Securing BOPIS and curbside pickup against fraud and theft in 2026
Buy online, pick up in store (BOPIS) and curbside pickup are now permanent fixtures of retail, and they have quietly rewritten the loss picture. Every order that starts on a website, waits in a back-of-house staging area, and ends at a car window opens a new seam that organized retail crime (ORC) groups probe fast. Retailers reported an 18% jump in the average number of shoplifting incidents in 2024 versus 2023, and 55% said ORC groups drove increases in digital and ecommerce fraud. (Source: NRF) For a director or VP of loss prevention, the job is no longer to document a loss after the fact. It is to deter it while it unfolds, using the cameras your stores already own as an active partner rather than a passive archive.
Key takeaways
- BOPIS and curbside pickup add three high-risk zones (digital ordering, back-of-house staging, and the vehicle-side handoff) that legacy cameras were never designed to cover.
- Fraud is shifting from the sales floor to the fulfillment layer: returns fraud, account takeover, and AI-assisted synthetic identity now target the ambiguity of hybrid pickup.
- Spot AI turns the cameras a store already owns into AI coworkers under an AI Security Guard model that detects intent, deters in real time, and packages case-ready evidence.
- Tying video to point-of-sale and order data creates exception-based reporting, so teams review flagged events instead of scrubbing hours of footage.
- All Star Elite cut cash shrink from about 6% to 1% and sped investigations by more than 50% after unifying cameras, cases, and analytics on Spot AI.
Why BOPIS and curbside pickup widen the loss surface
Securing hybrid fulfillment starts with understanding why it creates risk in the first place. These models are economically vital, yet the speed required to fulfill an order creates friction points where security steps get skipped. Criminological research describes three elements behind most theft: desire, ability, and opportunity. You cannot control a person's desire or ability, but you can shrink the opportunity, and BOPIS workflows tend to multiply it.
Four operational gaps show up again and again across store formats:
- Inventory accuracy failures: when website stock does not match the shelf, fraudsters exploit the gap, claiming they collected items that were never available and forcing chargeback disputes that are hard to refute without precise evidence.
- Staging area blind spots: orders are often staged in busy backrooms. Without tight access control, those areas become prime targets for internal theft.
- Handoff documentation gaps: the point of transfer is the most exposed moment. Many retailers still confirm identity by asking for a name, with no ID check and no timestamped record of the exchange.
- Curbside payment risk: payments taken vehicle-side on a mobile device lack the controlled setting of a fixed register, widening the window for card and refund abuse.
Emerging fraud typologies at the curb and counter
As retailers harden the sales floor, criminals pivot to the ambiguity of hybrid fulfillment. Three patterns are growing fastest, and each one exploits a different weak point in the BOPIS chain.
Returns fraud and friendly fraud
Returns are a structural drain on margin. Total US retail returns are projected to reach $849.9 billion in 2025, and an estimated 19.3% of online sales will be sent back. (Source: NRF) Roughly 9% of all returns are fraudulent, with retailers reporting increases in overstated-quantity returns (71%), empty-box or "box of rocks" returns (65%), and decoy or counterfeit returns (64%). (Source: NRF) In a BOPIS context, this often shows up as a claim that an item was missing or damaged during a curbside handoff that no one documented.
Account takeover and synthetic identity
When the pickup is remote, the identity check is the control that matters, and it is under pressure. In a recent study, 83% of organizations faced at least one account takeover attack in the past year, giving criminals working credentials to place orders in a legitimate shopper's name. (Source: Security Magazine) The forgery side is escalating too: AI-assisted document forgery rose to 2% of all fake documents identified in 2025, up from near zero the year before, and deepfake attacks are roughly doubling every six months. (Source: World Economic Forum) Untrained staff waving through a convincing fake ID at the curb is now a realistic path to a high-value order walking off.
Internal theft and collusion
Not all loss walks in the front door. In BOPIS models, an associate can mark an item as picked and divert it, or collude with an accomplice to hand off unpaid merchandise at the curb. Sweethearting, where staff pass extra goods to a friend, is especially hard to catch without video tied to the transaction. The table below maps the three curbside fraud types to how they present and where video AI helps most.
