Internal Theft Special Issue 2025

Asset Protection | Profit Enhancement | Retail Performance

Insights Stopping the Snowball of Refund Fraud Getting Back to the Basics PLUS: Interviewing in Collusion Cases

INTERNAL THEFT SPECIAL ISSUE Internal Theft Special Issue 2025 | v24.6 losspreventionmedia.com

Stop theft before it starts...

with the system

Hook

Pusher

Spiral Anti-Sweep Hook™

LM Tag™ Loop with

LM Tag™ with

SONR™ System - Smarter, Stronger Store Security Protect your products where it matters most, right at the shelf. SONR™ is a complete wireless ecosystem that detects product activity and instantly alerts store staff.

From hooks and shelf pushers to LM Tags and more, SONR™ solutions deter theft by letting offenders know items are being monitored, all while relaying activity to the SONR Echo Box up to 200 feet away.

Easy to install and scale to any category or store, SONR™ integrates seamlessly with your existing security systems to create a powerful tiered alert network. The result? Immediate deterrence, real-time awareness, and smarter protection for every product.

Echo Box

Internal Theft Special Issue 2025

Contents

Features

6

18

Detect Internal Dishonesty

By Cory Lowe, PhD and John Matas, CFE, CFCI

Getting Back to the Basics

By Jacque Brittain, LPC

24

Seeing the Truth

By Tom Meehan, CFI

10

Caught in the Act

By Lauren Fritsky

26

Stopping the Snowball

By Courtney Wolfe

14

Beyond the Theft

By Dave Thompson, CFI

34

You’re Catching Just 2% of Internal Theft

By Colin Peacock

Departments 25 Ask The Expert Hanwha Vision

32 Solutions Showcase CISCO

This special edition of LP Magazine is sponsored by the following partners

EDITORIAL BOARD

Marty Andrews, CFI Vice President, Loss Prevention, VF Corporation

Rick Beardsley Senior Director of Loss Prevention and Safety, At Home Group

Ray Cloud Group Senior Vice President, Loss Prevention, Ross Stores

Scott Draher, LPC Vice President, Asset Protection, Safety, and Operations, Lowe’s

Carmen DuBose, LPC, CFI Senior Director of Asset Protection, Hibbett/City Gear

Brian Friedman, CFE, CFI, LPC Divisional Vice President, Asset Protection and Risk Management, REI Co-op

Malcolm Gaspard Senior Vice President, Loss Prevention, Kohl's

Scott Glenn, EDJ, LPC Vice President, Asset Protection, The Home Depot

Cynthia Grizzle, CFI Vice President, Asset Protection, Nordstrom

Robert Holm Director, Global Safety and Security, McDonald’s

Christyn Keef, LPC Vice President, Checkout Experience Walmart

Mike Lamb, LPC Vice President, Asset Protection and Safety, (Ret.) Kroger

Michael Limauro, LPC Vice President, Global Asset Protection, Whole Foods Market

David Lund, MBA, LPC, CFI Executive Director, International Association of Interviewers

Dan Moren Senior Manager, Starbucks

Richard Peck, LPC Senior Vice President, Loss Prevention, The TJX Companies

Hank Siemers, CFI Vice President, Global Protection Services, Tiffany & Co.

Mark Stinde, MBA, LPC Vice President, Asset Protection, Casey's

LPM's Editorial Board is composed of some of the loss prevention and asset protection industry's top executives from a wide range of retail sectors. These senior executives provide guidance to the LPM team on article topics and industry issues that are of current concern and interest to LP professionals. To learn more about the Editorial Board, contact Stefanie Hoover, CFI, at StefanieH@LossPreventionMedia.com.

Internal Theft Special Issue 2025

| 4 |

LossPreventionMedia.com

SOLUTION PARTNER BOARD

Rhett Asher

SVP, Community Relations and Partnerships

Brianna Witts

Amy Day-O'Connor

Stephen B. Longo

Stuart Rosenthal

Tom Meehan, CFI

Rex Gillette

Chris Reene

Craig Greenberg

Scott Thomas

Jordan I. Rivchun

VP, Global Sales

Chief Commercial Officer

Dave Sandoval President

Senior Industry Marketing Coordinator

CEO

Senior Director, Enterprise Marketing

VP, Retail Sales

Chief Revenue Officer/EVP

Head of Commercial

National Director for Signature Brands

Senior Director of Business Development

Vy Hoang

Cita Doyle, LPQ, LPC

Matt Kelley, MBA

Sharon Costanza

VP, Sales and Marketing

Head of Retail, Go To Market

Chief Customer Officer

Senior Enterprise Account Executive

Ned McCauley Alix Arguelles

Mike Jennings

Robb Northrup

Tony Sheppard, MSM, CFI, LPC

Director of Product

Director, Marketing Communications

Kevin O'Brien

EVP of Business Development

VP Sales, US Retail

Nick Rykhoff

VP, Retail Risk Solutions

President

LPM's Solution Partner Board is composed of the magazine's strongest solution provider supporters. These executives provide their counsel on how the magazine can better advance and serve the loss prevention and asset protection industry. To learn more contact Ben Skidmore at Ben@PartnersPR.com.

Loss Prevention Magazine

| 5 |

Internal Theft Special Issue 2025

Business Consultant, Retail Technologies

Scott Pethuyne, LPC

Sr. Analytics Solution Consultant

FEATURE

Getting Back to Basics

Internal Theft Investigations:

GETTING BACK TO BASICS

By Jacque Brittain, LPC

T

here are many specialized aspects of an effective LP program, with each function contributing to the department’s overall vitality. While a balanced approach is typically viewed as an integral part of program success, as the program evolves to meet the changing needs of the retail business, our focus may shift or pivot to

Internal Theft Special Issue 2025

draw additional attention where it is needed most.

This is how we add value—stability is essential, but flexibility is a must.

Recent trends have largely shifted the focus of LP department initiatives to pressing issues, such as organized retail crime (ORC). A legitimate threat across the retail landscape, these crimes frequently

| 6 |

LossPreventionMedia.com

dominate the discussion. While a serious threat, growing concerns about ORC don’t imply that other forms of loss have stopped, slowed, or become less important.

