Cash register theft in 2026: how to detect, document, and resolve losses at the till
Cash register theft rarely shows up as one large loss. It arrives as small amounts moved through voids, refunds, no-sale openings, and unscanned items, spread across shifts and logins until a closeout count comes up short. ECR Retail Loss researchers estimate that, at best, retailers detect and close just 2% of employee theft cases, even with exception-based analytics in place (Source: ECR Retail Loss).
Spot AI links each flagged till transaction to the clip from the camera over that register, which turns a short drawer into a question an investigator can answer. This guide covers the three stages that close a till case: detect, document, and resolve.
Key takeaways
- A short drawer proves cash is missing, not who took it: shared logins, shift handovers, and cash pickups all fold into one closeout number.
- Point-of-sale reconciliation flags a pattern only once it repeats, often weeks after the first event and sometimes after the footage is overwritten.
- Spot AI attaches the register clip to flagged refunds and to transactions rung with no customer present, so investigators review a handful of clips instead of a shift of video.
- A case file that holds up carries the transaction records, the paired clips, the clock offset, a chain-of-custody log, and the associate's own account.
- Spot AI customer All Star Elite, an 80-store apparel retailer, reports cash shrink down from 6% to 1% after moving video, cases, and search onto one Spot AI system.
Key terms
- Sweethearting: an associate lets items pass unscanned, or rings them at a lower price, for a friend, relative, or coworker.
- Post-payment void: a sale cancelled after the customer has paid. It is routine while the customer is still at the counter and a theft method once they have left, with cash taken from the drawer to match.
- Exception-based reporting (EBR): software that mines POS data for transactions outside policy or peer norms, such as high void counts or no-receipt refunds, and lists them for review.
- Transaction-linked video: Spot AI pulls the clip from the register camera at the timestamp of each flagged transaction, so the record and the footage are reviewed side by side.
What cash register theft looks like at a single register
Consider one register across one week. Four associates log in to it, a manager takes cash twice to make change, the evening shift takes over without a recount, and hundreds of transactions post. At the Sunday closeout, the drawer comes up short.
That variance is the whole record: it says the store lost cash, and nothing about which shift, transaction, or hand. NRF's 2023 National Retail Security Survey, which put FY2022 retail shrink at about $112.1 billion, names merchandise theft, refund fraud, cash/deposit theft, and passing off merchandise to friends (sweethearting, sliding, and free bagging) as the top four methods of internal theft (Source: National Retail Federation). A camera recording the counter sees these happen at the till and flags none of them, because each looks like ordinary register work.
That national total is one of two figures that frame the scale. The other is a per-store anchor from Spot AI's August 2026 retail material: at one anonymized $5 billion retailer, deterring after-hours incidents such as dumping, dumpster fires, and vandalism saved an estimated $20,000 per incident, per store. That is an estimate rather than a verified result, counted per incident and never per month.
Till theft rarely arrives in incidents that size. It arrives as many small events that each look routine, which is why counting loss one incident at a time keeps missing it.
Why a short drawer does not tell you which shift or which employee
A closeout count is one number for a whole period, and every hand that touched the drawer sits inside it. Shared logins, change runs, cash pickups, and a handover without a recount all land in the same variance. In an ECR Retail Loss study of 74 staff dishonesty cases at four retailers in the UK and the Netherlands, the till was the scene of 68 of the 99 documented dishonest events, and offenders expected their thefts to be "lost in the sea of transactions and interchanges of operators" (Source: ECR Retail Loss). Shared till PINs, tills left logged in, and irregular till checks are what give that sea its cover.
The same blur works against honest associates. Miscounted change, a cash sale keyed as card, or an unrecorded void can each leave a drawer short. The people sharing a drawer also change constantly: the U.S. Bureau of Labor Statistics projects about 521,300 cashier openings a year from 2025 to 2035, all to replace workers who leave the occupation (Source: U.S. Bureau of Labor Statistics). When the variance is the only evidence, everyone on the shift sits under the same suspicion.
Video connects a discrepancy to a specific transaction and a specific person. The clip settles the question in both directions: it confirms a problem when there is one, and it clears everyone who was never near the drawer.
Why point-of-sale reconciliation starts the investigation weeks late
Reconciliation finds variance, and variance needs repetition before it looks like anything. One void is normal, and so is one no-receipt refund. A login stands out only after its voids or refunds climb above its peers across enough shifts, so the first event is weeks old when the pattern appears.
The lag builds in three places:
- The count. Drawers are reconciled at the end of a shift or day, so a variance arrives with no transaction attached.
- The report. An exception report that runs weekly or at month-end aggregates the period before anyone reads it.
- The request. Once someone reads it, the footage still has to be found and reviewed one transaction at a time.
Time also works against the evidence. Recorders overwrite their oldest footage once storage fills, and NIST's Organization of Scientific Area Committees (OSAC) notes that when a system's earliest recording is seven days old, an incident's footage may last only seven days (Source: NIST). By the time a monthly report flags a login, the clips for its first events can be gone.
