License plate data for repeat offenders across a chain

License plate data for repeat offenders: running a vehicle watch list across a chain

Spot AI reads license plates on the cameras a retail chain already owns, checks each plate against a watch list the loss prevention team controls, and lets investigators attach every hit to the case it belongs to. That turns license plate data for repeat offenders into an operating question rather than a technology one: which vehicles go on the list, who hears about a hit, how long the data lives, and what a detective receives. The question is getting sharper. In NRF's 2026 survey of senior loss prevention executives, 50% of retailers reported higher rates of repeat offenders and 40% reported more incidents tied to organized retail crime (Source: National Retail Federation).

This guide is the playbook for running that program the same way in every district. It starts where the read ends; how plate reading itself works is covered in our guide to how license plate recognition works.

What a vehicle watch list does across a chain

Spot AI turns the plate reads at every store into one searchable history, so a vehicle tied to a theft in one district is recognized when it pulls into a lot in another. Most store-level video has no vehicle memory: it records every arrival as a first visit, and nobody connects the sedan from last Tuesday's loss with the same sedan on Friday. Crews that work a district rely on that gap, because each store sees one small loss and no one sees the car.

A watch list closes the memory gap, and it has firm limits. It does three things well:

1. Recognizes a returning vehicle at any store with plate-ready cameras.
2. Links visits across stores into one timeline for an investigator.
3. Gives the store on duty a heads-up while the vehicle is still in the lot.

It cannot tell a store who is driving. Rental, borrowed and resold cars all put a plate in new hands, which is why the rules below place a person between every hit and every action. The list sits beside lot detections a chain may already run, such as car break-in detection in retail parking lots, rather than replacing them.

Where the plate reads come from

Spot AI reads plates from the cameras a store already owns, provided each one is set up for plate capture rather than for a wide view of the lot. A license plate recognition camera in this sense is a placement, not a product line, and Spot AI's camera setup guidance for license plate recognition spells out the conditions:

1. The plate passes within 15 feet of the camera, recorded at 1080p or higher.
2. The camera sits within 20 degrees of the plate. At 10 feet, it is no more than 3 feet above, below or to either side of it.
3. Vehicles move at 5 mph or less, so lot entrances and the spots where cars slow or stop work, and road-facing views do not.
4. The plate stays readable to a person in the dashboard for at least 2 full seconds.
5. Night and poor-weather reads need an infrared camera or an external infrared light, aimed away from oncoming headlights.
6. The camera faces the back of vehicles, because many states do not require a front plate.

Plate reading is switched on only for cameras that meet these conditions. A practical start is one entrance and one exit camera per store, adding lanes where the first month of reads shows vehicles getting past without a read.

What qualifies a vehicle for the watch list, and who approves it

Spot AI alerts on the plates a chain chooses to list, so the list is only as useful, and as fair, as the rules for getting on it. A plate goes on the list when all five of these are true:

1. It is tied to a documented incident with a case number: theft, organized theft, violence against staff, a trespass notice, or a ban from the property.
2. Video connects the vehicle to the incident, for example the people involved arriving or leaving in it, not a car that happened to be parked nearby.
3. A person has checked the plate read against the image, including the issuing state.
4. A second person, normally the district loss prevention manager, approves the entry. Whoever proposes a plate never approves it.
5. The entry carries a tier, a reason code, a response instruction and an expiry date.

Tiers keep a low-value theft from triggering the response a violent incident needs. The table below is a starting template; the expiry periods are examples to adjust with counsel, not norms.

Tier	Basis for the entry	Who is alerted	Store response	Example expiry
Tier 1	Violence or a weapon involved, or an active trespass notice	Store manager on duty and district LP	Follow the store safety plan, keep distance, LP decides on contacting law enforcement	12 months, reviewed every quarter
Tier 2	Linked to two or more incidents, or to an open organized retail crime case	District LP, with a heads-up to the store	Customer service presence near high-loss areas, LP reviews live video and documents the visit	6 months
Tier 3	One lower-value incident	No live alert, visits logged for review	None in the moment, LP reviews the week's visits	90 days

Former employees and banned visitors need one more signature. Unique Industries, a party goods manufacturer and distributor, uses Spot AI to flag the plates of people who were terminated or banned from the property, and the system sends an alert when that car shows back up on site. Entries like these rest on an HR or security decision rather than an incident, so the approval has to record who made that decision and when.