Internal theft and fraud are still among the primary drivers of retail shrink across the industry, and managing internal investigations remains a skill that sets us apart from most other retail professionals.

Strong investigative abilities have typically helped us stand out from our counterparts early in our careers. The passion to solve a problem, methodically and objectively gathering the pieces and separating fact from conjecture; the analytical process of finding substance in uncertainty; and the intuition to find answers when others can only see questions is initially what drew many of us into the LP field. We enjoy the search as much as the solution and find fulfillment as we unlock the unexplained.

Internal theft has historically caused extensive damage to retailers, carrying significant financial losses and a substantial impact on the business. Because employees have greater access to more systems, more products, and more areas of the store than customers, internal theft can typically influence a business much more quickly and to a significantly greater extent than most external theft incidents. In response, maintaining these investigative skills must be a constant and fundamental driver of any LP program.

Hearing from the Experts

Focused and productive teams are best measured by those who have their fingers on the pulse of LP programs: the industry leaders. To get a better sense of where we stand on the issue, LP Magazine reached out to the leadership of fifty prominent LP programs to gather their thoughts. To encourage participation and full disclosure, we allowed all leaders who participated the opportunity to provide anonymous responses and candid opinions on the subject. Below is a brief summary of the views of those that responded.

LP leaders feel that internal theft issues have increased over the past ten years, both within the industry in general and their own retail companies. No one believed that internal theft had dropped across the industry in general, and only 11 percent believe that internal theft has decreased within their own organizations.

Some argued that the advances in technology have made retailers more vulnerable to internal theft issues. Others pointed to a lack of overall respect for retail organizations and law enforcement, further complicated by the consequences of the crimes not outweighing the risks. On

a more positive note, several commented that while cases involving internal theft have increased, this may also be the result of better methods and tools used to detect these ongoing problems. Among the comments: “Opportunities have increased due to advances in technology as well as different forms of transactional methods—BOPIS, fulfillment, etc.”

“Collusion is also a significant part of the equation. There are more people being ‘planted’ into organizations to exploit and penetrate vulnerabilities than we have seen historically.”

“Internal theft cases are up, but our investigative capabilities have also matured.

I think we’re better at finding what already exists. With better investigation capabilities and the continued focus on hiring a higher quality, more engaged associate base, internal theft has decreased.”

“With the advances in technology, we see more exposure and the capacity to do more damage. particularly in the cyber and systemic exploitation areas.”

Industry leaders believe the types of crimes that employees are getting involved with have shifted to include new crimes.

With new technology and innovation comes new ways to steal. Leaders pointed to advances in transactional methodologies which create more opportunities for employees to commit internal theft. They feel employees are becoming more involved in crimes such as loyalty program abuse, high-level fraud, collusion, omni-channel thefts, gift card schemes, and using curbside pickup to get merchandise out of the store.

“Taking advantage of systems put in place to make shopping easier for consumers also opens doors for dishonest employees.”

“With improvements to CCTV and exception reporting systems, dishonest employees are getting more creative with the means by which they can try to conceal their actions. The surge of omni-channel has provided new methods for employees to leverage as well.”

“Associates are more aware of countermeasures and are growing more savvy at work around them. They are much more sophisticated at finding loopholes in newer technologies.”

The majority of industry leaders do not feel that internal theft issues are getting the focus and attention that they should.

Loss Prevention Magazine

Several commented that more visible topics like ORC and e-commerce fraud are getting much more attention, while some emphasized that we do have the tools necessary to quell some of the issues we are facing if we decide to use them.

“I believe that we can still leverage AI more consistently within the internal theft space to close internal investigations—issue identification, etc.”

“I think the industry organizations and vendor community understand the evolution of dishonest employees and do a solid job of providing continuous training and solutions to combat the trends.

“ORC is more visible, so we are overextending resources, training, and focus on external theft.”

LP leaders believe the area of the internal theft investigation process where practitioners need the most improvement is identifying the problem itself, followed closely by conducting

No one believed that internal theft has dropped across the industry in general, and only 11 percent believe that internal theft has decreased within their own organizations.

| 7 |

the actual investigation. Whether it’s navigating new systems, improving their skill sets, or developing the case through the entire process, industry leaders see an ongoing need for practitioners to continue building their overall investigative skills.

“Increased turnover and instability within AP teams have created an opportunity to revive the lost art of case building.”

“Internal theft is becoming a lost art. The focus on the basics needs to be emphasized in training.”

“Difficulty in navigating new systems makes investigations more challenging.”

Leaders feel strongly that developing and maintaining internal investigations skills is an industry imperative.

Handling these investigations is a core aspect of what we do and must remain a primary focus of our training and development efforts.

“It is a fundamental aspect of our acumen. There is a ton of focus within

Internal Theft Special Issue 2025

FEATURE

Getting Back to Basics In general, in what area of the internal theft investigation process do you feel LP practitioners need the most improvement?

Identifying the problem

44.44% 33.33%

Conducting the actual investigation The internal interview process

11.11%

Report writing and telling the story

5.56%

Evidence handling and the chain of custody

5.56% 0%

the industry on ORC, and internal theft investigations are often overlooked from a development perspective.”

“Internal investigation capabilities remain the core of any LP program. LP leaders must continue to grow and evolve their capability to meet the changing trends of the business.

This will and should always be a part of what we do and the need to conduct more sophisticated investigations is an area of need.”

10%

20%

30%

40%

50%

60%

Getting Back to Basics

Internal threats have always been a driving force for LP programs. Poor decisions and malicious intentions will

80%

90%

100%

continue to threaten the retail industry in perpetuity. While the types of crimes that we investigate will continue to evolve, the foundations of the investigative process remain. Sometimes all we need to do is get back to the basics and reinforce the messages that are at the core of what we do: ● An investigation is a search for the truth. It is a systematic, detailed inquiry intended to uncover facts and find answers. Ideally, we want those answers to uncover the cause, define the particulars, and produce a result that leads to solutions.

