The timestamps are cross-referenced between POS records and video footage to verify synchronization. This precision is critical for legal proceedings — attorneys and investigators need to demonstrate that the video and the POS data represent the same event at the same time. Our timestamp verification process ensures the evidentiary chain is unbroken.
4. Employee Identification
Each evidence package identifies the employee involved: employee ID number, name (as registered in the POS system), register assignment, shift information, and — where applicable — the manager on duty during the incident. Visual identification from the video is matched to the POS employee ID to create a verified link between the person on camera and the person logged into the register. This dual-layer identification eliminates the "it wasn't me" defense.
5. Written Reviewer Narrative
A detailed written account from the DohShield reviewer who examined the evidence. The narrative describes: what the POS data shows, what the video reveals, the specific discrepancy between the two, and why the reviewer classified the activity as suspicious or confirmed theft. The narrative uses objective, factual language suitable for legal and HR proceedings — no speculation, no opinion, just documented observations. This written account provides the human interpretation layer that connects the data evidence to the visual evidence in a coherent, understandable narrative.
6. Pattern Documentation & Loss Calculation
For repeat offenders, the evidence package is elevated to a pattern document — a comprehensive timeline showing every documented incident by the same employee across all reviewed dates. This includes: individual incident summaries, cumulative loss calculations (total estimated theft value), frequency analysis (how often the behavior occurs per shift/week), and escalation trajectory (whether the amounts or frequency are increasing). This pattern documentation transforms individual incidents into a prosecutable case by demonstrating intent, repetition, and quantifiable financial harm.
Pattern documents also include a comparative analysis showing the employee's exception rates versus peer employees on the same shift — demonstrating that the behavior is anomalous, not standard practice.
Three Levels of Action
DohShield evidence packages are designed to support action at every level — from internal HR to criminal prosecution. Here's how the evidence is used at each stage.
HR & Termination
The most common use case. Our evidence packages provide the documentation HR departments need to terminate for cause with confidence. The combination of video, POS data, and written narrative creates a record that withstands unemployment insurance challenges and wrongful termination claims. We've supported hundreds of successful terminations where the employer had clear, documented evidence of misconduct. Key elements for HR: the visual proof (video), the data proof (POS), the written account (narrative), and the pattern history (if applicable). Together, these components demonstrate that the termination was based on documented facts — not suspicion, personality conflicts, or protected characteristics.
Civil Recovery
Many states allow employers to pursue civil recovery from employees who steal — demanding repayment of documented losses through demand letters or small claims court. DohShield evidence packages include the quantified loss calculations needed for civil recovery: exact dates, amounts, and cumulative totals supported by both POS data and video evidence. For multi-incident cases, our pattern documents establish the total financial impact with precision — turning "we think they stole around $5,000" into "we have documented 47 incidents totaling $6,230 between January and March, each supported by video and POS evidence." That specificity is what attorneys and judges require.
Criminal Prosecution
For significant theft cases — typically those exceeding felony thresholds ($500–$2,500 depending on jurisdiction) — DohShield evidence packages support criminal referrals to local law enforcement and district attorneys. Our prosecution-ready packages include video in law enforcement standard formats, POS records with chain-of-custody documentation, employee identification verified through both POS login and video, cumulative loss calculations that establish the felony threshold, and pattern documentation showing the systematic nature of the theft. We've supported successful criminal referrals across multiple jurisdictions and can prepare evidence packages formatted for specific district attorney requirements upon request.
How Evidence Packages Are Created
Every evidence package follows a standardized creation process that ensures consistency, accuracy, and legal defensibility.
Incident Detection
Our daily POS + video auditing identifies the suspicious activity. Whether it's a void that doesn't match the video, a safe drop that was skipped, or a sweethearting pattern — the detection happens through our standard review process. Every flagged incident is assessed by the reviewing analyst for severity and evidentiary strength.
Evidence Collection
The reviewer collects all relevant evidence: extracts the video clip, captures the POS transaction record, verifies timestamps, confirms employee ID, and gathers any additional data points (register readings, safe drop logs, inventory records). Each piece of evidence is cross-referenced to ensure consistency.
Narrative Documentation
The reviewer writes an objective, factual narrative describing the incident: what the POS shows, what the video reveals, the specific discrepancy, and the classification. The narrative avoids speculation or conclusions about intent — it documents observable facts that allow the reader (HR, attorney, investigator) to draw their own conclusions from the evidence.