Removal matters as much as entry. Take a plate off when its case closes with no link to the vehicle, when a read proves wrong, when the vehicle turns out to be a rental or to have changed hands, and at expiry unless a new incident supports re-approval. Two patterns justify a closer look even without an entry: the same plate at three stores in one day, and repeated arrivals after closing. Both call for a video review by loss prevention, not a store alert.

Alert routing: who hears about a hit, and what they do

Spot AI sends a plate alert by email, text, Slack or Teams, so routing comes down to who acts on which tier and how fast someone acknowledges it. The tiers translate into routing like this:

Situation	Who receives it	First action
Tier 1 vehicle arrives	Store manager on duty and district LP	Verify the read, start the safety plan, LP decides on law enforcement contact
Tier 2 vehicle arrives	District LP, store heads-up	Verify the read, staff presence on the floor, LP documents the visit
Same listed vehicle at a second store that day	Regional LP	Pull the day's timeline across stores and brief the stores along the route
Tier 3 vehicle arrives	No live alert	Logged for the weekly review
Alert not acknowledged within 10 minutes	Next person on the LP rota	Take over the alert and note the gap for the routing review

Whoever receives a hit works through the same four steps in every store:

1. Verify the read: compare the image with the entry, including the state, the make and the color.
2. Open the entry and read its tier and response instruction.
3. Act as the tier says: presence and service, never a confrontation in the lot and never a pursuit.
4. Record the outcome on the case: what arrived, what happened, how the store responded.

Customer service presence is the default because it signals attention without treating anyone as a suspect. Deterrence works on behavior instead: Spot AI's strobes, horns and natural-conversation talkdown respond to what people do on the lot, such as loitering by parked cars, whether or not a plate is listed.

Retention and access rules for license plate data

Spot AI keeps full-resolution video on the Intelligent Video Recorder (IVR) inside each store and sends only metadata across the network, which leaves retention and access as policy the chain writes down before go-live. Most plates a store reads belong to ordinary customers, so routine reads and case evidence get different rules:

Data class	What it holds	Retention rule	Who can see it
Routine plate reads	Every plate read at every store	A short fixed window set with counsel, purged on schedule, never exported in bulk	Regional investigators, by case-linked search only
Watch list entries	Approved plates with tier, reason, case number and expiry	Until expiry or case closure, renewed only with a new incident	Store managers see their store's alerts, district LP sees the district
Plate evidence in a case	Reads, clips and images attached to a case	For the life of the case plus any legal hold	Case owner, assigned investigators, named external partners for that case
Audit log	Every search, export, share and list change	Longer than every other class	Loss prevention director and internal audit

Access follows least privilege, which NIST defines as restricting each user's access "to the minimum necessary to accomplish assigned tasks" (Source: NIST). In practice that means five rules:

• Store staff receive alerts for their own store and cannot search other stores.
• Searching reads across stores is a named-user right for investigators, and each search records the case it served.
• Exports and external shares need the case owner's approval, and each one is logged.
• Plate data serves loss prevention and safety only, never marketing, customer analytics or tracking employees outside an approved case.
• Every quarter, someone reviews the access list, removes expired and unverified watch list entries, and samples the audit log.

Retention windows and chain of custody for the footage itself are covered in our video retention and chain-of-custody guide. Plate reads need their own number in the same policy, agreed with counsel before the first store goes live.

Turning a hit into a case

Spot AI lets investigators search video by license plate across stores and attach what they find to a case, which is how a run of small losses becomes one documented pattern. A hit joins a case only when something happens during the visit, or when a pattern review links it to losses already reported. The work then runs in six steps:

1. Open or reopen the case, with an incident record built from a security incident report template so every store captures the same fields.
2. Attach the plate evidence: the read image, the arrival and departure clips, and the in-store clips that tie the people involved to the vehicle.
3. Search the plate across every store for the lookback window and attach each earlier visit that lines up with a reported loss.
4. Add the transaction side, such as refunds, voids or no-sale events during the visit, from POS exception reporting.
5. Summarize the pattern on one page: dates, stores, items, estimated values and the vehicle's description.
6. Pass the linked incidents into the process for connecting organized retail crime incidents across stores, where the cross-store total is built.

Spot AI's Cases keeps clips, annotations, documents and comments in one record with role-based access, so a case that began at one store can be worked by an investigator in another district. Finding the right footage quickly is what makes the lookback search practical, a point one Spot AI user made in a review:

"I like the fact that you can build a case to share with insurance companies. It's easy to navigate and with license plate recognition, incidents are much easier to find."