Beyond discovery, the process may include collecting, recording, analyzing, evaluating, and reporting our findings. Regardless of the type of investigation, the purpose of the investigation is to ascertain the facts. ● Investigations should be organized, methodical, and always conducted without bias or prejudice. Once the facts are determined through the process of investigation, decisions on how to react to those findings are easier to establish and resolve. ● There should always be a legitimate reason to conduct the investigation. The process may be initiated in a variety of ways, including personal observations, confidential tips, exception reporting, inventory results, audit results, or other methods. ● Substantiating information should be gathered that supports the validity of the investigation, and a valid relationship must then be established between the events that resulted in the loss and the supporting facts. This association must be clear and verifiable in a way

“Increased turnover and instability within AP teams have created an opportunity with the lost art of case building.”

“Whenever it is a person in a position of trust, the case value is much higher. They have a better understanding of our controls and blind spots. Do not be complacent with new technologies that ‘solve’ the issue of internal theft. Crafty and determined thieves will find the vulnerability.”

Companies and their LP programs vary greatly based on the type of merchandise sold, the venue, the company’s culture, the approach to the business, and countless other factors that shape how the organization does business. However, our industry leaders made clear that, regardless of the retail enterprise, the ongoing threat of internal theft is real, methodologies have evolved, and the problem is not getting the attention it deserves.

70%

Internal Theft Special Issue 2025

| 8 |

that a reasonable person would draw similar conclusions when presented with that information. ● The investigation should culminate in an interview with the subject involved.

Interviews are conducted to validate or disprove that the information and evidence corroborate the subject with the events that caused the loss. They may lead to additional information regarding the loss, other incidents, or others involved in illicit activity. ● No internal investigation is complete without the proper reports that document the various steps, facts, and facets of case development.

The written report should tell the story of the investigation. It is a direct reflection on the quality of the entire process, representing the totality of the work, value, detail, and effort put into the investigation. ● Your report should accurately reflect the facts of the case. The flow should follow a chronological order, be written in the first-person, and use simple, clear terminology. Grammar, spelling, and punctuation are direct reflections of the quality of the documents and are also crucial as others try to follow the flow of your investigation. It should represent the objectivity of the investigation and the professional approach to the entire process. ● Every company will require following its guidelines based on the practices of the individual retailer, and practitioners should review their company’s internal investigation policies.

The competency of a loss prevention program is firmly grounded in meeting the dynamic needs and expectations of the retail enterprise. While changing needs may demand our attention, we can’t lose sight of our ultimate objectives.

The need to balance all the different aspects of the program is what makes it most effective. l

Jacque Brittain, LPC, is editorial director for LP Magazine. Prior to joining the magazine, he was director of learning design and certification for Learn It Solutions, where he helped coordinate and write the online coursework for the Loss Prevention Foundation’s LPC and LPQ certifications. Earlier in his career, Brittain was vice president of operations for one of the largest executive recruiting firms in the LP industry. He can be reached at JacB@LossPreventionMedia.com

LossPreventionMedia.com

Don’t let ORC steal your Holiday Cheer!

Stop ORC Grinches with Alpha GPS powered by Ensurity!

Alpha GPS features: • • • • • •

Can be redeployed to combat new regional risks High Accuracy, High Tech hardware Proven in successful recoveries Complete service including SaaS tracking portal and full reporting suite Full Audit trail Full visibility on all devices, 24/7

Contact your National Account Manager to learn more!

FEATURE

Evolution of Cameras

Caught in the Act: How Camera Technology Has Evolved to Solve Internal Investigations

By Lauren Fritsky

T

he National Retail Federation defines internal theft as “an act of theft or fraud committed by a retail employee against their company or colluding with others to commit an act of theft or fraud.”

In its 2025 The Impact of Retail Theft & Violence Report, 85 percent of respondents reported that employee collusion with organized retail crime groups had either stayed the same or increased over the last year. When asked about the top

Internal Theft Special Issue 2025

three security measures or initiatives they have implemented that have resulted in the most significant recorded reduction in internal theftrelated shrinkage or loss, security measures and technology—exception-based reporting, cameras, and commercial closed-circuit television (CCTV)— ranked number one at 37 percent.

As both camera and video analytics technologies have evolved in recent years beyond their once manual, inflexible, passive-

| 10 |

LossPreventionMedia.com

The Evolution of Camera Technology: A Brief Timeline

9bdesign / Shutterstock.com

The origins of security camera technology date back almost fifty years.

Here is a brief decade-by-decade breakdown of how it has evolved since then: ● 1970s: Commercial CCTV solutions first hit the scene as black-and-white cameras connected via wired systems, enabling basic surveillance in stores and parking lots. Video cassette recorders (VCRs) also first emerged during this time and helped capture footage that allowed businesses to review incidents after the fact. ● 1980s: This decade saw the advent of color cameras that offered clearer footage, helping retailers and law enforcement better identify individuals and other visual details. Motion detection technology became more accessible, reducing storage needs by recording only when activity is detected, so LP pros could avoid reviewing endless hours of empty footage. ● 1990s: This was when everything started going digital, improving video quality, storage, and footage retrieval. Digital video recorder (DVR) systems replaced VCRs, extending storage, providing random access to any point in a video recording, and eliminating the constant

need to swap tapes. The introduction of timestamping became vital for legal evidence. ● 2000s: High-definition (HD) cameras enabled LP to more easily capture facial features, license plates, and other details.

Wireless technologies enabled cameras without complicated wiring, reducing installation time and costs. Remote monitoring was also introduced, allowing businesses to view live camera feeds from anywhere. ● 2010s: CCTV systems began harnessing AI for facial recognition, object recognition and tracking, behavior analysis, and automated alerts. Cloud computing began removing the need for on-site servers, allowing businesses to securely store footage in a scalable way. ● 2020s: AI and predictive analytics are helping to identify potential threats before they materialize.

When it comes to internal theft and CCTV, LP has both overt and covert cameras at their disposal. Savvy retailers deploy covert cameras by the hundreds, which are helpful for complex, strategic internal investigations because it’s not realistic to deploy live surveillance everywhere. Using camera technology like re-identification (Re-ID), a deep learningbased approach to matching visual identities across non-overlapping camera views, takes things a step further. Re-ID extracts feature vectors representing unique visual attributes, enabling the video management system (VMS) to recognize and track individuals as they move through different camera zones.

