Author: admin

Counterfeit bills at the register became real money at the return desk — and only a statewide pattern made it visible.

Some return fraud hides the merchandise. This one hid the money. On November 5, 2026, Pennsylvania Attorney General Dave Sunday announced felony charges against four New York men — Fitzroy James, Fabian Coke, Gabriel Young, and Christopher Nicholas — over an alleged scheme built on a simple two-step: buy merchandise with counterfeit cash, then return it and walk out with real money. The men are charged with felony organized retail theft, dealing in proceeds of unlawful activity, conspiracy, and related offenses. Efforts to take them into custody are ongoing, and the charges are allegations — all four are presumed innocent unless proven guilty.

The scale is what should get an LP leader’s attention. According to the Attorney General, the group bought or attempted to buy more than $20,000 worth of merchandise with fake cash and profited at least $12,436 from returns. They allegedly worked stores in 16 Pennsylvania counties — from Allegheny and Bucks to Lancaster, Lebanon, and York — targeting Kohl’s, Target, Home Depot, Lowe’s, and other retailers. Investigators also suspect the group in similar crimes in several other states.

Why this play works

Each half of the scheme looks ordinary on its own. A cashier sees a cash sale. Days later, a service desk sees a customer with merchandise and a receipt, asking for a refund. Neither transaction triggers an alarm by itself — the fraud lives in the gap between them. Spread the activity across 16 counties and several chains, and no single store ever sees enough to call it organized. That is the design: small, plausible transactions that only become a felony case when someone connects them.

Catch it at the register, not the return desk

The first control point is the tender itself. Counterfeit-detection pens are widely used and widely over-trusted — they test the paper, not the bill, and modern counterfeits routinely pass them. Train cashiers on the built-in security features of larger denominations: the watermark, the security thread, color-shifting ink. Where volume justifies it, put bill validators or UV verification at lanes that take the most cash. A large cash purchase of easily returned merchandise deserves a few extra seconds of scrutiny before the drawer closes — because once a bad bill is in the drawer, the store has already lost, return or no return.

Connect the purchase to the return

Your POS data already holds the pattern; it just needs to be asked. Exception reporting should flag cash purchases returned for cash within a short window, repeat returners across locations, and the same high-value items cycling through buy-and-return at multiple stores. A return desk working from the receipt alone cannot see any of that. A return desk working from linked transaction data can — and a pattern that spans stores is exactly what turns a refund dispute into an organized retail theft referral.

Small losses, shared fast, become a felony case

This case was built the way these cases usually are: collaboratively. The Attorney General’s Organized Retail Crime Unit worked with the U.S. Secret Service, Pennsylvania State Police, four local police departments, and loss prevention professionals from the retailers involved, with Deputy Attorney General Jenna Strausbaugh prosecuting. None of that happens because of one store’s $300 loss. It happens because LP teams documented, preserved video and transaction records, and shared what they had. Report the pattern, not just the incident.

Source: Pennsylvania Attorney General press release, “AG Sunday’s Organized Retail Crime Unit Charges 4 New York Men with Statewide Fake Cash-Return Scheme in 16 Pa. Counties,” November 5, 2026 — https://www.consumerproductsinthenews.com/article/954779960-ag-sunday-s-organized-retail-crime-unit-charges-4-new-york-men-with-statewide-fake-cash-return-scheme-in-16-pa-counties

A counterfeit bill accepted at the register is a loss the return desk cannot undo. Verify the cash, link the return, and share the pattern — that is how a $300 refund becomes a statewide case.

The first fifteen minutes decide whether the store runs tight — or spends the day catching up.

Last week’s closing checklist covered how to end the day without leaving the store exposed. The other end of the day matters just as much. A sloppy opening — alarm not verified, safe not counted, cameras not checked — hands the day’s problems to everyone who walks in after you. A disciplined opening takes about fifteen minutes and pays for itself in shrink avoided and headaches prevented.