GM (Small-Business), Steve A.

Sharing plate evidence with law enforcement

Spot AI's case record lets loss prevention share one subject vehicle's case with law enforcement or an insurer, which is the right unit: a detective needs that vehicle's timeline, not access to every plate the chain has read. Many store thefts never reach them. NRF's 2026 survey found 63% of retailers report fewer than half of store theft incidents to law enforcement, citing low-dollar losses or not meeting felony thresholds (60%) and concerns about follow-through (54%) (Source: National Retail Federation). A plate-linked case speaks to the first objection, because it shows one vehicle across several incidents rather than a single small loss.

Many departments already work with plate data. In 2020, 21.8% of local police departments regularly used license plate readers, and those departments employed 65.4% of all local officers (Source: Bureau of Justice Statistics). Five rules keep sharing consistent across regions:

1. One named loss prevention contact per region shares cases and takes requests.
2. Share a case, never a login or a standing feed of reads.
3. Log every request and share: agency, officer, agency report number, date and what was shared.
4. Broad requests, such as every visit by a plate this year, arrive in writing with a case number and go to the loss prevention director.
5. Record the agency's report number on the case, so outcomes flow back into the program's numbers.

What goes inside the package, and how it differs for detectives, insurers and attorneys, is covered in our guide to video evidence packages for law enforcement, insurers and attorneys.

Measuring the watch list program across stores

Spot AI's reporting breaks detections down by agent, camera and location across days, weeks and months, which gives loss prevention the counts to judge whether the watch list is doing its job. Six measures cover it:

Measure	What it tells you	Review
Hits per store per week	Where listed vehicles actually return	Weekly
Verified match rate	The share of hits a person confirmed against the image. A low rate points at camera placement or weak entries	Weekly
Time from alert to acknowledgement	Whether routing reaches someone on duty	Weekly
Cases opened or linked from hits	Whether hits become evidence	Monthly
Cases accepted by law enforcement	Whether packages are complete enough to act on	Monthly
Entries expired or removed on schedule	Whether the list is kept clean	Quarterly

Roll the program out in waves. Start with three to five stores where vehicle-linked losses run highest, run them for 60 days against these measures, adjust tiers, camera placement and routing, then add the next district with the same rules.

From plate reads to cases a detective can use

Spot AI gives a chain the plate reads, the watch list alerts, the cross-store plate search and the case record, and the program built around them decides whether license plate data holds repeat offenders to account. Write the entry rules, tiers, routing and retention windows before the first store goes live, and treat every hit as the start of a verified case.

For how loss prevention teams run AI agents on the cameras they already own, from detection through deterrence to a documented case, read Spot AI's white paper, Turning Cameras Into Coworkers.

Frequently asked questions

How do retailers use license plate data to track repeat offenders?

Spot AI reads plates at store entrances, checks each one against a watch list the chain builds from documented incidents, and alerts the people assigned to that entry's tier. Investigators can also search a plate across every store to connect earlier visits with reported losses. A person verifies every hit first, because a plate identifies a vehicle rather than a driver.

Who should approve adding a vehicle to a watch list?

Spot AI alerts on whatever plates a chain lists, so approval should sit with a second person, usually the district loss prevention manager, never with the investigator who proposed the entry. Plates belonging to former employees or banned visitors also need sign-off from HR or security.

How long should license plate data be kept?

Spot AI keeps full-resolution video on the in-store IVR, and the chain decides how long each kind of plate data lives. Routine reads of ordinary vehicles warrant the shortest window, agreed with counsel, while plate evidence stays with its open case and the audit log outlasts both.

Should store staff approach someone whose vehicle is on the watch list?

Spot AI flags the vehicle, not the person, so the default store response is customer service presence and documentation, never a confrontation or a chase into the lot. A rental or borrowed car can carry a listed plate with an unrelated driver at the wheel.

What should a retailer share with law enforcement from plate data?

Spot AI's case record lets a retailer share one case per subject vehicle: its plate reads, clips, images and incident records, rather than access to the chain's full history of reads. A named loss prevention contact in each region handles shares and requests. Each share is logged with the agency, officer and report number, and broad search requests come in writing.

About the author

Joshua Foster is an IT Systems Engineer at Spot AI, where he focuses on designing and securing scalable enterprise networks, managing cloud-integrated infrastructure, and automating system workflows to enhance operational efficiency. He is passionate about cross-functional collaboration and takes pride in delivering robust technical solutions that empower both the Spot AI team and its customers.