Exception reports still earn their place as a starting list, and this guide to exception-based reporting explains how they pair with video. The fix is to shorten the distance between the report and the clip.
Detect: what the camera layer shows at the till that a report cannot
Detection at the till works when the transaction and the video are read together at the moment of the event. Spot AI connects to the point-of-sale system and pairs each flagged transaction with the clip from the camera over that register, on the cameras a store already owns. Most POS fraud at the till fits one of these rows:
Till event | What the POS report shows | What the camera layer shows or flags |
|---|---|---|
Refund with no customer at the counter | A refund line, often with no receipt, in an exception summary days later | Spot AI pairs the refund with the register clip and flags that nobody was at the counter |
Void after the customer paid and left | A cancelled sale; the drawer balances, so it stands out only once void counts run above peers | The clip shows whether the customer had already left with the goods |
No-sale drawer opening | A no-sale count per login, with no amount attached | The clip shows what happened in the open drawer: change for a customer, a pickup, or cash leaving the till |
Items passed around the scanner (sweethearting) | Nothing: an unscanned item leaves no line, only a smaller basket | The paired clip shows items moving from counter to bag with no matching scan |
Override on a manager code | An override line under the manager's code | The clip shows whether a manager was at the register, which exposes shared codes |
Cash taken for a sale never rung | Nothing, and a balanced drawer if the cash never went in | Spot AI's cash-handling detections, in beta or custom-built per customer, can flag cash going somewhere other than the drawer |
Walk-through at self-checkout | An unpaid or abandoned transaction, or nothing at all if no item was scanned | Spot AI flags self-checkout walk-throughs, where a shopper leaves with items that were never paid for |
Transactions on someone else's login | Every transaction filed under the logged-in ID | The clip shows who actually stood at the register when each one posted |
Spot AI's POS integration for refund fraud and transactions with no customer present is live. Cash-handling detections are not: visual cash pocketing is in beta, and cash register theft detection is custom-built per customer. For anything store-specific, Iris builds a custom detection from a plain-language description in about eight minutes.
Camera placement decides what a clip can answer. Aim the register camera at the drawer, the counter, and the bagging area, which shows who is at the till and where the cash goes while keeping the PIN pad out of frame. Spot AI's Intelligent Video Recorder (IVR) keeps that full-resolution footage on site and sends only metadata across the network, which keeps register coverage PCI-clean.
Start with the two till events a report handles worst: refunds with no customer present and voids keyed after the customer has left. Both look routine in the record, and one clip showing who stood at the counter settles either.
Skip-scanning at self-checkout
Self-checkout moves the scan to the customer, and the same logic holds. A weight check catches an unscanned item only when the bag weighs wrong, and it cannot tell a deliberate miss from a barcode that failed to read. Reviewing the paired clip shows whether an item reached the bag unscanned, and Spot AI flags self-checkout walk-throughs, where a shopper leaves without paying. Many misses are honest mistakes, so the first response should be an assist, such as a rescan prompt or a staff check, rather than an accusation.
Document: build a case file that holds up
A till case stands or falls on its file: a record someone outside loss prevention can follow without the investigator in the room. A complete file holds:
- The trigger: the exception or count variance that opened the case, with its date and register.
- The transaction records: the POS journal entry for each event, with login IDs and timestamps.
- The paired clips: one per transaction, exported in the recorder's original format with its player, with the master copy kept untouched.
- The clock offset: the gap between the POS clock, the recorder, and real time. NIST's OSAC guidance says any discrepancy between system time and real time should be recorded, and that a camera's own clock can differ from the recorder's (Source: NIST).
- The pattern: every related event across dates and shifts, including the legitimate ones.
- The innocent explanations checked: manager approvals, returning customers, training records, and other users of the login.
- The chain of custody: who exported each clip, when, and every hand it has passed through.
- The associate's account: in their own words, added at the interview stage.
Spot AI builds much of that file as it goes. Its case workflow attaches clips to each case, lets investigators annotate them, and shares the file with the people who need it. AI search finds footage by time, register, or what appears in the frame. Teams comparing case management and exception tools can weigh the options in this roundup of retail loss prevention software.
Resolve: hand the case file to the right owner
A finished file goes to one of four owners, and the evidence decides which:
- Store operations, for a process gap such as shared PINs, a skipped recount, or a new associate who needs coaching.
- HR and employment counsel, when the file points to deliberate theft and an employment decision is next.
- Law enforcement, when the loss and the evidence justify a report the business will pursue.
- The insurer, when the loss supports a claim under an employee dishonesty or crime policy.
Reporting is where many till cases stall. In NRF's 2026 theft and violence survey, 63% of retailers said they report fewer than half of store theft incidents to law enforcement, and 60% cited low-dollar losses or not meeting felony thresholds as a reason (Source: National Retail Federation). A single short drawer rarely clears that bar. A documented pattern tied to transactions and clips gives counsel or law enforcement something to act on.