“That’s where I think internal investigations can really be unlocked, if you know what you’re looking for,” Rivchun said. “There aren’t that many innovative ways to steal. You’re either going to steal

Bringing a More Proactive Approach to LP

As in other sectors, technology often evolves to address new challenges.

And retailers face more complexities today than they did when security cameras first hit the market decades ago. This has necessitated a more realtime, proactive approach to all forms of retail shrinkage and crime, including employee-related theft.

“Retailers can’t take a one-size-fits-all approach to problem-solving, and I think that’s where cameras can come in,” said Jordan Rivchun, former senior director of business development at Hanwha Vision America, which sells security and video surveillance systems. “I think in the past, everything was very reactive: Let’s install a bunch of cameras, and then when something happens, go to LP, have them review it, and find that person. With software and hardware working together, you’ve been able to really shrink that amount of investigative time.”

Gorodenkoff / Shutterstock.com

monitoring origins, they now play a pivotal role in augmenting internal LP investigations. Retail loss prevention teams are increasingly turning to cloudbased security camera systems with artificial intelligence (AI) analytics, offering capabilities such as remote monitoring, advanced behavior detection, and intelligent search. We talked to a few solutions providers and retailers to get the lay of the land on how innovative camera capabilities reduce the time retail LP professionals spend scanning lengthy footage to identify internal incidents.

“LP investigators can use ‘appearance search’ to quickly determine if a person matching a description visited specific parts of the store, thus enabling them to bypass hours of uneventful video.”

—Sharon Costanza

Loss Prevention Magazine

| 11 |

Internal Theft Special Issue 2025

cash out of a drawer, out of a safe, off the floor, or in the stock room, or you’re going to pass it off. So, you can draw a virtual line over an area, and ask the camera to tell you when something came into this area, or when something left this area, when a male came into this area or a female, how long they were there for, any time you saw this person in the store.”

Sharon Costanza, senior enterprise account executive, video security and access control, Motorola Solutions, highlights “our advanced cloud camera and analytics solutions significantly streamline the work of LP professionals.”

“These smarter technologies allow retailers to execute highly detailed searches—for people, vehicles, or even someone wearing a backpack—reducing ‘noise,’” she said. “LP investigators can use ‘appearance search’ to quickly determine if a person matching a description visited

It’s imperative, however, that LP professionals don’t go out and make the case for new camera solutions before they know all the capabilities and features of the legacy systems already in place. specific parts of the store, thus enabling them to bypass hours of uneventful video.” This is highly beneficial, as it increases case closure rates and reduces investigation times.

James Stark, former segment leader at Axis Communications, which sells video surveillance systems, said that LP has gotten smarter with data and more direct in their algorithms and rules for what they seek in internal investigations as AI increasingly becomes part of camera solutions. He said, “The demand from retailers is to have that single pane of glass,” where all their systems are integrated into a central place.

A Tool in the Toolkit DC Studio / Shutterstock.com

FEATURE

Evolution of Cameras

It’s important to note that cameras are one tool in the LP toolkit for internal investigations and often work best when used with other technologies, such as exception and inventory reporting tools, and with human guidance. They serve, as Rivchun put it, to “help you see the story and tell the story. You still need a

human to help do that hard investigation.”

Cameras should also not be shoved in employees’ faces, as if to suggest they may or may not commit theft or another crime.

“Today’s technology is more advanced and less intrusive. It quietly supports a safe environment without disrupting the experience for our team members or customers,” said Rick Beardsley, senior director of LP and safety at furnishing chain At Home. “Certainly, our CCTV systems are utilized for a variety of initiatives, but most importantly for safety and protecting our assets. Keeping our team members and customers safe is our priority.”

The adoption of cloud-based camera and software technology has significantly streamlined the process for retailers to easily upgrade existing surveillance systems and transition from older, legacy systems to cloud-based solutions. In the case of Motorola Solutions, they can also use existing camera infrastructure (analog or IP) and migrate to the cloud for storage and analytics, according to Costanza.

Costanza elaborated on the key advantages: “A cloud system allows for cameras to be replaced as they fail— either with cloud-native technology or continuing with the current infrastructure.”

This system offers significant IT benefits, including automatic updates/ upgrades that eliminate the need for manual maintenance, server upkeep, or managing multiple servers in a dedicated space. Open cloud technology enables seamless integration with other investigative tools, including exceptionbased reporting, case management, and access control. Investigators can access these systems by connecting directly to the cameras via browser or mobile applications.

Counter to the cloud, “edge-based” camera solutions also exist that rely on

“Today’s technology is more advanced and less intrusive. It quietly supports a safe environment without disrupting the experience for our team members or customers” —Rick Beardsley Internal Theft Special Issue 2025

| 12 |

LossPreventionMedia.com

with Rivchun’s example of someone who has cobbled together a variety of different camera systems over the twelve years in his role.

“Basically, my technology in the LP and safety department is anywhere from one to twelve years old,” he said. “Some cameras that are five years old don’t have the advanced technology for what I’d like to accomplish—for example, highlight motion created by humans vs. signs waving or headlights shining in through the doors.”

He shared a few criteria for assessing whether he should swap out one system for another: 1. “Are there any pain points?”

2. “Is there some really compelling reason to take on the workload that I would need to convert everything I have into something new?”

3. “Is the new thing more affordable over the next three to five years than maintaining the current?”

4. “Does the new thing have such a great feature that nobody else has or cannot be replicated quickly?”

5. “Can I align changes with other contract expirations?”

“So, the chances of consolidating current structure into one technology group are likely slim, and generally, if you were starting over, securing the budget and the IT capacity would be a challenge,” he said.

Questions to Ask Potential Camera Solution Providers

If you’re looking to upgrade your camera technology to support internal LP investigations, our sources shared a few key tips.

Stark: “It needs to be the question that’s asked up front: Who do you work with?

