Employee Theft at the Register — 11 POS Red Flags Every Owner Should Watch

We've done loss-prevention reviews across smoke, vape, liquor, kava, c-store, and adult retail. Register-level fraud is not a sophisticated crime — it's a small handful of repeated patterns. The owners who catch it are the ones who pull the right reports every Monday and know what "normal" looks like for each cashier. For the smoke-shop-specific take, see /resources/blog/smoke-shop-loss-prevention-pos-shrink. This post is the broader, cross-vertical version focused on the register patterns themselves.

Why register-level fraud is the biggest category

The National Retail Federation's 2023 National Retail Security Survey puts total retail shrink at $112.1 billion in FY 2022, with the average shrink rate at 1.6% of sales. Specialty retail and counter-culture verticals (smoke, vape, liquor, kava, c-store, adult) typically run 2–4% — well above the mainstream average — because of higher cash mix, higher employee turnover, and high-value pocketable product.

Internal theft is roughly 60–75% of total shrink at specialty retail. And the overwhelming majority of internal shrink does not happen in the back room — it happens at the register, in transactions that look fine on the surface. The register is where the cash is. Back-room theft requires moving product through a door (cameras, access control, eyes). Register theft just needs a void button and a customer who paid cash.

The good news: every void, no-sale, refund, override, and adjustment is a logged event. The bad news: most owners never look at those logs until the annual inventory count surfaces a $20,000 problem.

The 11 patterns

Each pattern below: what it looks like in the data, and the action threshold we use. "Coach" = one-on-one conversation. "Investigate" = pull camera footage and cross-reference the audit trail. "Escalate" = involve your employment attorney and consider formal action.

1. High void rate

The most common pattern. Cashier rings a sale, customer pays cash, cashier voids after they leave, pockets the cash. Inventory shows sold; the drawer balances because the void removed the expectation.

What to watch:

• Void rate as a % of transactions, per cashier
• Peer comparison (same shift, same store, same role)
• Dollar-weighted void rate — voids on higher-value SKUs are a stronger signal

General retail should run below 1%. High-touch verticals (kava bars, restaurants with modifiers, vape shops with try-before-you-buy) can legitimately run 1.5–2%. Above that, the report is telling you something.

2. High no-sale opens

"No sale" pops the drawer without ringing a transaction. Legitimate uses: making change, money-order deposit, fixing a misplaced bill. Illegitimate use: skimming a $20 between customers.

What to watch:

• No-sale opens per shift, per cashier
• Time-of-day clustering (right before shift end, during the slow hour)
• Correlation with cash variance — high no-sale + small negative variance is the combination

Most POS systems can require a reason code on every no-sale ("make change," "money order," "drawer fix"). Turn that on. A forced reason code alone cuts no-sale abuse roughly in half — the cashier has to consciously lie on every event.

3. Refund-without-receipt clusters

Cashier processes a refund without a matching receipt, takes the "refund" cash out of the drawer. The transaction looks like a return; the cash walks.

What to watch:

• Returns processed without a linked original receipt
• Returns concentrated on one cashier
• Returns on easy-to-fake SKUs (small accessories, consumables)

Best practice: require a manager PIN for any no-receipt return. If your POS doesn't enforce it, that's the highest-leverage fix you can make this week.

4. End-of-shift adjustments that zero out the drawer

A cashier whose drawer comes up short manually adjusts the declared count, or backs out a transaction to balance. A cashier whose drawer is over (under-rang a sale, kept the overage) declares the overage as expected and pockets it.

What to watch:

• Transactions voided or refunded in the last 30 minutes of a shift
• Manual cash declarations that come in at exactly $0.00 variance
• Cashiers who close their own drawer (vs. manager-closed)

The single procedural change that catches the most of this: the manager closes the drawer, not the cashier. Blind drops (cashier doesn't see expected count before counting) make it nearly impossible to engineer a $0.00 variance.