1. Verify the alarm and the perimeter before anything else

The first person in should confirm the alarm was set overnight and that it disarmed cleanly, with no overnight events on the log. Walk the exterior before you unlock the front: check for broken glass, pried doors, tampering at the receiving dock, and anything left against the building overnight. A forced entry that happened hours ago is already a loss — but finding it before the store opens means the scene is preserved, the police call is made on your terms, and no customer walks through a crime scene.

2. Count the safe and the tills before the first transaction

The safe count and the till counts from close should be verified against the closing log before any money moves. If a count is off, you want to know it at 8 a.m., with a small pool of people who had access, not at 4 p.m. after a full day of transactions has buried the trail. Count, record, initial. If your store uses dual control on the safe, do not let the morning rush become an excuse to skip it.

3. Check that your cameras and EAS actually work

A quick spot-check of the camera system — a glance at the monitor wall, a confirmation that recording is active on all channels — takes under a minute and catches the failures that matter most: a camera knocked out of position overnight, a DVR that stopped recording, a blind spot created by a moved display. Do the same for the EAS gates. Walk through with a tagged item and confirm the alarm sounds. An EAS system that silently fails is worse than no system at all, because the team keeps assuming it is watching.

4. Sweep the floor for overnight movement

Before the store fills with customers, walk the floor with fresh eyes. Look for fixtures that were moved, merchandise that was relocated, empty packages, and product staged in odd places — restrooms, fitting rooms, behind displays. Offenders and dishonest employees both use the quiet hours and the close of the previous day to stage product for a quick grab later. A five-minute sweep at opening catches what the closing sweep missed.

5. Confirm the day’s risk picture with the team

The opening huddle takes two minutes: who is on the floor, who is covering the front, any known persons to watch for, any deliveries expected, and any incidents from yesterday that carry over. Share the description of anyone who attempted a return fraud or a grab-and-go the day before. A team that starts the day with the same picture is far harder to exploit than five people each working from their own assumptions.

Make it a checklist, not a habit

Habits drift. A written opening checklist — posted, initialled daily, and audited weekly by the manager — is what keeps the routine honest when the store is short-staffed, when a new opener is covering, or when the morning is running late. The goal is not paperwork. It is a store where every day starts with the alarm verified, the money counted, the cameras confirmed, the floor swept, and the team briefed.

Fifteen minutes at open saves hours of investigation later. Open like you mean it.

The day’s shrink is often decided before the first customer walks in. Spend fifteen minutes at open — and make the rest of the day play defence, not catch-up.

Partial-payment theft led the spike. What LP teams should carry into the holiday season.

Halloween fell on a Saturday this year, and offenders noticed. According to new data from retail intelligence firm SAI, reported by The Grocer on November 3, 2026, shoplifting offences soared 163% on Halloween compared with the year before. Theft peaked between 11 a.m. and noon, and London accounted for 61% of the hotspot activity, followed by the South East at 18% and the South West at 10%.

The figures come from more than 30,000 cameras across 1,000 UK supermarkets and convenience stores. The geography is British, but the pattern travels: a seasonal trading peak, crowded stores, stretched staff, and offenders working inside otherwise ordinary transactions. U.S. teams heading into Black Friday should read this as a preview, not a foreign curiosity.

What actually happened

The most common Halloween method was not the smash-and-grab. It was partial payment — a customer paying for part of a basket while intentionally leaving other items unpaid. That accounted for 62% of incidents, followed by grab-and-go at 38%. Shoplifting was also up 8% week-on-week, and SAI attributes part of the year-on-year jump to Halloween landing on a Saturday, traditionally one of the highest-risk days for retail loss, versus a Friday last year.

Context matters too. An estimated 78% of families celebrated Halloween this year, with consumer spending expected to rise 6% year-on-year to £705 million, according to SAI. Bigger crowds mean more cover, more transactions to monitor, and more chances for a partial basket to slip through unnoticed.