How do you work with them? What does that look like? From a pricing and scale structure, what does the integration look like? How strong is your relationship and your partnership with said ecosystem partners?” Other questions he encourages retail LP pros to ask include: ● How are we leveraging object analytics and other types of analytics? ● What can I put into the camera that sits on the camera itself, so I don’t have to have a server?” ● Do you need visual data or just metadata?

Beardsley: “I think the first thing is utilizing non-proprietary devices and remaining agnostic. I think the ability to be nimble, especially in today’s environment

Loss Prevention Magazine

| 13 |

9bdesign / Shutterstock.com

data at the “edge” of a network—closer to the source of data generation—rather than a central cloud server to curb latency and bandwidth usage given the fact that most retailers face network bandwidth constraints that prevent them from streaming high-resolution video live or recorded back to a central location. These edge-based capabilities also mean that retailers do not need to upgrade all their camera technology to get what they need from these systems today. If a retailer has significant investments in existing camera infrastructure—even as dated as analog—they can couple it with edge- or software-based solutions that can take video streams, process them, feed them into their model, and then run their model on that raw video to understand where people flow in their stores, what zones are the most high traffic, and if someone shelf swipes an area.

It’s imperative, however, that LP professionals don’t go out and make the case for new camera solutions before they know all the capabilities and features of the legacy systems already in place.

“I found that most of the time, nobody’s using a fraction of what a system is capable of doing, and that that’s on us as a manufacturer, that’s on integrators overselling and misrepresenting, and that’s on end users not being informed of what the capabilities are and how they actually scale them,” Rivchun said. “That’s really to me the three-legged stool of the evolution of partnership in the space: the manufacturer, the retail end user, and, of course, the industry solution provider working together to determine how much existing infrastructure we can leverage to solve this problem.”

Stark said that as retail LP continues to stitch together multiple solutions from multiple providers, it becomes critical for vendors to become open source and “to be open to those integrations and different systems under one roof.”

“How do we integrate all of these solutions so that, from an internal investigations perspective, we know there are twenty TVs stacked up next to the back door that shouldn’t be there?” he said. “And not only bring them together, but also have some interdependencies of communication?”

Beardsley’s approach at At Home has been to prioritize non-proprietary camera systems that are easier to integrate and that regularly update features. He aligns

Re-ID extracts feature vectors representing unique visual attributes, enabling the video management system (VMS) to recognize and track individuals as they move through different camera zones.

and economy, when you give up control to a proprietary company, and you’re kind of stuck with them as your contract comes up, you are somewhat at their mercy.

If you can’t use their device with other technology, you may have signed up for a large, unplanned expense. You need to make yourself future-proof, because you need to be able to evolve without replacing everything.” l Lauren Fritsky is a seasoned journalist and content marketer whose work has appeared on CNN, AOL, USA TODAY, Huffington Post, Travel+Leisure, Entrepreneur, Adweek, and many other websites. She’s spent the last eleven years writing about IT, adtech, martech, retail, and e-commerce for global companies. Lauren earned a bachelor’s degree in English from La Salle University in Philadelphia.

Contact her at Lauren.fritsky@gmail.com.

Internal Theft Special Issue 2025

FEATURE

Beyond the Theft

Beyond the Theft:

Investigative Interviewing in Collusion and Organized Retail Crime Cases

By Dave Thompson, CFI

T

he booster walked out the front door with bags of stolen merchandise, but the real source of the loss was standing behind the register.

At first glance, it looked like another ORC grab-and-go, a quick, efficient, and significant theft from the store.

But when the team reviewed video,

Internal Theft Special Issue 2025

something didn’t add up. Cameras caught an associate disabling EAS tags minutes before the crew arrived. The fitting rooms were left unattended and the emergency exit door was propped open. A pattern started to emerge: every incident linked back to that same shift, same employees, and same door.

| 14 |

LossPreventionMedia.com

This wasn’t just an independently operating external theft incident; it was a cooperative effort. That changes everything about the investigation and the preparation for an interview. Investigating employee collusion isn’t about catching one bad actor; it’s about uncovering how organized groups infiltrate your operation from the inside out and how a wellconducted interview can open a doorway into the network behind the crime.

ORC investigations are increasingly revealing that insiders across organizations (supply chain, retail, IT, procurement, etc.) are being recruited, coerced, or paid to help external theft crews bypass controls.

These internal partners don’t always steal merchandise or cash themselves, but their cooperation can multiply losses exponentially.

The challenge for investigators isn’t simply proving that theft occurred; it’s identifying how employees became part of the system, who recruited them, and what intelligence they hold about the larger network. That requires a different mindset for the preparation of an interview, one designed not only to close a case, but to open the next lead. Investigative interviewing aims to gather actionable and reliable intelligence, not just a confession, and in collusion cases, that is vital in having an actual impact on shutting down these operations.

D Line / Shutterstock.com

Understanding the Nature of Collusion

Just because an employee is not complying with company policies or forgets to lock a door does not prove they are part of an organized crime ring.

Part of the investigation is understanding that some company safeguards may fail, employees may need more training, or the organization may need better oversight.

Collusion in this context is the intentional collaboration between employees and those outside of the organization to commit a crime, such as theft or fraud.

Depending on their level of access to an organization, employees can create significant opportunities for bad actors by sharing information or physically manipulating security devices.

Investigators have seen this type of behavior evolve over the years, beginning with some of the most basic types of collusion: staging merchandise near exit points, passing merchandise off at the

”

A simple but often overlooked step in preparing for an interview is proactively identifying the goals or areas of the investigation that should be explored.

”

profit. Employees involved in theft schemes with external actors may have slightly different motivations for their behavior and fears for consequences.

Investigations have shown that some employees may be involved in collusion schemes primarily for financial gain, where they receive a kickback relative to the theft amount. However, not all cases or people have the same motivation. On the other hand, some employees have shared that they were coerced into joining an organized ring through fear or threats from outside actors. An employee “helping a friend” by passing off merchandise may have different motivations or fears of cooperation than the person who is part of a larger criminal organization. The latter example may have dual loyalty, to both the company and the illegitimate operation—which may also contribute to fears of consequences on both sides of the equation.

Implications for Interviews

point-of-sale, or removing EAS sensors.

