ChecklistFree download

Employee Theft Warning Signs Checklist

A practical, printable checklist of behavioral, transactional, and inventory warning signs that often precede internal theft — written with explicit cautions to prevent false accusations.

How to use this list

None of these signs prove theft on their own. They are indicators— patterns worth a second look. Use them to direct your attention and your audits, never as the basis for an accusation. Most of these behaviors also have innocent explanations.

1. Behavioral indicators

  • Refuses to take vacation or insists on covering certain shifts alone.
  • Always volunteers to handle deposits, voids, or refunds.
  • Stays after close or arrives well before open without a reason.
  • Lifestyle change that does not match wages (new car, jewelry, large purchases).
  • Unusually close relationships with specific vendors, drivers, or customers.
  • Becomes defensive when basic questions are asked about transactions.
  • Other employees quietly complain about favoritism or being blamed for shortages.
  • Heavy financial stress disclosed in conversation (gambling, debt, family pressure).

2. Transaction indicators

  • High rate of voids, no-sales, or post-void refunds on one employee.
  • Refunds without a customer present on camera.
  • Repeated even-dollar refunds or refunds just below the manager-approval threshold.
  • Frequent "training mode" or "manager override" use.
  • Drawer over / short pattern always tied to the same shift.
  • Discounts or employee pricing applied to non-employees.
  • Gift cards activated, voided, or reloaded outside normal patterns.
  • Refunds or returns processed at unusual times (open / close).

3. Inventory indicators

  • Specific SKUs disappearing only when one person is on shift.
  • Shrink concentrated in high-value, easy-to-resell categories.
  • Receiving discrepancies that always favor a specific vendor or driver.
  • "Damaged" merchandise written off without photos or paperwork.
  • Empty packaging found in stockrooms, trash, or restrooms.
  • Back-door activity outside of scheduled deliveries.
  • Inventory counts that always reconcile when one person counts — never otherwise.

4. False-positive warning

Many of these signs have honest explanations. A single mom may need every shift. A long-tenured manager may genuinely prefer to handle cash. A high-void rate may reflect a busy register or a new POS. Treat indicators as questions to investigate, never as proof.

5. Investigation caution

  • Document quietly. Do not discuss suspicions with other employees.
  • Verify with data — pull transaction logs, video, and inventory counts before talking to anyone.
  • Never confront a suspected employee alone or without a witness.
  • Do not detain anyone. Follow your local laws and your company's policy.
  • For anything beyond a verbal coaching, involve HR, legal counsel, or law enforcement as appropriate.
  • Protect the employee's privacy until facts are confirmed. False accusations create real legal exposure.

6. Quick audit triggers

If you see…Pull…
Refund pattern30 days of refund report by employee + video on top 5
Cash variance patternDrawer counts by shift, deposit slips, void log
Inventory drop on one SKUPOS sales vs. on-hand, last 60 days, all employees who handled receiving
Back-door activityCamera review of receiving zone for prior 14 days

This checklist is informational only and is not legal or HR advice. Always consult appropriate counsel before taking employment action. Patterns are starting points, not conclusions.

Built into My LP Portal

My LP Portal flags transactional patterns, ties them to employees and shifts, and lets you store the documentation you'll need if the pattern turns out to be real — quietly and on the record.

Want future resources and updates?

Enter your email. Optional — no spam, unsubscribe anytime.

Related resources

Run all of this inside one place

My LP Portal turns these checklists, incident reports, and trackers into a working system — built for small businesses. Free to start.