Why partial payment is the trend to watch

SAI’s UK head, Clare Hoole, put it plainly: theft is evolving, and many incidents now occur within otherwise legitimate transactions, making them harder to catch through traditional methods or passive surveillance alone. A partial-payment theft does not look like a theft at the door. It looks like a normal shopper who paid — for something.

That is exactly why it deserves attention in loss prevention planning. Self-checkout and busy staffed lanes both create the same opening: an item left in the trolley, a basket scanned selectively, a high-value product never presented. If your exception reporting only flags voids, no-sales, and refunds, you are missing the quietest form of shrink on the shop floor.

What to do before Black Friday

First, staff the peak, not just the day. Halloween’s 11 a.m. to noon peak is a reminder that theft concentrates in narrow windows. Map your own peak hours from the last two holiday seasons and make sure floor coverage and checkout supervision match them.

Second, audit partial baskets daily through the holiday period. Review self-checkout interventions, unmatched items, and transactions where the scanned total looks light against the basket visible on camera. Look for repeat patterns — the same person, the same product mix, the same lane — rather than treating each incident as a one-off.

Third, brief front-end teams on polite, specific intervention. Staff should know what to say when a basket does not match a receipt, and when to step back and let LP or a manager take over. A calm, factual challenge at the till prevents far more loss than a confrontation at the exit.

Fourth, use real-time visibility, not end-of-week reports. Hoole’s warning for the golden quarter is that theft pressure will stay elevated. Daily exception reviews, live camera checks during peaks, and same-day sharing of suspect descriptions across nearby stores turn a single incident into intelligence for the whole estate.

Finally, share the lesson across your stores now. Halloween data is most useful in the first week of November, while there is still time to adjust rotas, lane coverage, and audit routines before the Black Friday surge.

The bigger lesson

Seasonal peaks are no longer just busy days; they are targeted periods for heightened retail crime. Offenders plan around them the same way retailers do. The teams that come out of the golden quarter with shrink under control will not be the ones with the most cameras. They will be the ones that watched the transactions happening in front of those cameras, caught the partial basket early, and shared what they learned before the next peak arrived.

Source: SAI data reported by The Grocer, “Shoplifting offences soar 163% on Halloween,” November 3, 2026 — https://www.thegrocer.co.uk/news/shoplifting-offences-soar-163-on-halloween/725491.article

Halloween was the warning shot. The golden quarter is the test — make sure your team is watching the basket, not just the door.

Concealment happens behind a closed curtain — so your controls have to work before the door closes.

Ask any experienced loss prevention agent where concealment happens most often in an apparel store, and the answer rarely changes: the fitting room. It is one of the few places in a store where a customer is legitimately alone, legitimately out of sight, and legitimately handling unpurchased merchandise. That combination makes it a natural target for concealment, tag removal, and wardrobing — and it means your controls have to work before the door closes, not after.

Here are five controls that actually work, without turning the fitting room into a confrontation zone.

1. Count in, count out — every time, no exceptions.

The single most effective fitting room control is also the simplest: count every garment going in and count every garment coming out. Use a numbered count card or a small tag handed to the customer at the entrance, and reconcile it at exit. When counts do not match, staff should know exactly what is missing — item, size, color — while the customer is still in the area. The control fails the moment it becomes optional during a rush. Peak hours are when it matters most, so staff the entrance during those windows rather than abandoning the count when the line grows.

2. Limit the number of items per visit.

A customer carrying twelve garments into a fitting room is harder to track than one carrying four. Set a reasonable per-visit limit — six is a common standard — and require the rest to be held at the entrance. This is not about inconveniencing honest shoppers; it is about keeping the count manageable and the reconciliation fast. Post the limit clearly at the entrance so it reads as store policy, not a personal judgment.

