Sweethearting in Retail: The Quiet Form of Employee Theft Most Owners Never Catch

The cashier everyone trusted

She had worked at the store for almost four years. Customers asked for her by name. She covered shifts when nobody else would. She remembered which regulars wanted their cigarettes pulled before they reached the counter, and which ones were still trying to quit. Her drawer balanced almost every night. When the owner ran the numbers, sales were steady. When the manager watched the cameras, nothing looked wrong. She was, by every reasonable measure, the kind of employee independent retailers spend years trying to find.

And yet, quietly, the store kept losing inventory. Cigarettes ran short. Energy drinks did not last as long as the order quantities suggested they should. Liquor counts drifted by a few bottles each month. The owner blamed it on receiving — vendors get things wrong all the time. He blamed it on shoplifting — the parking lot had been busier. He even blamed it on his own paperwork, because that was easier to accept than the alternative.

It took almost two years before anyone realized that none of the missing merchandise had ever been stolen by a customer acting alone. It had all walked out the front door in plain sight, scanned or not scanned, by people who smiled at the cashier on the way out and thanked her for her help. The cashier had not taken a single dollar from the drawer. She had done something quieter, more damaging, and much harder to see.

She had been sweethearting.

Not every form of employee theft involves taking money from the register. The most damaging schemes never touch the cash at all.

This article is for the owner of the store that just read that paragraph and felt a flicker of recognition. It is for the manager who has noticed that certain customers always choose the same line. It is for the operator who has run the same drawer audit a hundred times without ever finding a shortage, and who still cannot explain why the cigarette count keeps slipping. It is written in plain English, with zero assumed loss prevention background, because the people who most need this information almost never receive any formal training in it.

Sweethearting is not exotic. It is not rare. It is not new. It is simply quiet — and quiet is what allows it to continue. The goal of this guide is to make it loud enough to see.

What sweethearting actually is

Sweethearting is the intentional practice of an employee allowing merchandise to leave the store without proper payment. The word covers a wide range of behavior, but every form of it shares the same three elements: an employee, an unauthorized transfer of value, and a recipient who benefits.

The recipient is almost always someone the employee knows or has chosen to favor. It might be a close friend who comes in twice a week. It might be a sibling or a parent. It might be another employee finishing their own shift. It might be a romantic partner, a former coworker, or simply a regular customer the cashier has come to like. The relationship is the point. Sweethearting is a relationship crime disguised as a transaction.

Unlike cash theft, where the employee personally pockets money, sweethearting moves value out of inventory. The store's bank account is not directly raided; the store's stockroom is. That difference is what makes sweethearting so dangerous in independent retail. Most small business owners watch the cash. Very few watch the inventory with the same intensity. As long as the till balances, the assumption is that the day was clean.

The many forms it takes

Sweethearting does not look like one thing. In a single shift it can wear half a dozen different faces. Some of the most common patterns retailers eventually identify after the fact include:

• Pass-throughs. Items placed on the counter and bagged without ever being scanned. Sometimes hidden beneath other items. Sometimes simply waved past the scanner.
• Partial rings. Multiple identical items where only one is scanned. A six-pack rung as a single can. A case of water rung as a single bottle.
• Substitutions. A high-value item rung at the price of a low-value item. A premium liquor rung as a well brand. A carton of name-brand cigarettes rung as a generic pack.
• Unauthorized discounts. Manual price overrides, employee discounts applied to a friend's purchase, or coupons used against items they were never intended for.
• Refund and void schemes. A transaction is rung, paid, and then voided or refunded after the customer leaves with the merchandise. The drawer balances. The product is gone.
• Comped items. Items marked as damaged, spoiled, or complimentary that were neither damaged, spoiled, nor authorized to be given away.
• Generosity creep. Free coffee. Free pastries. Free snacks. None of it sanctioned. Each item small. The accumulated monthly loss substantial.

Almost no employee runs all of these patterns. Most run one or two, and they tend to settle into whichever pattern matches their store's weakest control. If the store never reviews voids, voids become the pattern. If the store never cycle counts cigarettes, cigarettes become the pattern. The scheme adapts to the gap.

Why it goes unnoticed

Sweethearting hides for the same reason a leak inside a wall hides: nothing on the surface looks wrong. The transactions appear normal. The customer walks out with a bag. The cashier rings the next person in line. The drawer balances. The sales report shows a busy day. The cameras, if anyone bothered to review them, would show a smiling exchange between two people who clearly know each other.