5. Sweethearting — discounts applied to friends/family

Cashier under-rings sales for friends, family, or themselves. Common forms:

• Manual discount applied without manager approval
• Employee discount applied to non-employee purchases
• Promotional discount applied outside the promo window
• A $50 item rung as a $15 item (similar SKU)

What to watch:

• Manual discount count and dollar value per cashier
• Average basket size — sudden drops for one cashier vs. peers
• Discount timing — clustered when a specific customer is at the counter

POS fix: require a manager PIN for any manual discount above a threshold (we recommend $5 for smoke and vape, $10 for liquor, $3 for kava and c-store). The cashier can no longer apply the discount unilaterally.

6. Manager-override patterns by the same employee

When a cashier needs a manager PIN, the event is logged with both IDs. Same cashier needing the same manager's overrides repeatedly is worth a look.

What to watch:

• Override count per cashier
• Same cashier + same manager repeatedly
• Override clustering during off-peak hours

Two-person register fraud is more common than single-cashier fraud, because the manager-PIN system is the check — and if the check is corrupted, the cashier can do whatever they want with manager cover. Pull the override report by manager-cashier pair, not just by cashier.

7. Transactions just under reporting thresholds

If your audit flag is $100, a cashier may consciously ring sales at $99.99, $99.50, $99.00 to dodge the flag. The underlying fraud could be discount abuse, sweethearting, or fake-return cash. The "just under" pattern is what gives it away.

What to watch:

• Transaction-amount distribution (histogram with $5 bins)
• Clustering just below known thresholds (audit flag, cash-handling cap, discount cap)
• Per-cashier comparison of the same distribution

Every cashier learns your thresholds within a week. Honest cashiers don't engineer transactions around them; dishonest ones do.

8. Voided line items followed by smaller re-rings of the same SKU

Cashier rings a $40 SKU, voids the line item, then re-rings it at $25 via manual price entry or a "similar" cheaper SKU. Customer pays the lower price (in cash, with the difference pocketed; or as a sweetheart deal).

What to watch:

• Line-item voids followed by re-ring of the same or similar SKU within the same transaction
• Per-cashier frequency
• Concentration on specific SKU pairs (high-value original, cheaper sibling)

Requires a transaction-detail report, not a top-line cashier summary. Most POS systems have it; few owners pull it. If you run a vape, kava, or c-store with lots of similar-looking SKUs at different price points, add this to your Monday review.

9. Returns with new receipts on items not sold that day

Cashier creates a fake "return" by referencing a receipt from another store, another day, or an item the store didn't sell that day. Refund cash gets pocketed.

What to watch:

• Returns where the original transaction date is unverifiable
• Returns on SKUs that don't appear in today's sales report
• Returns processed against receipts that don't exist in your POS history

POS fix: most systems can require an original-receipt scan (barcode on the printed receipt) before a refund processes. Turning this on eliminates this entire category overnight.

10. Consistent small negative drawer variances by one cashier

The "$200 short" event is easy to spot. The dangerous pattern is the cashier whose drawer is consistently $3, $5, $8 short — small enough to dismiss as counting error, big enough to add up to $1,500–$3,000 a year per cashier.

What to watch:

• Cumulative variance by cashier over 30 days
• Sign of the variance (always-negative is worse than mixed)
• Variance correlated with no-sale or void counts

The honest cashier whose math is shaky will be over some days and short others, averaging close to zero. The dishonest cashier will be short almost every shift, by a deniable amount. Don't let small variances accumulate — the pattern is the evidence.

11. Late-night void clusters with no manager on shift

The combination that catches systematic skimmers. Voids alone are normal. Late-night activity alone is normal. But voids clustered in the last two hours, when the manager has already left, by the same cashier or pair — that's a pattern.

What to watch:

• Void count by hour of day, per cashier
• Voids during "manager not on shift" windows
• Cross-reference with cash variance for the same shift

This pattern often co-occurs with #1, #2, and #10. Two or three red flags overlapping on the same cashier jumps the priority from "monitor" to "investigate this week."

The Monday 15-minute fraud review

Controls catch nothing if no one looks at them. The cadence we recommend:

End of session: a list of 0–3 cashiers to watch this week, and 0–1 to coach. Most weeks the list is empty or one name long. The point of Monday cadence: catch the pattern in the first three weeks instead of finding out at annual inventory. For the broader weekly reporting routine, see /resources/blog/weekly-liquor-store-pos-reports.