3. Design out the blind spots around the rooms, not inside them.

Never place cameras inside a fitting room — that is a privacy violation and a legal disaster. Instead, control what surrounds them: keep camera coverage on the entrance and exit corridor, keep sightlines from the sales floor open, and avoid layouts where a customer can slip from a fitting room into a stockroom door or an emergency exit unobserved. Remove extra hooks, shelves, and ledges inside stalls where tags and sensors can be hidden, and check that stall doors latch properly. A stall that will not close invites misuse; a stall with a hiding place invites concealment.

4. Check every room between uses.

A quick stall check after each customer is one of the highest-return habits in apparel LP. Staff should look for removed tags, detached sensors, empty hangers, and merchandise left behind — and log what they find, including the time and stall number. That log is more valuable than most teams realize: a pattern of tag removals in the same stall, on the same shift, or on the same weekday is early evidence of an organized effort, not a series of coincidences. A room that is never checked is a room where evidence disappears with the next customer.

5. Keep high-risk merchandise out of the fitting room loop.

Not every item belongs in a fitting room. Keep sensor tags and hard tags on garments until purchase, and consider keeping the highest-shrink items — premium denim, leather goods, and high-value activewear — in staff-assisted areas or behind the counter during peak theft periods. Train floor staff to offer help early and naturally: a greeting at the entrance, an offer to hold sizes, and a prompt count-out are customer service and loss prevention at the same time. When staff do find a discrepancy, the response should be calm, factual, and policy-based — “Our count shows one item unaccounted for; let me help you check” — never an accusation in front of other shoppers.

None of these controls requires new technology or a bigger budget. They require consistency: the same count, the same limit, the same stall check, on a slow Tuesday morning and on a packed Saturday afternoon. Fitting room shrink drops when the process is predictable — because the people testing it quickly learn that this store counts, checks, and notices.

Put the count card back at the entrance this week, and watch what your fitting room numbers do over the next thirty days.

A cross-county theft ring only became a prosecutable case when retailers and police shared the pattern — here’s how to build one.

Today, Ohio Attorney General Andy Wilson announced that Byron Carner, 35, of South Euclid, was sentenced to nine years in prison for stealing more than $104,000 in merchandise — mostly tools — from Rural King farm-supply stores across ten Ohio counties between June and October 2024. Carner pleaded guilty to one count of engaging in a pattern of corrupt activity and eight counts of theft in Clark County Common Pleas Court, and was sentenced immediately after the plea.

The stolen tools were sold at pawn shops. Carner and two suspected accomplices were arrested on October 2, 2024, after a vehicle pursuit involving the St. Clairsville Police Department, the Belmont County Sheriff’s Office, and the Ohio State Highway Patrol. The German Township Police Department investigated the case with assistance from the Ohio Bureau of Criminal Investigation, and the Clark County Prosecutor’s Office prosecuted it, with the Attorney General serving as special prosecutor. Cases against the suspected accomplices are still pending.

The quote worth pinning to your office wall came from Wilson himself: “This is how you prosecute organized crime — by taking a unified approach to crimes that cross county lines.” That sentence is the whole lesson. No single store’s loss, viewed alone, looked like a nine-year case. Ten stores’ losses, connected, did.

Report across lines, not just within them. A booster working a region counts on each store treating a hit as an isolated incident. When loss prevention shares descriptions, vehicle information, merchandise mix, and timing across a district or region — and with neighboring jurisdictions — a pattern emerges that no single incident report can show. If your company has stores in more than one county, your reporting chain should cross county lines as easily as the thief does.

Treat pawn shops as part of the investigation, not an afterthought. In this case, the fence was the trail. Tools are attractive precisely because they hold resale value and move quickly through secondhand channels. Serial numbers, distinctive markings, and good photos taken at receiving or on the sales floor turn a generic “missing drill set” into an identifiable item a detective can recover and a prosecutor can tie to a defendant. If your team is not capturing serial numbers on high-value tools, that is a gap worth closing this week.