The loss only appears later, in inventory variance, and inventory variance has too many other plausible explanations to immediately point at the front end. Was the truck short? Did receiving miscount? Did a customer shoplift? Did the previous count have an error? Each of those is true often enough that the real cause stays buried under reasonable alternatives.

This is the core insight every owner needs to internalize: sweethearting is the form of internal theft that is specifically designed not to produce an obvious symptom. It is the quiet variant. It is the one that requires you to go looking.

Why employees commit sweethearting

Understanding motive is not the same as excusing behavior. But for owners trying to build a workplace that resists internal theft, understanding why sweethearting happens is essential — because almost every motivation maps directly to a management practice that either invites the behavior or discourages it. Investigators who have worked hundreds of internal theft cases tend to see the same handful of drivers appear over and over again.

Friendship and social pressure

The most common driver is also the most human. An employee likes the person on the other side of the counter. Maybe it is a longtime friend. Maybe it is a coworker who has covered shifts for them. Maybe it is a regular customer who has been kind during a hard period of their life. The employee does not think of themselves as a thief. They think of themselves as doing a favor. The first time it happens is almost always small — a single drink, a single pack of gum. The favor crosses a line, nothing bad happens, and a precedent is set.

Once the precedent exists, social pressure makes it nearly impossible to reverse without explanation. The friend now expects the favor. To stop is to invite a difficult conversation. To continue is to deepen the behavior. Most employees choose the easier path until the easier path becomes an entrenched pattern.

Family pressure

When a relative is the beneficiary, the social pressure becomes much heavier. A cashier whose brother walks in every other day and expects to be taken care of is operating under a different kind of weight than a cashier whose friend stops in once a month. Family sweethearting often runs longer and reaches higher dollar totals precisely because the employee feels they cannot say no.

Financial stress

Some employees sweetheart not to enrich themselves directly but to reduce the financial burden on people they care about. A parent who cannot afford diapers. A roommate behind on bills. A friend who lost a job. The employee rationalizes the behavior as a form of help that the store can absorb. They are usually wrong about that — independent retailers are far more fragile than employees realize — but the rationalization is sincere.

The desire to feel generous

Front-end employees deal with customers all day. Customer service environments reward warmth, and warmth often expresses itself as generosity. An employee who cannot offer a discount they did not earn the authority to give will sometimes simply not ring an item. It feels, to them, like a small extension of the friendly behavior their job already rewards. They do not see it as theft. They see it as hospitality with the wrong cost center.

Entitlement

Some employees believe the store owes them something. Maybe they feel underpaid. Maybe they feel unappreciated. Maybe a raise was promised and never delivered. Whatever the source, the belief produces a kind of moral accounting in which giving away merchandise — to themselves or to others — feels like collecting an unpaid debt. Entitlement-based sweethearting is particularly resistant to remediation because the employee does not view their behavior as wrong.

Revenge and grievance

A small number of sweethearting cases trace back to a specific grievance. A manager disciplined the employee. A scheduling change cost them hours. A coworker was promoted instead of them. The employee, unable to retaliate openly, retaliates quietly through the merchandise. These cases tend to escalate quickly because the behavior is no longer about the recipient — it is about hurting the business.

Poor supervision and weak accountability

Opportunity is the single largest enabling factor in every internal theft case ever investigated. When supervision is weak, when no one watches the cameras, when no one reviews POS exceptions, when no one ever conducts an inventory count on the high-risk categories, the environment itself communicates that no one is paying attention. Honest employees notice. Dishonest employees act on it.

Normalization and culture

Perhaps the most insidious driver is culture. In stores where the previous manager gave away coffee freely, where the prior owner let employees grab snacks, where comping items for family was unofficially permitted, sweethearting does not feel like theft. It feels like the way things have always been done. New employees learn the unwritten rules from senior staff, and a behavior that began as one person's favor becomes the operational norm. Cleaning up culture is one of the hardest tasks an owner ever faces, because the people benefiting from the existing culture have no incentive to help dismantle it.

Behavioral warning signs

Behavioral indicators almost always appear before inventory variance ever surfaces. An owner who knows what to watch for can often identify a pattern of concern months before a count tells the same story. Nothing in this section proves misconduct on its own. The point of behavioral observation is to identify patterns that justify a closer look — not to convict anyone in your head before the work is done.