Keep the handoff as fair as the file. Hold any conversation off the sales floor with HR present, and let the associate explain before a decision is made. Apply the same standard to everyone who used that register. A case built that way carries more weight with counsel and protects the associates the evidence cleared. Till controls are one layer of a wider retail loss prevention program, and the same handoff rules apply to cases from the stockroom or the lot.
Before any conversation with an associate, check the file for the innocent explanation first: a manager-approved void, a customer who came back, or a miscount at a shift handover. A file that has ruled those out is fairer to the associate and stronger with HR, counsel, or law enforcement.
How All Star Elite cut cash shrink from 6% to 1%
Spot AI customer All Star Elite, an 80-store sports jerseys and apparel retailer in U.S. shopping centers, cut cash shrink from 6% to 1% and merchandise shrink from between 10% and 15% to about 6%. Its investigations had lived in spreadsheets and notes apps. The team moved them into one case system that attaches video to every case, and it used AI search to find incidents in minutes instead of hours.
Investigations now run more than 50% faster, and law enforcement case timelines fell from two to three months to one month, as the All Star Elite customer story details. The outcomes are customer-reported, and the story credits them to moving video, cases, and search onto one Spot AI system rather than any single detection.
Deterrence at the till comes from controls associates can see
Spot AI's retail workflow runs detect, deter, investigate, and resolve. At the till, deterrence does not come from talkdown or strobes, which belong on the forecourt and in the lot. It comes from controls associates can see, and from telling them plainly how the register is reviewed, which removes the cover a sea of transactions seems to offer. Effective controls include:
- One drawer per associate per shift, counted in and counted out.
- Individual logins that are never shared, and tills that log off when their associate steps away.
- A blind recount at each shift change by someone other than the associate who ran the drawer.
- Manager sign-off on refunds, voids, and overrides above a set amount, with manager codes kept by managers.
- Unannounced drawer counts during the shift, not only at close.
- A written policy, shared at onboarding, on how the register is reviewed and how a discrepancy is investigated.
None of these controls assumes anyone is stealing. They shrink the number of hands on each drawer, which makes an honest associate's count easy to verify. Stores that run one associate overnight feel this most, and this guide to convenience store security cameras looks at the counter and the forecourt together.
Considerations and limitations
Transaction-linked video narrows an investigation; it does not replace judgment. Keep these limits in view:
- Video shows actions, not intent. A clip can show cash leaving the drawer, while the associate's account and the pattern explain why.
- Coverage sets the ceiling. A camera that cannot see the drawer cannot answer a drawer question, so check register angles first.
- Thresholds need tuning. Set too tight, they send investigators after routine voids; set too loose, they let a pattern run for months. Start from each store's own history.
- Beta capabilities earn trust gradually. Run cash-handling detections alongside existing controls until a store has seen them work on its own footage.
- Legal rules differ by state. Audio recording at the register and employee interviews both carry state-specific rules, so review them with counsel before rollout.
If your team still matches exception reports to footage by hand, book a demo to see Spot AI tie till transactions to clips on the cameras you already have. The All Star Elite story shows what moving cases, clips, and search into one system looked like across 80 stores.
Frequently asked questions
What is sweethearting at the cash register?
Sweethearting is theft by favor: an associate skips scanning items, or keys a lower price, for someone they know. Two signs point to it before any video is pulled: the same customer repeatedly choosing one associate's lane, and baskets from that pairing that ring up well below similar baskets elsewhere. The clip then confirms it by showing items going into the bag that never reached the scanner.
Is a cash drawer shortage always a sign of employee theft?
No. Miscounted change, a cash sale keyed as card, an unlogged cash pickup, or a void entered to fix an honest mistake can each leave a drawer short. Shortages that follow one login across different shifts and registers deserve a closer look, while a single short count on a busy day rarely does. Recount the drawer and check the pickup log before drawing any conclusion.
How do you find out which employee is stealing from the register?
Remove the blur first: give every associate a unique login and their own drawer, so each variance belongs to one person's shift. Then compare over and short results by associate across several weeks, and pull the clips for that associate's refunds, voids, and no-sale openings. Review everyone who shared the register the same way, because the evidence that confirms one person also clears the others.
What should you do first when you suspect register theft?
Preserve the evidence: export the clips for the suspect transactions now, before the recorder overwrites them, and note the clock offset. Do not confront the associate on the floor or discuss the case with coworkers, because an accusation made before the file is complete is unfair to the associate and weakens the case. Then bring in HR, and involve employment counsel before any interview.
How does Spot AI help detect cash register theft?
Spot AI reads the point-of-sale feed and the register camera together, so a refund or sale rung with no customer present arrives with its clip attached. Most sites go live in days, because the software works on the IP cameras already installed with no rip-and-replace. The platform is NDAA-compliant and follows SOC 2 practices. A practical rollout starts with the stores that have the worst over and short history and with two event types.
About the author
Sud Bhatija is COO and Co-founder at Spot AI, where he scales operations and GTM strategy to deliver video AI that helps operations, safety, and security teams boost productivity and reduce incidents across industries.