Build the case file as if a prosecutor will read it — because one might. Dates, locations, amounts, preserved video, and inventory records tying each item to a specific store and date are what elevate a stack of incident reports into a pattern-of-corrupt-activity charge. Sloppy documentation is how multi-jurisdiction cases fall apart; clean documentation is how they hold together.

Recognize tools as a target category. Farm-supply and hardware merchandise combines high value, easy resale, and weak traceability. If tools are a high-shrink category in your stores, they deserve the same attention you give electronics or fragrances: locked or cabled displays for the top items, exception reporting on tool-category shrink, and a direct line to local pawn detail detectives.

The Ohio case took two years from arrest to sentence, and it started with police departments and a prosecutor’s office willing to work as one team. LP’s role in that kind of outcome is unglamorous and essential: share the pattern early, document it cleanly, and keep the evidence trail intact across every store the thief visits.

Source: Ohio Attorney General announcement via EIN Presswire, November 2, 2026: https://www.einpresswire.com/article/953970756/cuyahoga-county-man-pleads-guilty-to-organized-crime-theft-charges

The takeaway: one store’s theft report is an incident; ten stores’ reports, shared early, are a case.

Most overnight losses don’t start at midnight — they start at closing, when the safe count is rushed, the back-door check is skipped, and the alarm is assumed, not verified.

Ask any investigator where an overnight loss usually begins and the answer is rarely a sophisticated break-in. It is a door left unsecured, a safe count done alone and in a hurry, an alarm that was never actually armed, or a back room nobody swept before the lights went out. Closing is a loss prevention procedure, not just the end of the shift — and it deserves the same discipline as opening.

Count with two people and reconcile before anyone leaves. Safe counts, register tills, and deposit bags should be verified by a second person, with variances documented the same night, not discovered the next morning when the trail is cold. A solo count is an invitation: it removes the witness, the cross-check, and the paper trail all at once. If staffing only allows one closer, require a manager review of the count sheet and the deposit record first thing the next day — and make that review visible, so the closer knows it happens.

Sweep the whole store, not just the sales floor. Stockrooms, receiving areas, restrooms, fitting rooms, and offices are where people hide, merchandise gets staged, and doors get propped. Walk every space, check every door and window latch, and confirm the receiving door is locked from the inside. Staged merchandise found at closing is a prevented loss; staged merchandise found at opening is a police report.

Account for keys and access before you lock up. Collect temporary keys from vendors, contractors, and seasonal staff who will not be back tomorrow, and log who still holds what. A key that walked out with a departing employee is an unlocked door you cannot see — and it stays that way until someone audits the key log.

Verify the alarm and the cameras — do not assume them. Arm the system and confirm the panel shows a clean, armed status, not a bypassed zone or a trouble signal everyone has learned to ignore. Glance at the camera system to confirm it is recording, with the right date and time stamp. An alarm that was never armed and a camera that stopped recording last Tuesday are the two most common discoveries after an overnight incident, and both are preventable in thirty seconds at closing.

Step outside before you drive away. Check that exterior lighting is on, the dumpster area is clear, and no one is lingering near the building or in a parked vehicle. Good lighting and a clear lot do not just deter a break-in; they tell anyone watching that this store is watched.

Write it down. A short closing log — who closed, what was counted, what was found, what was exceptional — turns closing from a habit into evidence. When something does go wrong overnight, that log is what tells investigators and leadership whether the store was secured or merely assumed secure.

Closing well costs about ten focused minutes. Closing carelessly can cost a night’s inventory, a safe’s contents, and a case that never gets solved. Close like you mean it.

A fictitious pickup in Torrance cost a warehouse half a million dollars in product — and the whole shipment was recovered. The lesson is at the dock door, not in the recovery.

Los Angeles County Sheriff’s Department detectives announced on October 27, 2026, that they had recovered approximately $500,000 in SIG Sauer firearm parts and accessories taken in a fictitious pickup from a warehouse near Torrance, California. The entire shipment was returned to its owner, and two men were arrested on suspicion of grand theft cargo. For loss prevention and supply chain security teams, the recovery is the good news. The bad news is how easily the loss happened in the first place: freight was released to someone who was not authorized to take it.