Specific customers repeatedly choosing one cashier

This is the single most commonly observed indicator in confirmed sweethearting cases. A particular customer enters the store, looks toward the registers, and waits for a specific cashier to be available — even when other lines are shorter, even when another register has just opened. Once is meaningless. Twice is a coincidence. A repeating pattern over weeks is one of the clearest signals investigators look for. Front-end staff often notice it before managers do; ask, listen, and write it down.

Extended conversations at the register

Long, personal, animated conversations between a cashier and a specific customer that go far beyond normal transactional small talk deserve attention — especially when the same conversation pattern repeats with the same customer. Length alone is not the issue. The repetition is.

Scanning behavior that looks unusual

Items placed in bags without ever crossing the scanner. Items scanned with the barcode held in a way that obscures it from view. Hands moving quickly over the scanner without an audible beep. Items rung through using keyed-in price codes when a scan would be faster. Customers leaving with noticeably more merchandise than the receipt appears to account for.

Avoiding eye contact with supervisors

Most cashiers naturally acknowledge a manager passing behind the registers. Employees engaged in active sweethearting often do the opposite — they pretend not to notice, become extremely focused on the transaction in front of them, and visibly relax once the manager moves on. This is one of the easier signals to dismiss as coincidence; in repeat-pattern form, it rarely is.

Defensive responses to routine questions

Asking a cashier a normal operational question — "How is the day going? Anything I should know about?" — should not produce defensiveness. Employees engaged in active theft often interpret routine conversation as the beginning of an inquiry. The reaction is usually subtle: a slight stiffening, an over-explanation, an unnecessary justification for something that did not need to be justified.

Resistance to register rotation

Cashiers who become uncharacteristically resistant to switching registers, taking breaks, or being floated to a different department may simply prefer routine. Or they may have created an environment at a specific register — a familiar setup, known camera blind spots, a regular customer schedule — that they do not want to leave. Resistance itself does not prove anything. Resistance combined with other indicators deserves attention.

Reluctance to take breaks or time off

An employee who refuses vacation, fights against time off, and resists any shift change that would put someone else on their register may be protecting a scheme that only works while they personally control the front end. This is also true in cash handling roles more broadly. Many large-scale internal theft cases were first noticed when a long-tenured employee was finally forced to take a week off and the numbers suddenly looked different.

Stress indicators and changes in work habits

Sweethearting is stressful for the people doing it, especially as the pattern grows. Sleep loss, irritability, sudden weight changes, increased smoking, drinking issues, or signs of financial difficulty — none of these prove anything on their own. They are simply observations that, in combination with operational indicators, sometimes reveal that something is happening in an employee's life that may be intersecting with their work.

Operational red flags

Behavioral indicators surface in observation. Operational red flags surface in data. Every modern POS system produces a record of what happened during a shift, and that record — read carefully — tells a story that no amount of in-person observation can match.

POS exceptions

Voids, refunds, no-sales, manual price changes, suspended transactions, and reopen-drawer events are the levers used in almost every internal theft scheme. Reviewing them weekly should be a standing habit for every owner. The question is not "did exceptions happen?" — they always happen. The question is whether the distribution makes sense.

• Voids concentrated under one cashier. Especially voids that occur after the customer has walked away from the register.
• Refunds without corresponding return paperwork. Cash refunds processed without a receipt, without an item return, or without a manager signature.
• No-sale frequency. A drawer that opens without a transaction multiple times per shift, repeatedly, under the same employee.
• Manual price overrides on high-margin items. Especially when the override drops the price to an unusually low number.
• Suspended transactions that are never resumed.

High item count with low basket value

A receipt that records eight items but totals seventeen dollars deserves a second look in a store where the average ticket runs much higher. So does a receipt that records two items totaling almost a hundred dollars in a store where most baskets are small. Outliers in either direction can be perfectly innocent — a customer buying only liquor, a customer buying only candy bars — but a pattern of outliers attached to a single cashier is the kind of detail investigators notice.

Unusual discount frequency

Most stores have a normal range of discount activity per shift. Employees who consistently apply discounts at three or four times the store average — or who consistently apply the maximum allowed discount instead of a more typical amount — are operating outside the norm. The norm itself is not a rule; it is a baseline against which unusual activity becomes visible.

