The 4 Types of Thieves: Warning Signs & Prevention Guide
Opportunistic · Necessity · Thrill · Insider — behavioral indicators, manager and employee action items, and prevention checklists
A professional, owner-friendly field reference covering opportunistic, necessity, thrill, and insider theft. Each section includes motivation, primary targets, environmental triggers, behavioral warning signs, employee and manager action items, and a quick-reference checklist designed to live in a manager's binder.
This guide is built for small business owners, general managers, and store leaders who do not have a dedicated loss prevention department. It covers the four core motivations behind nearly every theft your business will ever encounter — and gives you the behavioral indicators, operational controls, and quick-action checklists professionals use in the field.
How to use this guide. Read it cover to cover once. Then keep it accessible — in a manager's binder, on a breakroom shelf, or in your shift-leader handoff folder. The quick-reference checklists at the end of each section are designed to be reviewed in five minutes before a shift, an audit, or a coaching conversation.
Behavioral Warning Signs
- Scans the perimeter of the store before approaching a specific aisle
- Lingers in blind corners, end caps facing away from the counter
- Carries bags, jackets, or large purses inconsistent with weather or shopping pattern
- Avoids eye contact, especially after being acknowledged
- Returns to the same area more than once without selecting anything
- Asks a long distracting question about a product on the opposite side of the store
- Picks up, looks around, puts back, repeats
Employee Action Items
- Greet every customer within ten seconds of entry, with eye contact
- Offer help a second time when a customer doubles back to the same aisle
- Recover and reset shelves continuously — a tidy store is a watched store
- Walk the floor on a routine but unpredictable cadence
- Never confront a suspected thief — observe, document, and notify a manager
Manager Action Items
- Audit your blind spots monthly — walk the floor with the camera feed open
- Verify high-value SKUs have either camera coverage or active sightline
- Confirm back doors are not propped during deliveries without supervision
- Coach greeting standards every onboarding, every quarter, every time it slips
- Review front-end staffing during peak self-checkout windows
Questions to Ask Yourself
- If a customer wanted to be invisible in my store for thirty seconds, where would they go?
- Which aisle has the highest dollar density and the least sightline?
- When was the last time someone walked in and was not greeted?
Behavioral & Emotional Warning Signs
- Tight, hurried movements with a clear destination — not browsing
- Eyes that drop, body language that reads as shame rather than evasion
- Selection limited to essentials, not discretionary items
- Visible signs of financial or physical distress
- Concealment that is fast and clumsy rather than practiced
- Children present and visibly aware of the situation
Employee Action Items
- Walk the aisle, greet, and offer help — presence resolves most of these incidents quietly
- Do not confront, judge, or publicly question the customer
- Alert a manager privately if concealment is observed
- Reinforce calm, professional tone in any interaction
Manager Action Items
- Train your team that necessity theft is handled privately, calmly, and per written policy
- Post community resource information (food bank, assistance program contacts) at the customer service desk
- Document every incident — pattern still matters
- Avoid public escalation — the reputation cost of mishandling these incidents far exceeds the merchandise
Surveillance & Testing Behaviors
- Repeated visits at different times to map staffing patterns
- Triggers small alerts (touches tagged items, lingers near sensors) to test response time
- Asks detailed but 'casual' questions about return policy, camera coverage, or schedules
- Buys small low-value items to build a 'regular customer' identity
- Photographs fixtures, exits, or merchandise inconspicuously
- Returns to the same area on the same day of the week, often at shift change
Employee Action Items
- Recognize repeat visits by name — "Back again, how can I help?" disrupts the game
- Vary your floor coverage — do not stand in the same spot every shift
- Document repeat visitors with timestamped notes (time in, time out, behavior, vehicle if visible)
- Never tip off a suspect that they are being watched — escalate to a manager
Manager Action Items
- Randomize till audits — different days, different times, different auditors
- Rotate high-risk aisle coverage so blind spots are not blind at the same time daily
- Schedule unannounced floor walks by managers from other locations
- Review camera footage on a regular weekly cadence — not only after a loss