Investigators have not yet explained publicly how the fictitious pickup was carried out, which transportation provider was impersonated, or how the shipment was tracked down. That gap is itself instructive. LP teams should not wait for the full case study to harden their own pickup procedures, because the pattern behind this case is well documented. In Southern California, the region around Torrance accounted for 37% of reported U.S. cargo theft incidents in the surrounding 200-mile area, according to an Overhaul report cited by FreightWaves, and deceptive pickups represented 28% of cases in the region. This is not a rare trick. It is a routine one.

Verify independently, not from the paperwork at the door

Before freight leaves the dock, someone other than the driver should confirm the pickup against a source the driver did not provide: the carrier assignment on file, a pickup number confirmed with the shipper or broker through a known contact, and the tractor and trailer details. A bill of lading handed to you at the door proves only that someone printed a bill of lading. In a separate Southern California case involving roughly $70,000 in beer shipments taken from an Anheuser-Busch distribution center, detectives identified discrepancies involving the trucking company, the driver, and the vehicles. Any one of those mismatches should stop a release, not start a negotiation.

Treat high-value freight as a different tier

A shipment of firearm parts deserves more than the standard dock routine: pre-registered pickups, photo identification checked against the assignment, equipment numbers recorded, and a supervisor sign-off before the doors close. The extra two minutes at the dock are cheap compared with a half-million-dollar loss and a criminal investigation.

Document the handoff so investigators can use it

Log who picked up the load, when, in what equipment, under which pickup number, with seal numbers and photos where your procedure allows. When a case lands with a specialized unit like the Sheriff’s Cargo Criminal Apprehension Team, that record is often the difference between a fast recovery and a cold trail.

Share the attempt, not just the loss

Fictitious pickups work because each warehouse treats its dock as an island. Regional task forces, industry groups, and neighboring facilities all benefit when a near-miss or a suspicious pickup attempt is reported the same day, with carrier names, equipment descriptions, and document details attached. The Torrance recovery shows law enforcement can close these cases. It does not show that recovery is a strategy.

The dock door is a loss prevention post. Staff it like one, verify every pickup like the load depends on it — because it does.

Source: FreightWaves, “$500,000 SIG Sauer shipment stolen in fictitious pickup, two arrested in California,” published October 29, 2026.

A missing master key can cost more than a shoplifting ring. Tighten who holds keys, how they’re tracked, and what happens when someone leaves.

Ask a loss prevention manager where their shrink comes from and you’ll hear about shoplifting, organized retail crime, and return fraud. Ask where their keys are, and you’ll often get a pause. That pause is the problem. A single unaccounted master key gives someone quiet, after-hours access to the stockroom, the cash office, and the safe — no forced entry, no alarm, no footage of a break-in. Key control is loss prevention, and most stores treat it as a facilities afterthought.

Here are five controls that close the gap.

1. Number every key and log every handoff. Each key should carry a stamped number tied to a record: who holds it, which doors it opens, and when it was issued. Sign-outs go in a log, not on memory. If you can’t produce a current list of key holders in five minutes, you don’t have key control — you have key hope.

2. Separate the person who issues keys from the person who audits them. When the same manager hands out keys and checks the log, discrepancies have a way of never surfacing. A monthly spot check by someone outside the key-issuing chain catches the quiet drift: the key lent to a contractor and never returned, the duplicate made “just in case.”

3. Make key return part of the termination checklist — same day, no exceptions. Every LP professional has a story about a former employee who kept a stockroom key for weeks because nobody asked for it. The exit procedure should name key collection explicitly, and any unreturned key should trigger a rekey decision within 24 hours, not at the next remodel.