Transaction timing

Sweethearting tends to cluster at predictable moments: early morning before a manager arrives, late evening after a manager leaves, during a shift change when supervision is fragmented, or during a known busy period when no one is paying close attention to any single transaction. A pattern of exception activity that consistently appears at the same times in the same employee's shift is a strong operational indicator.

Inventory shortages by category

High-risk merchandise — cigarettes, vape products, liquor, energy drinks, lottery, small electronics, ammunition — should be cycle counted often. When variance in a specific category grows steadily over weeks or months, and especially when that variance does not correlate with shoplifting incidents or vendor receiving issues, the front end becomes the next reasonable place to look.

Customer complaints

It is unusual for sweethearting to generate complaints — the beneficiary is rarely the one who calls — but secondary customers sometimes report something that does not feel right. A customer who mentions that another customer "didn't seem to pay for anything," or a customer who notices their own receipt is missing items, has just given you an investigative lead. Take it seriously. Write it down.

How professional investigators detect sweethearting

There is a discipline to investigating internal theft that most owners have never been taught. Done well, an investigation produces a clear factual record, protects honest employees, and gives the business a defensible basis for whatever action follows. Done poorly, it produces accusations, lawsuits, and a workplace climate that damages everyone. The following section describes how trained investigators approach sweethearting cases. It is intended to teach the thinking — not to provide a step-by-step operational manual.

Start from the data, not the suspicion

An experienced investigator rarely begins with "I think this employee is stealing." They begin with "the inventory in this category is off, and I want to understand why." Starting from the data forces objectivity. It opens the possibility that the problem is receiving, or shoplifting, or paperwork, or a combination of all three. Many suspected internal theft cases turn out to be operational failures. Many operational investigations turn out to be internal theft. Either outcome is more useful than acting on a hunch.

POS analysis comes first

Before pulling video, before talking to anyone, the investigator reviews POS data over a meaningful window — typically thirty to ninety days. They look at exception counts by employee, by day of week, by hour. They look at average basket size, average item count, discount frequency, void and refund patterns, and no-sale activity. They compare each employee to the store baseline. The goal is to identify outliers that justify deeper review, not to make accusations from the data alone.

Video review reconstructs the transactions

Once specific transactions of interest are identified in the POS data, video review is used to reconstruct what actually happened. Did the items on the receipt match the items in the bag? Did the cashier appear to scan everything? Did the customer hand over money that matched the receipt total? Did the cashier's behavior change when a particular customer arrived? This is painstaking work. A single confirmed case may take many hours of video review.

Pattern recognition over time

Single transactions almost never make a case. Investigators build cases on patterns: the same cashier, the same customer, the same type of exception, the same time of day, repeated across multiple transactions over weeks. Patterns convert ambiguous observations into a coherent story, and that story is what makes the case defensible.

Customer identification

In sweethearting cases, the recipient often returns again and again. Identifying that customer — through loyalty program data, payment records, or video — strengthens the case considerably. The investigator is not building a case against the customer; they are documenting the relationship that explains the pattern.

Evidence documentation and chain of evidence

Everything is documented contemporaneously. Date, time, what was observed, what was reviewed, what the source was, who reviewed it. Video clips are preserved with original timestamps. POS reports are saved with parameters intact. The chain of evidence is what allows the documentation to survive scrutiny — from the employee being interviewed, from HR, from an attorney, from a court if it ever reaches that point.

Interview preparation

Interviews happen at the end of an investigation, not the beginning. By the time an interview is conducted, the investigator already knows what happened. The interview's purpose is to give the employee the opportunity to explain, to corroborate or refute the evidence, and to acknowledge what is documented. Interviews conducted before the evidence is in hand almost always go badly.

Objectivity and professional ethics

Throughout the process, the investigator's job is to find the truth, not to confirm a theory. That means actively looking for evidence that would disprove the suspicion as carefully as evidence that confirms it. It means avoiding language that prejudges the employee. It means treating the person at the center of the investigation with respect, even when the evidence is damning. The professionalism of the investigation is what makes the outcome legitimate.

The goal of an investigation is the truth — not a conviction. An investigator who only looks for evidence that confirms their theory is not investigating. They are accusing.

Common management mistakes that allow sweethearting to thrive

Sweethearting is rarely the product of a single bad employee in an otherwise tight operation. It is almost always the product of an operational environment that, without anyone intending it, has made the behavior easy and the risk low. The following mistakes appear in almost every confirmed sweethearting case.