- Treat any repeat-visit pattern as data, even without a confirmed loss
Personality & Trust Shifts
- Sudden defensiveness about routine questions
- Isolation — eating alone, avoiding manager check-ins, declining to train others
- Mood shifts that do not match operational events
- Irritation at audits or oversight previously accepted without issue
Control & Ownership Behaviors
- Insists on being the only person who does the deposit, schedule, receiving, or count
- Refuses days off, especially around inventory or audit windows
- Works unpaid extra hours that always coincide with cash or back-office tasks
- Resists cross-training — 'it's easier if I just do it'
- Visible discomfort when someone else covers their shift unexpectedly
Operational & Transaction Red Flags
- Disproportionate voids, refunds, no-sales, or post-voids tied to one user
- Persistent small over/short patterns on the same drawer
- Refunds processed without product return, or on closed-out tender types
- Discount or coupon usage concentrated on one employee's transactions
- Receiving discrepancies repeatedly 'corrected' by the same person
- Inventory counts that improve on the days a specific person is off
Lifestyle Indicators (Pattern Only — Never Alone)
- New vehicle, electronics, or jewelry inconsistent with known income
- Frequent vacations or expensive habits that do not fit pay grade
- Casual mentions of large purchases that do not square with role
Manager Action Items
- Enforce separation of duties — no single person owns cash, inventory, or vendor relationships end to end
- Require cross-training; treat any 'irreplaceable' employee as a vulnerability
- Run random, unscheduled audits on tills, safes, voids, refunds, and high-risk SKUs
- Apply two-person controls on deposits, safe access, and large refunds
- Apply the same procedures to long-tenured employees that you apply to new ones
- Review camera footage weekly on a schedule — not just after a loss
- Document small rule violations in writing, calmly, every time — stage one is where prevention lives
- On any resignation, immediately rotate keys, codes, logins, and vendor permissions
Quick-Reference Comparison
How each thief type differs across motivation, target, behavior, and the control that actually disrupts them.
| Type | Driver | Typical Target | Disruptive Control |
|---|---|---|---|
| Opportunistic | Low perceived risk | Small, easily concealed | Active greeting + sightlines |
| Necessity | Pressure / desperation | Essentials | Visible engagement + private handling |
| Thrill | Challenge / ego | "Secured" items | Random audits + recognition |
| Insider | Entitlement, need, grievance | Cash, refunds, inventory, vendor flow | Separation of duties + random review |
The Owner's Walk-Through
Walk your business tomorrow with one question in your head: If I wanted to steal from this business, how would I do it?
- Where is cash unattended, even briefly?
- Which aisle has the highest dollar density and the least sightline?
- Which back door is propped during deliveries without supervision?
- Which process is controlled end-to-end by one person?
- Which long-tenured employee is exempted from a procedure others follow?
- Which audit happens on the same day, by the same person, every time?
- Which camera has not had footage reviewed in the last 30 days?
- Which vendor reports their own delivery and counts their own restock?
- Which refund or void permission is granted more broadly than it should be?
- Which new hire was trained on how — but never on why — the policies exist?
This guide is educational in nature and reflects general loss prevention practice. It is not legal advice. Customize procedures to your local laws, written policies, employment agreements, and any applicable union or contractual obligations before implementation. My LP Portal is not liable for actions taken based on this material.
Want future resources and updates?
Enter your email. Optional — no spam, unsubscribe anytime.
Related resources
- GuideManager Coaching & Documentation Toolkit
A four-part printable toolkit for small business managers — Employee Coaching Form, Failed Till Audit Review Worksheet, Manager Coaching Guide, and Coaching-or-Investigation Decision Tree.
- ChecklistRetail Closing Checklist
A printable end-of-day checklist covering locks, registers, cash drops, high-risk merchandise, cameras, alarms, and manager signoff.
- TemplateRetail Incident Report Template
A printable incident report covering witnesses, suspect descriptors, evidence, narrative, and manager signoff — built for small business.
- ChecklistEmployee Theft Warning Signs Checklist
Behavioral, transactional, and inventory indicators that often precede internal theft — with cautions to avoid false accusations.
Run all of this inside one place
My LP Portal turns these checklists, incident reports, and trackers into a working system — built for small businesses. Free to start.