What to do when you find something

A three-tier response framework. None of this is legal advice — talk to your employment attorney before formal action.

Tier 1 — Coaching conversation. One-off pattern, possibly a mistake or training gap. Sit down in a neutral setting. Frame around the pattern, not an accusation: "I'm seeing your void rate run about double the team average — walk me through how you handle a void." Listen. Document. Monitor for 30 days.

Tier 2 — Formal warning + active monitoring. Repeated pattern after coaching, or one pattern combined with other red flags. Written warning in the file. Increase monitoring. Pull camera footage on flagged transactions. Document everything.

Tier 3 — Termination + consider law enforcement. Pattern + dollar amount over your tolerance + documented evidence. Your employment attorney must be involved before you act. Termination procedures, restitution agreements, and any criminal referral have to be handled correctly the first time — bad termination of a documented theft case can cost more in wrongful-termination exposure than the theft itself.

The mistake owners make most often: confronting a cashier with an accusation based on a single report. The cashier denies, you have no documented pattern, the employee feels targeted, and either the fraud continues or the relationship is poisoned. Coach with patterns, escalate with documentation.

POS controls that prevent the patterns

The controls that turn each pattern into either a prevented-at-source event or an auto-flagged-for-review event:

Most modern POS systems support all of these as configuration options — the owner just has to turn them on. Generic retail POS often defaults to "off" for several of them because they add cashier friction. That friction is the entire point.

For the audit-trail compliance angle (what to log, how long to keep it, what auditors look for), see /resources/blog/liquor-store-audit-trails-pos-logs.

Where Lifelong fits

Every Lifelong POS install ships with forced void reason codes, manager-PIN-required actions, complete audit trails, and per-cashier reporting configured by default. The fraud-prevention controls are not an add-on, upgrade tier, or separate module — that's how we set up the system out of the box.

Merchants can request a free 30-minute setup call to walk through configuration: which thresholds to set for manager-PIN requirements, which reports to surface on the weekly dashboard, and how to layer in camera-DVR integration so flagged transactions are one click from the matching video. Current clients reach our team on demand via 20/7 phone and text support. Atlanta-based, 8 years in business, 500+ active merchants across all 50 states.

For the broader specialty retail solution overview, see our specialty & counter-culture retail POS.

FAQ

What's a healthy void rate?

Under 1% for general retail. Under 2% for high-touch verticals where mis-rings are more common (kava bars, restaurants with modifiers, vape with try-before-you-buy). A cashier consistently above 2% (general) or 3% (high-touch) is worth a closer look — not necessarily theft, but outside normal and worth a coaching conversation at minimum.

Should I confront a cashier directly when I see a red flag?

No. Confrontation based on a single report or hunch almost always backfires. The cashier denies, you have no documented pattern, and either the fraud continues or the relationship is damaged. Document the pattern over 2–4 weeks, coach with patterns rather than accusations, and involve your employment attorney before any formal action.

How long should I keep POS audit trail data?

Five years is the practical floor. State requirements vary — some require longer for age-verified sales, tax-relevant records, or controlled-substance-adjacent products. When in doubt, keep more. Storage is cheap; not having the record when you need it is expensive. Confirm with your CPA and state department of revenue for vertical-specific rules.

Do I need security cameras too?

Yes — but cameras alone don't catch register fraud. Cameras catch external shoplifting and after-hours intrusion. Register fraud happens during business hours through legitimate-looking transactions. You catch a void-and-pocket from the void report first, then use camera footage to confirm what happened. POS event timestamps integrated with camera DVR means the investigation is one click. Neither alone is enough.

What's the most common combination pattern you see?

Refund-without-receipt clusters plus end-of-shift voids on the same cashier. That combination signals systematic skimming — fake refunds extract cash from the drawer, end-of-shift voids balance the books. When we see both on the same employee, it moves directly from "monitor" to "investigate." A surprise mid-shift drawer count, in addition to the regular review cadence, often confirms the pattern within a week.