Trusting everyone equally

Owners who treat trust as a fixed reward for tenure — "she has been here four years, she would never do that" — remove the natural check that periodic verification provides. Trust in retail should be procedural, not personal. The best employees in the world benefit from a workplace where verification exists, because it protects them from suspicion when something does go wrong.

Never reviewing video

A camera that never gets watched is decoration. Many small retailers install camera systems, walk through the storeroom once, and then never pull footage again until something obvious goes wrong. Sweethearting almost never produces an obvious moment. By the time the footage is needed, the older clips have already been overwritten.

Ignoring inventory trends

Owners who only run a full inventory count once or twice a year miss the trend that would have told them where to look. High-risk categories — cigarettes, liquor, vape, energy drinks, lottery — should be counted on a cycle measured in weeks, not months. The cost of counting is small. The cost of not counting is whatever has walked out the door in the meantime.

Weak supervision at the front end

Sweethearting requires the absence of a manager. When no manager is present during long stretches of a shift, when the manager spends their entire shift in the office or on the phone, when the front end is run by whoever happens to be available, the conditions for sweethearting are in place whether anyone exploits them or not.

No surprise audits

Predictable audits are not audits. If every cashier knows the till is counted at the end of their shift and at no other time, the audit has zero deterrent value during the rest of the shift. Surprise mid-shift counts, on a rotating and unannounced schedule, are the only kind that change behavior.

No exception reporting

Owners who never pull an exception report are flying blind on the most important data the POS produces. Voids, refunds, no-sales, and discount activity tell a story that drawer counts never will. Reviewing them weekly takes minutes. Not reviewing them takes thousands of dollars over time.

Poor documentation

Stores that document nothing — no incident logs, no audit results, no coaching conversations, no customer complaints — have no way to recognize patterns. A pattern is, by definition, multiple data points connected over time. Without documentation, every event is its own isolated moment, and the connections never form.

Register sharing

When multiple employees use the same till during a shift, accountability evaporates. A shortage cannot be attributed. An exception cannot be assigned. One drawer per employee per shift is one of the simplest, highest-impact controls in retail, and one of the most frequently violated.

Failure to investigate repeat patterns

Many owners notice the warning signs and do nothing. The cashier is too valuable to lose. The conversation feels uncomfortable. The evidence is not airtight. Each individual reason is understandable; the accumulated reluctance allows the behavior to compound. By the time the issue is undeniable, the documented loss is usually a large multiple of what it would have been if the first pattern had been investigated.

Prevention strategies that actually work

Prevention is not a single program. It is a system of small, consistent controls that, working together, raise the cost of sweethearting and lower the likelihood that it will continue undetected. None of the controls described below are expensive. Most cost nothing but the discipline to implement and maintain them. Their power comes from being used consistently, not from being elaborate.

Start with hiring

Background checks, reference checks, and structured interviews are the first defense. They are not a guarantee — many sweethearting employees have clean histories — but a careful hiring process signals that the store takes its operations seriously, and that signal alone changes the kind of candidates who accept the job. Owners who hire impulsively, off the street, with no verification, inherit a higher-risk workforce by default.

Train every employee in the same standards

Most sweethearting begins as ambiguity. Employees do not know whether free coffee for a friend is allowed. They do not know whether comping a damaged item requires a manager. They do not know whether an employee discount applies to a relative. Written policies, trained at hire and refreshed periodically, remove the ambiguity. The first time an employee crosses a line they did not know existed, the policy is what allows the conversation to be about correction rather than discipline.

Build a culture that protects honest employees

The single most underused asset in a small retail business is the honest employee. They see things owners never see. They know which coworkers are operating outside the rules. They notice the customers who always pick the same line. They will not say anything in a culture where reporting is treated as snitching, or where management never acts on what is reported. Owners who build a culture in which integrity is recognized and rewarded — quietly, consistently, without theater — gain access to information no camera will ever capture.

Use camera placement deliberately

Cameras pointed at the ceiling do nothing. Cameras pointed at the scanner, the bag area, the cash drawer, the customer's hands, and the cashier's face — together — capture the information needed to reconstruct a transaction. Resolution matters. Frame rate matters. Retention matters. A camera system that only retains seven days of footage will rarely be useful for sweethearting cases, where the pattern often spans weeks before anyone notices.

Maintain visible manager presence at the front end

The single most consistent deterrent in retail is a manager who is actually present. Walk the front end. Ask cashiers how their shift is going. Step behind the counter periodically. Acknowledge regular customers. None of this is surveillance. It is operational presence, and it changes behavior on both sides of the counter.