Fraud type | How it presents in BOPIS or curbside | Where video AI helps |
|---|---|---|
Friendly and returns fraud | Claims of non-receipt, empty-box returns, or damage disputed at the handoff | Timestamped visual record of the exchange tied to the order and transaction |
Account takeover | Orders placed on stolen credentials, collected by someone other than the buyer | Attribute search to locate the collector and vehicle, supporting ID-check policy |
Synthetic and forged identity | AI-generated or altered IDs used to collect high-value orders | Evidence trail for step-up verification on flagged high-value pickups |
Internal theft and sweethearting | Items marked picked but diverted, or extra goods passed at the curb | No-go-zone alerts in staging plus exception-based reporting on pick and handoff |
How Video AI Agents reduce BOPIS and curbside loss
Unlike a passive camera, a video AI platform reads context and acts while an event is happening. Under an AI Security Guard model, Spot AI follows a simple flow: detect the behavior that matters, notify the right person, and deter in seconds. Here is how that maps to the four pain points loss prevention teams feel most in hybrid fulfillment.
From reactive recording to proactive deterrence
Traditional systems document theft after it happens, by which point the inventory is gone. Video AI Agents such as loitering and person-enters-no-go-zone read suspicious behavior in staging and curbside zones in real time, so a team can intervene earlier and deter the loss rather than review it later.
Cutting alert fatigue
Legacy motion alerts bury teams in noise, and a wind-blown branch trains people to ignore the very notifications that matter. Context-aware retail video analytics filter that noise, so when an alert fires about someone entering a BOPIS storage cage, it is a verified event worth acting on.
Closing the omnichannel fraud gap
BOPIS creates fraud vectors that a wall of monitors cannot see, from friendly fraud at the curb to quiet shrink in staging. Agents like vehicle-enters-no-go-zone watch curbside lanes, while unattended-workstation alerts keep pickup counters staffed at peak, closing the openings that opportunistic theft relies on.
Faster, defensible investigations
Investigating a non-receipt claim once meant reviewing four to eight hours of footage. The Intelligent Video Recorder (IVR) and AI search collapse that to minutes: search for a red vehicle at a curbside bay or a person in a specific color in the staging area and jump straight to the clip. All Star Elite, a retailer running 80 stores, put this to work by centralizing case management and using AI search. The company reduced cash shrink from about 6% to 1% (an 83% reduction), cut merchandise shrink to roughly 6%, and sped investigations by more than 50%, all customer-reported outcomes from unifying cameras, cases, and analytics on Spot AI.
The fastest ROI in BOPIS security is usually investigation time, not headcount. When AI search returns the right clip in minutes instead of hours, a lean loss prevention team can close disputed returns and non-receipt claims defensibly, which is how All Star Elite sped investigations by more than 50% on its existing team.
The capabilities below map common BOPIS pain points to the video AI response and the outcome a loss prevention leader can expect.
Operational pain point | Video AI response | Business outcome |
|---|---|---|
Internal theft in staging | Person enters no-go zones | Detects unauthorized staff entering secure cages during off-hours |
Curbside confusion or theft | Vehicle tracking and loitering | Identifies vehicles dwelling in pickup zones without an active order |
Unstaffed pickup desks | Unattended workstation | Alerts management when the BOPIS counter is left unmanned |
Slow fraud investigation | Attribute search | Finds a red pickup truck or a person in a blue hoodie in seconds |
Securing the curbside handoff: camera placement and process
Effective loss prevention here is layered: physical setup, process discipline, and video AI working together. The curbside lane is the hardest zone to control because there are no walls, so placement and verification carry more weight than anywhere else in the store.
Multi-factor identity verification
An order number alone is not enough. Strong BOPIS verification uses more than one signal:
- Digital confirmation: require the shopper to authenticate through an SMS or app notification on arrival.
- Physical ID check: for high-value orders, train staff to match a government-issued ID to the order name before release.
- Visual record: use video AI to capture the exchange, creating a timestamped record of the customer receiving the goods.
Hardening the staging zone
Segregate BOPIS inventory from general backstock so orders are not accidentally sold or misplaced, and cover the high-value staging cage with person-enters-no-go-zone analytics that alert when unauthorized personnel step in. Pairing this with consistent SOP practices keeps the pick-to-handoff chain of custody intact.
Curbside camera placement that holds up as evidence
Getting the curbside lane right is mostly about angles and coverage:
- Designated, marked bays: clearly signed pickup bays keep vehicles in predictable positions that a fixed camera can frame cleanly.
- License plate recognition: parking-lot cameras with license plate recognition tie a vehicle to an order and flag repeat plates of interest without specialized hardware.