Larger-scale operations may include employees disabling alarm systems, staging large amounts of cash, or providing unauthorized access to secure areas. In a more data-centric environment, employees could also manipulate inventory results to conceal theft, fabricate point-of-sale activity, or share proprietary information that creates vulnerabilities for bad actors. From an informationsharing perspective, involved employees may exchange schedules for security personnel, the locations and timing of expected shipments or deliveries, or even technological weaknesses (e.g., a lack of video coverage in the supply room).

These actions are just a few of the many ways that we have seen employees contribute to organized theft.

Understanding the access and opportunity that employees have can help in facilitating security protocols, audit processes, and ultimately the strategy of an investigative interview. It’s also important to consider the “why” behind employee collusion, as it may be bigger than the simple motivation of personal

Loss Prevention Magazine

| 15 |

Given the broad scope of potential involvement, investigators must enter these conversations strategically, casting a wide net to capture as much actionable information as possible. These conversations require building authentic trust and rapport, rather than confrontation.

Step one is to re-establish the goal of an interview as information-gathering versus confession-seeking. Our intention should be to obtain intelligence that allows us to further the investigation, map the network, and not just secure a statement.

In a world of data-sharing and technology-supported investigative tools, the power of the investigative interview can be the catalyst for bringing intelligence to case management.

Understanding the ecosystem of an organization’s investigative resources can help in the strategic preparation of an interview. License plate readers, facial recognition, RFID technology, and AIsupported video surveillance are just a few of the many tools available to investigators that can both support the efforts of an interview and corroborate or disprove information obtained.

The mindset for entering an interview with an employee involved in collusion must be intelligence-focused. Instead of seeking a confession for an incident that’s well documented, interviewers should seek to obtain a wider range of

Internal Theft Special Issue 2025

information about what the interviewee knows and how they came by that information. Focusing on a broader range of intelligence targets, like logistics, communication, timing, organizational charts, and geographic coverage, can help the investigator advance the case rather than close it down with minimal information. With additional intelligence, leveraged with technological resources, the information becomes more actionable, the cases more prosecutable, and ultimately helps shut down illicit activity. These interviews are part of an ongoing case development to understand the broader criminal ecosystem, rather than the conclusion of an investigation.

Preparing for the Interview

As in any interview, the strategy begins well before the conversation starts.

Although some ORC-related interviews may be spontaneous based on the nature of the case, the more intelligence an investigator can gather beforehand, the more helpful it will be to strategic preparation. In addition to reviewing available evidence, investigators should take advantage of reliable informationsharing platforms that help to inform them of data or patterns that may be relevant to the conversation at hand.

Knowing the vehicle model used in a booster hit or the name of the fencing location where the merchandise is being resold could help build the credibility of the investigation.

A simple yet often overlooked step in preparing for an interview is proactively identifying the goals or areas of the investigation to be explored. Interviewers should map out the intended scope of the conversation beforehand to include operational vulnerabilities, other potential parties involved, the crew’s geographic coverage, and how they communicate with each other. Having a list of objectives (not a script of questions) allows the interviewer to adapt throughout the conversation, as the interviewee may be more or less willing to share in some areas than others.

Conducting the Collusion Interview

All investigative interviews should be conducted in a way that promotes evidence-based approaches to rapport, credibility, empathy, and the way in

“The mindset of entering an interview with an employee involved in collusion must be an intelligence-focused approach. Instead of seeking a confession for an incident that’s well documented, interviewers should look to obtain a wider range of information on what the interviewee knows and how they came about that information.”

”

which we ask questions. The interview of an employee potentially involved in collusion is no different; however, certain things are important to focus on relative to these types of cases: Build rapport with credibility and empathy: These employees may feel trapped between loyalty and fear.

Showing empathy for the situation, without leniency, can help create a comfortable environment.

Internal Theft Special Issue 2025

| 16 |

Use open-ended, strategic questions: Leading and direct questions will potentially increase resistance and could reveal evidence we may want to withhold. Our goal is to obtain intelligence, not provide it. Rephrase the direct accusatory question to one of curiosity.

Explore networks, not just actions: Remember, these investigations are about more than the incident in front of you. Attempt to ask questions about the parties involved, their roles, and communication methods—not just the outcomes.

Understand and manage resistance: It is natural for a person to be defensive or resistant in these situations. Our job is not to force cooperation, but to be adaptive in our approach so we can create an atmosphere where they are sharing to be cooperative—not compliant.

Leverage the unknown: These cases are still developing, and interviews may be exploratory in nature. Withhold key evidence to prevent contamination, but if helpful in moving the conversation forward, present known evidence in a strategic manner to maintain the integrity of the investigation.

Capture and preserve intelligence: If permitted, electronically recording these interviews can be helpful for the investigation. If not, make sure to document all details provided, as the power of information only grows stronger in a data-sharing investigation.

With more technology than we’ve ever had before, it’s essential that interviewers don’t forget the power of human intelligence. With more evidence and data available, our interviews should be better informed and better prepared than ever before. When we treat each interview as a source of intelligence rather than an endpoint, we stop just collecting statements and start dismantling criminal networks. l David Thompson, CFI, is the president and partner at Wicklander-Zulawski & Associates, providing investigative interview and interrogation training to a global audience. He has served as a subject-matter expert in developing curriculum and providing consultation to investigators, attorneys, and the academic community. He can be reached at dthompson@w-z.com.

LossPreventionMedia.com

V.studio / Shutterstock.com

FEATURE

”

Beyond the Theft

INTELLIGENCE IS THE KEY InstaKey’s cloud-based software allows you to track and audit any key www.InstaKey.com | (800) 316-5397

ShutterstockAI

FEATURE

How To Detect Internal Dishonesty

How to Detect Internal Dishonesty

O

ver the past five years, retailers have publicly expressed more concerns over violence and ORC than any other crime or malicious source of merchandise loss. However, there is no reason for anyone to believe the prevalence or rate of employee offending has decreased. Rather, there are several reasons to believe it has worsened, including the expansion of several different transaction, delivery, and sales channels, which all create additional opportunities for employee offending.

Nevertheless, internal dishonesty has not garnered the attention that ORC and violent crime have, and this is not just because it isn’t a serious problem.