Conduct random observations

Short, focused, unannounced observations of front-end activity — five to ten minutes spent watching transactions, scanner activity, and customer interactions — produce information that no report can. They also communicate, without saying a word, that the front end is being watched. Done sporadically, at unpredictable times, they carry far more deterrent weight than a posted schedule ever could.

Review POS exceptions weekly

Set a recurring weekly time — thirty minutes is enough for most small stores — to review voids, refunds, no-sales, and discount activity by employee. Look for outliers. Look for patterns. Ask questions when something looks unusual. The questions themselves change behavior even when nothing turns out to be wrong.

Cycle count high-risk categories

Cigarettes, vape, liquor, energy drinks, lottery, ammunition, small electronics. Pick a cadence — weekly for the highest-risk items, monthly for the rest — and stick to it. The first time the cycle count surfaces a variance you cannot explain, you will have the early signal that monthly or quarterly counts would never have given you.

Set clear customer service expectations

Many cashiers begin sweethearting because their understanding of good customer service has drifted into territory the store never authorized. Defining service standards explicitly — what is included, what is not, when to call a manager, when to apply a discount, when to comp an item — gives employees a framework that keeps generosity inside operational boundaries.

Document everything consistently

Audit results. Cycle counts. Customer complaints. Coaching conversations. Behavioral observations. Exception reviews. Nothing about any single entry needs to be dramatic. The point is to build a record over time so that when a pattern emerges, the documentation is already in place to support the next step.

Enforce accountability consistently

A policy that is enforced against one employee and not another teaches the entire staff that the policy is optional. Consistency in enforcement is the difference between a culture of accountability and a culture of favoritism. The latter is one of the most reliable predictors of long-term internal theft.

Recognize the people who do it right

Prevention is not only about catching what is wrong. It is also about making the right behavior visible. Owners who publicly acknowledge employees who follow procedure, who decline a friend's request for a discount, who flag a suspicious situation — without making a spectacle of it — reinforce the culture they want every day. Quiet, consistent recognition is one of the most powerful prevention tools in retail, and one of the least used.

A realistic case study

The following case is a composite. Names, dates, and details have been changed, and the scenario has been simplified for educational clarity. The pattern, however, mirrors many real sweethearting investigations conducted across independent retail.

The setup

A family-owned convenience store in a small town. Three registers. Annual revenue around two million dollars. Cigarettes, lottery, beer, and vape accounted for nearly half of inventory value. The owner had owned the store for twelve years. The cashier in question, "Marcy," had worked there for almost four. She was warm, reliable, and beloved by customers. Her drawer balanced almost every night.

Initial suspicion

Over the course of about nine months, cigarette inventory variance grew from negligible to roughly six hundred dollars per quarter. The owner blamed the wholesaler, then a new vape product line, then the receiving manager. A full physical inventory in the winter showed losses across cigarettes, energy drinks, and beer that did not correlate with any single explanation. The owner decided to take a closer look at the front end.

The POS review

Pulling thirty days of exception data revealed that Marcy ran three to four times the store average in voids and refunds. Most of the voids were processed shortly after the transactions themselves — typically within a minute or two. Many of the refunded transactions had no return paperwork on file. Her no-sale activity was also elevated, clustered consistently in the last hour of her shift.

The video review

Pulling video for the days with the highest exception activity showed a repeating pattern. A specific customer — a man in his forties driving a white pickup — would arrive roughly twice a week, always within the last hour of Marcy's shift. He would pick up a six-pack of beer, a carton of cigarettes, and a handful of small items. Marcy would scan some of the items but not all of them. He would hand her a few bills. Several minutes after he left, the transaction would be voided. The drawer balanced because the cash he handed her was roughly equal to the smaller items that had actually been rung.

The pattern

Reviewing video across six weeks revealed the same customer in the same pattern on eighteen separate visits. Across those visits, an estimated four to five thousand dollars of merchandise had left the store without being properly paid for. The drawer had balanced every one of those nights.

The response

The owner contacted his attorney, who in turn contacted a professional investigator. The investigator worked with the owner to consolidate the evidence: POS reports, video clips with timestamps, an investigation log, and a written summary of the pattern. The interview with Marcy was conducted by the investigator, in the presence of the owner, in a small office at the back of the store. Marcy initially denied any wrongdoing. When she was shown a single video clip of a single transaction, she began to talk. The customer was her brother-in-law. She had started giving him small items when he was unemployed two years earlier. The behavior had grown. She had not realized how much had been taken, and she had no plan for what to do about it.

