How to Identify Cash Register Theft in Small Businesses

I've sat across the table from a lot of cashiers in investigation interviews. Almost none of them got there because of one dramatic moment. They got there because someone — usually an owner — finally slowed down and looked at the patterns that had been quietly accumulating for months.

That's what this article is. Not a "how to catch a thief" piece. A framework for seeing what's actually happening at your registers, building defensible documentation, and knowing when a situation has graduated from "coaching" to "investigation."

How to actually think about register theft

Most small business owners think about register theft like a snapshot: "Is this person stealing right now?" The right question is closer to: "Is this person showing a pattern that's statistically inconsistent with the team?"

One shortage is noise. Three shortages on the same shift, with the same cashier, paired with elevated voids — that's signal.

The framework I use is simple:

1. Observe — count drawers, log variance, and review transactions every single shift.
2. Track patterns — by cashier, by shift, by transaction type.
3. Document — every count, variance, void, and refund. No memory.
4. Coach early — most issues stop when the cashier realizes leadership is paying attention.
5. Escalate carefully — only when patterns plus evidence demand it, and only with professional support.

Behavioral warning signs

Behavior alone proves nothing. But behavior plus transaction patterns plus variance starts to tell a story. Watch for combinations, not single moments.

• Cashier consistently insists on working a specific register or shift alone.
• Drawer "doesn't fit right" or is repeatedly reorganized in ways that obscure counting.
• Visible discomfort or topic-changing when refunds, voids, or shortages are discussed.
• Customers being told receipts aren't needed, or printers "running out of paper" unusually often.
• Lifestyle changes that are dramatic and unexplained — not a reason to accuse anyone, but worth noting alongside other indicators.
• Refusal to let another employee count or run the drawer.

Transaction indicators

This is where most actual evidence lives.

Shortage patterns that matter

The pattern matters more than the dollar amount.

• Same cashier, multiple shifts: highest-priority signal.
• Same shift, multiple cashiers: often a process/scheduling issue, not theft.
• Same register, multiple cashiers: hardware or counting issue first; investigate before assuming intent.
• Small consistent variance: often more revealing than a single large one.
• Variance only on days the manager is off: ownership gap. May be theft, may be process drift, often both.

Till audit methods that surface patterns

Random till audits done correctly do more to prevent register theft than any camera ever installed. Done incorrectly, they punish honest employees and miss the dishonest ones.

What good till audits look like

1. Unscheduled but predictable in frequency. Cashiers should know audits happen, just not exactly when.
2. Two people. Cashier counts, manager verifies. Always two.
3. Counted against the POS expected balance, not a guess.
4. All variance documented, not just amounts over a threshold.
5. Variance reviewed with the cashier same shift — calm conversation, not interrogation.
6. Trended weekly — the daily count creates the data; the weekly trend creates the signal.

Use the free Till Audit & Register Shortage Tracker to make this consistent across shifts.

Documentation that holds up

If you ever need to act on what you've seen, the only thing that matters is what you've written down. Memory does not survive cross- examination.

• Every till count: date, time, cashier, manager, register, expected, actual, variance.
• Every void/refund/no-sale: timestamp, cashier, amount, reason.
• Every coaching conversation: date, topic, employee acknowledgement.
• Any video review: who reviewed, when, what was seen, where footage is preserved.
• Any incident: written narrative completed within 24 hours using a standard incident report template.

A defensible investigation workflow

1. Pattern recognition phase. Variance + transaction anomalies + behavioral indicators logged over multiple shifts.
2. Quiet confirmation phase. Pull POS data, compare to expected behavior, identify specific incidents to review.
3. Video review. Targeted, not broad. Specific transactions, specific times, preserved on separate media.
4. Evidence preservation. Lock down transaction logs, schedules, audit sheets, and video. Do not delete or overwrite anything.
5. Professional consult. Loss prevention professional, employment attorney, or both before any conversation with the employee.
6. Interview (if appropriate). Conducted properly, with the right people, in a way that protects both the employee and the business.
7. Resolution. Termination, restitution, prosecution, or coaching — supported entirely by documented evidence.

Video review guidance

• Review specific transactions, not whole shifts. You'll find what you can prove, not what you suspect.
• Confirm camera coverage actually shows the drawer, the hands, and the customer interaction.
• Preserve full clips with audio (where legal). Never edit or extract only "the good parts."
• Document who reviewed, when, and what was observed — same standard as any other evidence.
• Audio recording laws vary by state. Many states require all-party consent. Confirm yours before relying on audio.

Coaching vs investigation — different tools for different problems

Not every variance is theft. The first response to almost every incident should be coaching, not interrogation.

False positives — what looks like theft and isn't

• POS reporting errors (especially after software updates).
• Promotion / discount logic configured incorrectly.
• Returns processed at one register because that's how the layout works, not because of intent.
• A cashier protecting another cashier's bad habits — process issue, not necessarily theft.
• Counterfeit currency taken in good faith.
• Customer disputes leading to legitimate refunds that look unusual on a report.

This is exactly why pattern recognition matters. One data point lies constantly. A trend over time is harder to mistake.

When to stop investigating yourself

Systemize the pattern recognition

Every workflow in this article — drawer counts, variance tracking, void/refund logs, coaching notes, incident reports — works better when it lives in one place instead of a binder, a phone, and the manager's memory.

That's the entire reason My LP Portal exists: to give small business owners the operational visibility that used to require a dedicated loss prevention team. Pair it with the Till Audit Sheet and the Employee Theft Warning Signs Checklist for a complete starter system.

You are not trying to catch people. You are trying to make the environment one where dishonest behavior is statistically impossible to hide.