Violence and ORC might gain greater attention because they are simply more visible. In some cases,

By Cory Lowe, PhD, and John Matas, CFE, CFCI

Internal Theft Special Issue 2025

| 18 |

LossPreventionMedia.com

these crimes may be more “visible” because they require greater levels of external collaboration among retailers, law enforcement, and other stakeholders.

There is less of a reason to publicly decry internal losses when these can often be addressed without extensive collaboration with other stakeholders; in other words, retailers can often exert greater independent influence over employee dishonesty than these other crimes.

This article will review methods retailers can use to better detect internal dishonesty; this is a necessary first step for estimating the extent of internal losses and their relative contribution to overall losses. Some of the greatest opportunities involve new twists on common practices like exception-based reporting (EBR), as well as leveraging technologies like computer vision and radio frequency identification (RFID). But, just like any problem within the industry, internal dishonesty is not distributed evenly. There are store locations, areas within stores, and other factors that drive risk, and, for the sake of efficiency, retailers would do well to focus

prevention, detection, and other control measures where there is greatest risk.

Understanding the Basics: Why Employees Offend

To build programs that target risk, it is important to understand why employees offend. When we say “why employees offend” we are not referring to their motives or what they are hoping to accomplish via crime—rather, we are talking about the causes of employee dishonesty and crime. Employee theft, fraud, and other dishonest acts typically come down to a few key factors, including motivation, criminal propensity, and opportunity. ● Motivations and propensity include all the factors that influence individual differences in the likelihood of committing crime in the presence of similar opportunities. This can include financial stress, pro-criminal beliefs, feeling undervalued or treated unfairly, and many other factors. ● Opportunities to commit crime include all the weaknesses in protective measures—in other words, opportunities are what give individuals with greater

Loss Prevention Magazine

| 19 |

motivation the ability to commit crimes with minimal risk of detection and consequences. ● Supervision is a critical factor, and many retail leaders would say that every instance of employee theft or fraud is a breakdown in supervision.

Therefore, we would expect to see crime where motivations or propensity and opportunities are present; if someone has the opportunity to commit crime but no propensity or motivation, then crime is unlikely. Alternatively, if an individual has the motivation or propensity to commit crime, but is in prison, they will lack the opportunity to engage in many types of crime.

These realities have serious implications for the detection of employee offending. If we assumed that motivation and criminal propensity were evenly distributed throughout the population (they aren’t), we would expect to see greater employee offending among those with greater opportunities. For example, we would expect to see greater cash theft and embezzlement among those who directly handle cash or work in accounting.

Alternatively, if opportunities are evenly

Internal Theft Special Issue 2025

FEATURE

How To Detect Internal Dishonesty distributed, we would expect to see more offending among those with greater motivations or propensity.

On one hand, employees have greater opportunities to commit many crimes than non-employees for a few reasons. First, external offenders must make a special trip to a retail facility, while retail workers are there because it is their job. Second, employees have the proverbial “keys to the kingdom.” They are given the ability to bypass protective measures because it

such as their work schedules, POS transaction data, surveillance footage, and more.

However, an additional advantage is that, unlike many types of non-employee offending, retailers have additional options beyond simply restricting opportunities to commit crime. With non-employees, there is not much retailers can do to impact the motivations and propensity to commit crime. In some cases, LP programs and other parts of the business can address

is their job. Third, employees are familiar with safeguards and protocols and may be much more aware of how to evade detection. Finally, employees interact with non-employees, creating unique opportunities for collusion; therefore, some internal actors can assist external, lesser-known actors in the commission of their crimes, making those crimes more difficult to detect, investigate, and ultimately control. This is especially a problem regarding ORC factions that will recruit employees using coercion or compensation. All of this is why employee supervision and internal controls are so important for preventing employee crime.

With all of this said, it may seem like things are bleak for retailers. Still, there are additional opportunities to prevent, detect, and address employee dishonesty that do not exist for external offending. First, with some types of employee crimes, there are specific controls that retailers can put in place, and there are unique opportunities for supervision and monitoring. For example, LP programs can analyze much more data related to employee offenses,

Milan1983 / Shutterstock.com

There is less of a reason to publicly decry internal losses when these can often be addressed without extensive collaboration with other stakeholders; in other words, retailers can often exert greater independent influence over employee dishonesty than these other crimes.

personal and social factors that contribute to employee offending.

Researchers have discovered many individual and social factors associated with employee crime generally, and crime among retail workers specifically. Risk factors for employee dishonesty include low job satisfaction and commitment, dissatisfaction with management, financial hardship, perceived unfairness, lack of supervision, limited long-term job prospects, pro-criminal peer and social influences, low self-control, and low workplace autonomy, which is also associated with job dissatisfaction. All these risk factors are, theoretically, similar to many other types of crime in that they involve personal stress and strain, social influences, and employees feeling they have little or nothing to lose if they victimize their employer.

When individuals have pro-criminal attitudes, beliefs, and knowledge (e.g., how to commit crimes), they will be more likely to engage in those behaviors. If retailers have unclear norms or behavioral standards, allow unethical behavior to

Internal Theft Special Issue 2025

| 20 |

LossPreventionMedia.com

go unchecked, or fail to counter criminal attitudes within their locations, they may struggle with internal losses. In the case of personal stresses and strains, retailers have options to alleviate some of these pressures, including managing working conditions and providing support to their employees during periods of hardship (e.g., employee assistance programs).

Company culture is critical, and it must be created and sustained by management. If employees see that corners are being cut and that unethical behavior is tolerated (either for “favorite” individuals or more generally), dishonesty can become normalized. ORC and violence are obvious and often reported, but many forms of employee crimes are much less visible; therefore, it is critical for internal dishonesty to be addressed when reported, so it does not fester. However, while it is crucial to establish a company culture that encourages reporting and discourages internal dishonesty, retailers can create unintended effects if they are too heavy-handed. In this case, retailers can create a culture of distrust, which may worsen internal dishonesty by generating disengagement and resentment, leading some employees to rationalize their offenses. For example, employees may begin to ask themselves, “My employer does not trust me or even care about me, why should I care about them?”

