5 Employee Theft Warning Signs Owners Miss

Most small business owners do not miss employee theft because they aren't paying attention. They miss it because the warning signs do not look like theft. They look like quirks. Personality. A bad shift. A coincidence. A trusted employee who just prefers to handle the deposit.

After more than two decades working investigations, behavioral analysis, and loss prevention across retail and small business environments — and millions of dollars worth of documented loss and risk reduction along the way — one observation is consistent:

Most employee theft cases show warning signs long before anyone catches the person responsible.

Trusted employees can still become theft risks. Tenure does not equal immunity. In nearly every internal theft case I have seen, the person responsible was someone the owner trusted — and that trust is exactly what made the warning signs easy to dismiss.

Small businesses are especially vulnerable. There is rarely a dedicated loss prevention team. Owners wear ten hats. Cameras may not be reviewed. Audits are inconsistent. Documentation is informal. The operational environment quietly teaches employees that nobody is really watching — and over time, a small percentage of people will test that.

The five warning signs below are not accusations. They are the observations that, in pattern, surface most internal theft cases before the financial damage becomes severe.

1. Inventory losses without a clear explanation

Recurring shortages are the most overlooked warning sign in small business. A miscount happens. A bad delivery happens. One bad cycle count is noise. But when the same product, the same category, or the same location keeps coming up short — and nobody can explain it — that is no longer noise. That is a signal.

What to watch for:

• The same SKUs going short repeatedly, especially high-value or easily concealed items.
• Inventory counts that "improve" when a specific person is not working.
• Counting discrepancies between shifts, locations, or managers.
• "Damaged" or "write-off" volume that exceeds what the business actually generates.
• Missing merchandise that nobody remembers receiving — or selling.

Unexplained shrink does not always mean theft. It can mean receiving errors, vendor shortages, poor process, or honest miscounts. But repeated unexplained shrink — concentrated around a person, a shift, or a product — deserves attention, not dismissal.

2. Employees who resist accountability

Honest employees generally accept oversight quickly because oversight does not threaten them. Resistance to accountability is the second most common warning sign in internal theft cases, and it tends to look like this:

• Defensive reactions to routine questions ("why was this voided?").
• Pushback when their drawer is counted by someone else.
• Friction around audits, second sets of eyes, or camera coverage.
• Complaints about controls being "unnecessary" or "insulting."
• Avoiding documentation — blank logs, unsigned counts, missing notes.

3. Unusual register activity

Cash and register theft is the most common form of internal theft in small business — not because employees are dishonest by nature, but because the register is where opportunity, speed, and ambiguity intersect. The transaction warning signs are predictable:

• Excessive voids — especially after the sale, especially without a customer present.
• Refunds without a corresponding return — or refunds processed at odd hours.
• No-sale transactions — opening the drawer with no sale recorded.
• Repeated cash shortages — or, equally suspicious, repeated cash overages that "smooth out" over time.
• Transaction irregularities — short rings, missing line items, manager overrides on a single person's shifts.

Routine till audits — even short, simple, written ones — make most of this visible quickly. Theft at the register survives because nobody looks. The moment someone consistently does, the behavior almost always changes. That alone is information.

If running till audits manually becomes difficult, My LP Portal includes a built-in till audit tool with a downloadable till audit sheet you can print today.

4. Sudden changes in behavior

From a behavioral-analysis perspective, internal theft is rarely a single decision. It is a sequence of small decisions, each one tested against the environment. Every test produces behavioral evidence — and the most visible evidence is change.

The behaviors that show up most often:

• Secrecy — withdrawing, working alone, going quiet around management.
• Nervousness — visible stress around audits, deposits, or conversations that used to be routine.
• Territorial behavior — insisting on handling specific tasks themselves (deposits, end-of-day, returns, inventory).
• Avoiding management — schedule changes designed to minimize overlap, or pushback on coverage that would put someone else on the same shift.
• Unusual schedule preferences — repeatedly volunteering for the closing shift, the unsupervised shift, or the inventory shift.
• Refusing assistance — declining help with tasks that would normally be welcome.

No single behavior proves theft. People go through hard seasons. Stress at home shows up at work. The relevant question is never "is this one moment suspicious?" — it is "are several of these things clustering on the same person, around the same processes, over the same window of time?" That is when behavior becomes pattern.

One observation is a moment. Five observations on the same person is a story.

5. Employees living beyond their known means

This warning sign requires the most care, because it is the easiest to misuse. People's financial lives are not always visible to their employer. A new vehicle could be a co-signed loan. Expensive purchases could be a tax refund, an inheritance, a partner's income, or a second job.

What matters here is objectivity. The signal is not "this person bought something nice." The signal is sudden, sustained, unexplained spending that does not reconcile with the role — and that appears in the same timeframe as other warning signs above.

• Sudden lifestyle upgrades without a disclosed explanation.
• Visible spending patterns that do not match wages.
• Frequent expensive purchases or travel that appear shortly after access to cash, deposits, or inventory expands.

What small business owners should actually do

Noticing warning signs is the first half. The second half is building a quiet operational environment that surfaces them consistently — without turning the workplace into a surveillance state. The practical fundamentals:

Inventory audits

Cycle counts on a defined schedule, with high-shrink categories counted more often. Counts performed by someone other than the person responsible for ordering or receiving.

Till audits

Short, written, repeatable. The goal is not to catch — the goal is for employees to know that the count happens. Most cash theft does not survive consistent till audits.

Documentation

A coaching log. An incident log. A behavioral observation log. Factual, dated, initialed entries — not gossip. Most "we never saw it coming" theft cases were, in fact, seen — they simply were not recorded.

Incident tracking

Every operational concern — voids, refunds, missing money, customer complaints about transactions, inventory variances — needs to land in one searchable place. Scattered information hides patterns. Centralized information surfaces them.

Opening and closing procedures

The two highest-risk windows of any shift. Written procedures, two people whenever possible, deposit verification, and signed confirmation. This single change alone reduces a meaningful share of small-business cash loss.

Accountability systems

Separation of duties wherever realistic. The person who runs the deposit should not be the only one who reconciles it. The person who voids the sale should not be the only one who knows it happened. Honest employees benefit from this structure more than anyone — it protects them from suspicion when something goes wrong.

Behavioral awareness

Train managers to notice, document, and review. Not to accuse, not to confront, and never to discuss suspicions with coworkers. The job is to see — and to record what they see.

The goal is not suspicion. The goal is visibility.

The point of recognizing warning signs is not to make owners suspicious of their employees. The vast majority of employees are honest, hardworking, and proud of the businesses they help run.

The point is visibility. Without it, problems grow quietly, honest employees end up under unfair suspicion when something goes wrong, and the few people exploiting the operational cracks go undetected long enough to do real damage.

With it, patterns surface early. Honest employees are protected. Owners stop reacting after the loss — and start preventing it before it compounds.

You can't protect what you can't see.

The five warning signs above are not a checklist for catching thieves. They are a reminder that small business theft almost always announces itself first — through behavior, through process cracks, through the small inconsistencies easy to dismiss in the middle of a busy week. The owners who notice early are the ones who get to act early. Everyone else writes the check.