4. Audit physically, not just on paper. Once a quarter, count the keys in hand against the log, test a sample against the doors they’re supposed to open, and look for the telltale signs of unauthorized duplication: shiny new copies, keys without stamped numbers, blanks that don’t match your keyway. Paper audits confirm the log matches itself. Physical audits confirm the log matches reality.

5. Control duplication at the source. Use restricted keyways that a hardware store can’t copy, and authorize exactly one locksmith vendor to cut keys for your locations. If any employee can walk into a key kiosk with a stockroom key, your log is fiction. Restricted keyways cost more upfront; one after-hours internal theft costs far more.

Two more habits round out the program. Treat vendor and contractor keys as temporary by default — issued for the job, collected at the end of the day, never left in a lockbox with a shared code that hasn’t changed in three years. And treat the cash-office and safe keys as a separate tier: fewer holders, stricter logging, and immediate rekeying when a holder’s role changes.

None of this requires new technology. It requires treating keys like what they are: credentials. You wouldn’t hand out alarm codes without a record and leave them active after someone quits. Keys deserve the same discipline — because the most expensive theft in your store may be the one that walks in through a door that was never forced open.

IHL Group and Sensormatic’s 2026 total retail loss study finds 75% of loss dollars come from somewhere other than external theft. Here’s where to look.

If your loss prevention program is built almost entirely around stopping shoplifters at the door, a major new study says you’re guarding a quarter of the problem. IHL Group and Sensormatic Solutions’ Beyond Shrink: 2026 Global Total Retail Loss Study — based on input from 915 retail decision-makers, weighted by company revenue — found that external theft, including organized retail crime, is the largest single source of loss at 25%. The other 75% of loss dollars come from elsewhere in the business.

That is not a reason to relax on theft. Every loss vector the study tracked is rising, with more than half of retailers (54%) reporting an increase in each area. It is a reason to widen the map your team works from.

Start with returns. Return fraud increased for 68% of retailers — nearly matching the 69% who reported increased shoplifting — yet retailers rank fraud prevention only fifth out of seven loss-related performance measures. That gap between exposure and priority is exactly the kind of blind spot LP leaders are paid to close. If your return desk still runs on loose receipt checks and manager overrides with no audit trail, you already know where to begin.

Next, look at the supply chain. Supplier fraud, warehouse and sales-area shrink, and goods-receiving loss together account for 33% of retailers’ total losses. That is a bigger slice than external theft, and it lives in areas LP teams often treat as someone else’s department. Receiving-dock discipline — counting before signing, separating receiver and checker duties, auditing high-shrink SKUs on arrival — is loss prevention work, full stop.

Then there is the quietest drain of all: process error. Administrative process errors cost retailers an average of $103.40 per incident, nearly matching the $107.00 average cost of employee theft. In other words, honest mistakes are costing almost as much as dishonesty. Tightening receiving paperwork, price-change procedures, and markdown controls is unglamorous work, but the numbers say it pays like an investigation program.

Two more findings deserve a place in your next budget conversation. First, scale changes exposure: external theft and ORC account for 26% of total loss at retailers over $1 billion in revenue, but only 17% at retailers under $250 million — so smaller operators should be even more skeptical of a theft-only loss strategy. Second, investment tracks with outcomes: the average LP budget in the study is about 1.2% of sales, and retailers spending above 2% were the only group reporting more declines than increases across loss vectors.

Finally, the study links traffic awareness to better results. Retailers that align staffing and monitoring to traffic patterns report better loss outcomes, with 91% citing peak traffic periods and 89% citing event-driven crowd surges as key drivers of loss. Staffing to the clock instead of to the crowd is leaving money on the table.

The takeaway is not that theft doesn’t matter — it does, and it is growing globally. The takeaway is that a loss prevention program measured only by apprehensions and recoveries is measuring a quarter of its job. Audit the other three quarters: returns, supply chain, and process. That is where the rest of your shrink is hiding.

Source: IHL Group and Sensormatic Solutions, “Beyond Shrink: 2026 Global Total Retail Loss Study,” announced October 22, 2026.