- Overlapping fields of view: position cameras so the bay, the vehicle, and the associate are all in frame, which is what makes footage usable when a handoff is later disputed.
- Dwell and wait-time awareness: monitor wait times and dwell, since long waits create the confusion fraudsters exploit and flag vehicles loitering with no active order.
- Payment discipline: under PCI DSS v4.0.1, future-dated requirements became mandatory on 31 March 2025, adding client-side controls that apply to the mobile devices used to take card payments at the curb. Keep those devices in scope and current.
Outdoor deterrence is where autonomous monitoring proves its value, because a parking area rarely has someone watching it. A top-five North American EV charging network applied the same detect-and-deter approach to protect unstaffed outdoor sites from theft.
Treat every curbside bay as an evidence zone, not just a convenience. Marked bays, overlapping camera angles, and license plate recognition together turn a disputed handoff into a timestamped record you can resolve quickly, which is the same visibility that lets outdoor sites deter theft without a person watching the lot.
Integrating video with POS and inventory data
The strongest programs connect video to the point-of-sale (POS) and order management systems. By correlating footage with transaction and order logs, retailers surface phantom pickups (orders marked complete with no matching vehicle) and register-side abuse, and they generate exception-based reporting so analysts review only flagged events. Spot AI's open POS integration and its broader video AI platform make that link practical across many sites. The comparison below shows why a modern, camera-agnostic approach outperforms legacy options for hybrid fulfillment.
Feature | Spot AI | Traditional camera systems | Manned guard services |
|---|---|---|---|
Deployment speed | Works with the cameras a store already owns, live quickly | Slow, often needs new cabling and hardware | Variable, depends on staffing availability |
Incident detection | Real-time AI alerts for specific behaviors | Reactive, passive recording needs manual review | Active but limited, guards cannot watch every zone |
Investigation time | AI search returns the right clip in minutes | Hours of manual footage review | Depends on guard notes and recall |
Total cost of ownership | Uses existing hardware with transparent pricing | High maintenance and storage hardware costs | Very high recurring labor cost |
Key terms
- BOPIS: buy online, pick up in store, a fulfillment model where a shopper orders online and collects the goods at a physical location or curbside.
- Friendly fraud: a chargeback or refund claim from a real customer who did in fact receive the order, often disputing a curbside handoff that was never documented.
- Account takeover: a fraudster using stolen credentials to access a shopper's account and place orders in that person's name.
- Sweethearting: an employee passing extra or unpaid merchandise to an accomplice, frequently at a low-visibility handoff point.
Securing hybrid fulfillment is not a single tool, it is a layered program: tighter SOPs, rigorous identity verification, and video AI that turns footage into action. See how Spot AI turns the cameras you already own into an AI Security Guard for your BOPIS and curbside operations. Book a demo to see it in action.
Frequently asked questions
What are the best practices for securing BOPIS transactions?
Use multi-factor identity verification at pickup, segregate BOPIS inventory in a monitored staging zone, and use video AI to keep a timestamped record of the chain of custody from picking to handoff. Real-time inventory synchronization also reduces the stock disputes that fraudsters exploit.
How can retailers reduce fraud in curbside pickup?
Retailers can deter curbside fraud with vehicle-side verification on mobile POS devices, clearly marked bays covered by video AI, and staff trained to confirm identity before releasing goods. Tracking vehicle arrival and dwell time also flags suspicious activity for review.
What technologies are effective for BOPIS loss mitigation?
Effective tools include video AI for real-time incident detection, license plate recognition to tie vehicles to orders, and POS or order-management integration that correlates transaction data with video evidence. Identity verification that checks government IDs is critical for high-value pickups.
How does identity verification improve BOPIS security?
Identity verification confirms that the person collecting an order is the legitimate purchaser. Pairing an ID check with a timestamped video record helps flag discrepancies between the collector and the order, which reduces account takeover and unauthorized collections.
What compliance requirements apply to BOPIS and curbside operations?
Retailers must follow PCI DSS for secure payment processing, including encryption of cardholder data across online and curbside transactions. Future-dated PCI DSS v4.0.1 requirements became mandatory on 31 March 2025 and place added emphasis on client-side controls for devices used in curbside environments.
About the author
Sud Bhatija is COO and Co-founder at Spot AI, where he scales operations and GTM strategy to deliver video AI that helps operations, safety, and security teams boost productivity and reduce incidents across industries.