Package Assembly & Delivery
All components are assembled into a structured evidence package with a cover sheet summarizing the incident: date, time, location, employee, incident type, severity, and estimated financial impact. Packages are delivered through your secure DohShield dashboard or via encrypted email — maintaining chain of custody from creation to delivery.
From Incident to Pattern: Building the Prosecution-Ready Case
A single incident of employee theft might represent a moment of weakness or an isolated lapse in judgment. But when DohShield documents the same employee engaging in the same behavior repeatedly — voids every Tuesday night, sweethearting with the same customer every weekend, short safe drops every closing shift — it becomes a pattern. And patterns are what prosecutors, judges, and unemployment boards care about.
DohShield's pattern documentation aggregates individual incident evidence packages into a comprehensive case file. The pattern document includes a chronological timeline of every documented incident, individual evidence summaries with links to the full packages, cumulative financial loss calculations, frequency and trend analysis, comparative data showing the employee's exception rates versus peers, and an escalation recommendation based on the severity and trajectory of the behavior.
This progressive documentation approach is strategically important because it allows you to choose when and how to act. Some clients prefer to address individual incidents immediately for deterrent effect. Others build a pattern case over 2–4 weeks to maximize the strength of the evidence before taking action. Either approach works — because every individual incident is independently documented and actionable.
Week 2: Same employee voids two transactions ($22.00, $14.75) on the same overnight shift. Video confirms cash pocketed during both. Pattern flag triggered.
Week 3: Three additional voids ($15.50, $31.00, $9.25) on consecutive shifts. Cumulative documented loss: $111.00 across six incidents.
Week 4: Pattern document compiled. Total documented loss: $156.50 over 4 weeks. Frequency: 2.25 incidents per week, escalating. Peer comparison: Employee #7's void rate is 340% higher than the next highest employee on the same shift. Recommendation: Immediate termination with criminal referral if cumulative theft exceeds jurisdictional felony threshold.
Frequently Asked Questions
DohShield evidence packages are designed to meet the documentation standards expected by employment attorneys, HR professionals, and law enforcement investigators. Our packages include synchronized video, POS records, verified timestamps, employee identification, and objective written narratives. We've supported hundreds of successful terminations and multiple criminal referrals. While we don't provide legal advice, our evidence has been used successfully in unemployment hearings, civil recovery proceedings, and criminal prosecutions across multiple jurisdictions. We recommend consulting your attorney for case-specific legal guidance.
Single-incident evidence packages are typically delivered within 24–48 hours of detection. Critical incidents (high-value theft, safe drop manipulation) on Gold and Platinum plans are escalated the same business day with preliminary evidence, followed by the full package within 24 hours. Pattern documents are compiled on a rolling basis and delivered when the case reaches a sufficient evidentiary threshold — typically after 3–5 documented incidents involving the same employee.
Yes. In addition to the proactive evidence packages generated through our daily auditing, you can request targeted reviews of specific employees, shifts, or time periods. If you suspect a particular employee or have noticed discrepancies at a specific location, we can prioritize a focused review and produce an evidence package based on the targeted findings. Targeted review requests are included in Gold and Platinum plans and available as an add-on for Silver plan clients.
Evidence packages are delivered through your secure DohShield client dashboard, accessible only to authorized users with role-based permissions. Sensitive evidence (video clips, employee identifiers) is encrypted in transit and at rest. For clients who prefer email delivery, we use encrypted email with password-protected attachments. We maintain strict chain-of-custody documentation showing when each evidence package was created, by whom, and when it was accessed — supporting the evidentiary integrity required for legal proceedings.
DohShield retains evidence packages for a minimum of 12 months from the date of creation. Extended retention is available upon request and recommended for any open investigations or pending legal proceedings. We advise clients to download and archive evidence packages in their own secure systems as well — providing an independent backup of the documentation. For active criminal cases, we can retain evidence indefinitely until the case is resolved and maintain chain-of-custody records throughout.
Yes. Evidence packages are included in every DohShield plan — Silver, Gold, and Platinum. Every confirmed incident receives a complete evidence package regardless of your plan tier. The difference between plans is the volume of transactions reviewed (100, 125, or 200 per month), the reporting frequency, and the escalation speed. But the evidence quality and completeness is the same across all tiers — because the evidence is the product.
Stop suspecting. Start proving.
Book a free strategy call to see how DohShield evidence packages can give you the documentation to act on theft with confidence — for HR, civil recovery, or criminal prosecution.
Book Strategy Call