Internal Theft: The Red Flags Most Managers Miss

Your biggest shrink risk isn’t walking through the front door — it’s already on the schedule.

Ask most retail managers where their losses come from and they’ll point at shoplifters. The data tells a different story. Industry research has consistently shown that employee theft accounts for roughly a third of retail shrink — often more than shoplifting — and each internal case costs far more on average than an external one. A shoplifter steals a product; a dishonest employee can steal for months, manipulating the very systems meant to catch them.

The uncomfortable truth is that internal theft rarely looks like theft. It looks like a trusted associate, a top performer, someone who’s been there for years. That’s exactly why the red flags get missed — managers don’t want to believe it, and the behaviors are easy to rationalize away.

Start with the POS patterns, because that’s where the money moves. Watch for excessive voids and returns processed without a customer present, especially by the same associate. Discount abuse — unauthorized markdowns for friends or “sweethearting” at self-checkout — is one of the most common schemes. Refunds issued to gift cards or cash without corresponding merchandise are another classic. Exception-based reporting software exists precisely to surface these patterns; if you’re not reviewing EBR reports weekly at minimum, you’re flying blind.

Then there are the behavioral red flags. An employee who never takes a vacation or refuses to let anyone else close their register may be protecting a scheme that requires their constant presence. Sudden lifestyle changes — a new car, expensive purchases on a retail wage — deserve attention, not accusations. Defensiveness about routine audits, reluctance to follow cash-handling procedures, and spending unusual time in stockrooms or near the safe are all signals worth noting. None of these prove anything alone. Together, they form a picture.

Here’s where most managers go wrong: they either ignore the signs or launch an aggressive confrontation that poisons the workplace. There’s a better way. Build your case quietly and methodically. Review POS data, check video against transaction records, and document everything before you ever speak to the employee. When you do interview, use a professional, non-accusatory approach — state the facts you’ve observed and give them a chance to explain. Many internal investigations resolve with a confession when the evidence is laid out calmly and completely.

Prevention matters more than prosecution. Anonymous tip lines work — a meaningful share of internal cases are uncovered because a coworker spoke up. Make sure your team knows the tip line exists, trusts that it’s truly anonymous, and has seen it lead to action. Rotate register assignments so no one person permanently controls a drawer. Enforce the unglamorous basics: bag checks, consistent discount policies, and manager approvals on voids and returns. Controls that feel like bureaucracy are the ones that stop the quiet, long-running thefts.

One more thing: protect the culture while you protect the assets. The goal is a workplace where honest employees feel trusted and dishonest ones feel watched. Blanket suspicion destroys morale and drives good people out. Targeted, data-driven investigation protects everyone — including the employees who deserve to work somewhere theft isn’t tolerated.

Employee theft is the hardest shrink to see from the inside. Robert John Bonus Consulting provides confidential security assessments, internal investigation guidance, and loss prevention training for your team — visit rjbonusconsulting.com to start the conversation.

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *


Protecting people, property, & profits

Small Business B(AI)sics Certificate of Completion, U.S. Chamber of Commerce

Small Business B(AI)sics — Certificate of Completion, U.S. Chamber of Commerce

Loss Prevention digital badge, Cloud Assess

Loss Prevention — Digital Badge, Cloud Assess

Bomb Threat Preparedness and Response Certificate of Completion, U.S. Department of Homeland Security

Bomb Threat Preparedness and Response — Certificate of Completion, U.S. Department of Homeland Security