The outcome

Marcy's employment was terminated. The matter was reported to local law enforcement. A civil restitution agreement was reached. The owner declined to publicize the case to his staff in any detail; he instead used the experience as the basis for an operational reset across the entire store.

Lessons learned

1. The drawer balanced for two years. Cash audits alone would never have surfaced this case.
2. The POS data told the story first. Exception review, conducted quarterly instead of weekly, delayed the discovery by months.
3. Camera coverage was almost adequate. A second camera angle on the bagging area would have shortened the review time significantly.
4. The behavioral signals had been visible. Other employees later confirmed they had noticed the customer always chose Marcy's line. No one had ever been asked.
5. The owner had trusted tenure as a substitute for verification. The hardest lesson, and the one most owners eventually learn the same way.

Every confirmed sweethearting case is also, in retrospect, a management case. The behavior is the employee's. The opportunity is the operation's.

How My LP Portal helps

Most independent retailers do not need an enterprise loss prevention platform. They need a single, consistent place to do the small things that, done together, make sweethearting harder and patterns easier to see. My LP Portal was built for exactly that — owners and managers who never had formal LP training and who need the operational discipline of a large retailer in a format that fits a small business.

• Incident Management. A clean place to document every observation, every suspected pattern, every customer complaint, and every operational anomaly. Documentation that accumulates over time is what turns isolated events into the pattern that justifies a closer look.
• Till Audit Checklist. A structured workflow for conducting surprise till audits, recording results, and tracking variance by employee, shift, and register over time.
• Exception documentation. A consistent format for recording voids, refunds, no-sales, and override activity that requires attention, so the data does not stay buried inside a POS report no one ever opens.
• Behavioral observation logs. A simple place to record the small things that managers and trusted employees notice — the customers who always pick the same line, the cashiers who become defensive when supervisors approach. Notes that, on their own, mean nothing. Together, they often mean everything.
• Evidence organization. A single record of documentation, exception data, and observations tied to each incident, so that when an investigation does become necessary, the timeline is already in one place.
• Manager checklists. Daily, weekly, and shift checklists that build the routines this article describes into the rhythm of the store, instead of relying on memory and good intentions.
• Historical reporting. Reports that show variance, incident, and audit data over time, so that emerging patterns become visible long before they become losses.
• Collin, the AI loss prevention assistant. An AI assistant trained specifically on retail loss prevention, available inside the portal to answer questions, suggest next steps, and help owners think through situations they have never encountered before.

None of these tools replace good management. They make good management easier — and they ensure that the small disciplines that prevent sweethearting actually get done, in a format that survives staff turnover, busy seasons, and the natural drift that affects every small business.

Closing thoughts

Sweethearting is one of the most damaging forms of internal theft precisely because it is so quiet. It does not announce itself in the daily drawer count. It does not produce dramatic moments on camera. It does not generate customer complaints. It hides inside ordinary transactions, behind friendly faces, in stores run by people who would never imagine their most trusted employee could be involved.

The defenses are not exotic. They are written policies, trained consistently. They are surprise audits, conducted unpredictably. They are POS exception reviews, run weekly. They are high-risk cycle counts, done on a cadence measured in weeks. They are cameras that capture useful angles and footage retained long enough to be useful. They are documented observations that accumulate into patterns. They are managers who walk the floor.

And, above all, they are an operational culture that treats verification not as distrust, but as a form of fairness — to the business, to the customer, and most of all to the honest employees who deserve to work in a store where the rules apply equally and where the people who follow them are recognized for it.

Owners who internalize these principles do not catch every case. No system does. But they catch the patterns earlier, lose less when they do find a case, and build stores where the opportunities for sweethearting are small enough that the behavior, when it appears at all, rarely survives the first month.

That is what protecting a business actually looks like. Quiet, consistent, unglamorous work — done every week, by people who understand that the absence of an obvious problem is never proof that nothing is happening.

If you would like to put any of this into practice, the related articles below cover the operational disciplines — surprise till audits, exception review, behavioral documentation, daily checklists — in greater depth. And the free printable resources in our resource library are designed to be hung in back offices, used in manager meetings, and put to work inside your store this week.