Retailers can collect data on these risk factors throughout their organizations, which can help them focus their efforts to combat employee offending, including detecting internal dishonesty. Retailers can use surveys, turnover data, and employee engagement and sentiment data as part of internal risk analyses. For example, a store with low morale and high turnover may be at greater risk for internal dishonesty.

There is a lot that retailers can do to influence risk factors at the store

Employee theft, fraud, and other dishonest acts typically come down to a few key factors, including motivation, criminal propensity, and opportunity.

level and individual level. There are also many other ways for retailers to limit employees’ opportunities to offend by increasing supervision and monitoring, and by implementing additional controls and processes. Much of what we do at the Loss Prevention Research Council is based on the principles of situational crime prevention. Situational crime prevention suggests that we can modify situations and environments to increase the costs of crime to offenders and reduce the benefits. There are three key actions that retailers can take, including: (1) increasing the amount of effort required for employees to victimize the company, (2) increasing the risks associated with victimizing the company, such as the likelihood of disciplinary measures, up to and including termination and criminal prosecution, and (3) reducing the benefits of crime. Many of the detection measures retailers can put into place will make offending more difficult and riskier for employees to victimize their employers.

Technologies, Processes, and Practices for Detecting Employee Dishonesty

Fortunately, there are many ways retailers can detect employee dishonesty, and many of them are well-known in the field. However, it can be very challenging to build programs that can address the challenges at scale while remaining thoughtful and strategic. In this section, we are going to review many of the methods for detecting employee offending; however, retailers should not expect to succeed by simply selecting a few ideas and “throwing solutions at the problem.” Instead, LP teams should build coherent, layered programs to detect and control employee offending in a variety of complementary ways. This means thoughtfully leveraging hiring standards, personnel, processes, training, and technological strategies focused on areas with the greatest risk. As discussed earlier, the risks are greatest where there are greater opportunities for internal dishonesty and where there is greater motivation or propensity for employee offending.

Education, Awareness, and Training

Education, training, and awareness are critical elements of any program. If done properly, this can enhance the team’s collective ability to detect employee offending and also raise awareness of existing programs. It is one thing to have

programs in place, but for programs to have their full effect on employee offending, employees must be aware of them.

For example, if a team of investigators is dedicated to investigating internal dishonesty but employees are unaware of it, its deterrent effect will be limited.

There are challenges and risks with training and awareness. On one hand, there is the possibility of backfire effects if education, training, and awareness are not carefully designed. For example, if retailers are not careful, they could make employees aware of opportunities to victimize their employer or of real or perceived vulnerabilities in controls and LP programs. Furthermore, if education and training are too heavy-handed, it may come across as accusatory or distrustful of employees. Similarly, there are practical challenges, such as maintaining workforce training in the face of turnover and rapidly changing forms of offending. On the other hand, training and awareness, if not done carefully, can make employees aware of opportunities to victimize the organization.

Inventory and Asset Tracking

Inventory and asset tracking technologies have advanced considerably in recent years, providing retailers with more precise and proactive ways to detect internal dishonesty. Traditional electronic article surveillance (EAS) remains valuable, particularly when used as a visible deterrent, but does not offer the kind of information provided by other systems.

EAS can identify that an item has left the premises; however, it cannot confirm which item was removed, whether it was sold legitimately, or who was responsible.

RFID technology overcomes many of these limitations. By assigning a unique code to each product, RFID allows retailers to trace individual items from receiving to sale, and can even help to identify stolen products after they have left a store location. When readers are integrated with transaction data, RFID systems can detect merchandise leaving the store and immediately determine whether a corresponding sale occurred. If no transaction record exists, the system can flag the specific item and time stamp for investigation. This precision is invaluable for identifying both external theft and internal diversion.

RFID data can also be used to detect discrepancies within stores. For example, if high-value products consistently leave

Loss Prevention Magazine

| 21 |

the stockroom but are not replenished on the sales floor or sold at POS, that movement pattern may indicate internal loss. Similarly, items marked as returned through the POS can be traced to confirm that they were reintroduced into inventory rather than diverted elsewhere. Finally, a lot of merchandise can be stolen before or after close; understanding when product is exiting the store during these times is critical.

Where RFID adoption is not yet feasible, traditional inventory control techniques remain essential. Frequent cycle counts in high-risk categories, audits of receiving processes, and immediate reconciliation of shipment discrepancies can detect theft or manipulation. Integrating these traditional practices with systems like inventory management software or video verification can provide a better understanding of loss activity. In short, effective inventory and asset tracking programs combine physical verification with data intelligence, ensuring loss detection and visibility.

LP teams should aim to build coherent, layered programs that aim to detect and control employee offending in a variety of complementary ways.

This means thoughtfully leveraging hiring standards, personnel, process, training, and technological strategies that are focused on areas with the greatest risk.

Anonymous Reporting

Anonymous reporting programs are among the most cost-effective and revealing methods for detecting internal dishonesty. This is because employees are constantly interacting with their peers and are more likely to notice internal dishonesty before management or others.

However, the success of these programs depends entirely on design and followthrough. Retailers that offer employees a confidential, accessible, and credible way

Internal Theft Special Issue 2025

to report unethical or suspicious activity can surface problems long before they result in significant loss. Anonymous reporting systems can take many forms, including third-party hotlines, apps, or QR codes in employee areas linked to reporting forms. You can even go old school and place physical drop boxes in employee areas. Regardless of which you choose, employees must believe their reports are reviewed by someone capable of taking appropriate action.

Anonymous reports often lack specific details, yet they can provide valuable directional intelligence when paired with other data. If multiple anonymous tips reference the same associate, department, or pattern of behavior, these reports can inform where EBR, audits, or video review efforts should be focused.

Effective programs also close the communication loop by acknowledging that information was received and acted upon. Ensuring action is key to encouraging employees to participate; people engage in behaviors when there is some kind of benefit to doing so. If there is no benefit, or if employees see no action as a result of reporting, then they have little reason to continue doing so, and problems can fester.

Exception-Based Reporting

Retailers have a lot of transaction data, and this volume is only growing.

This reality creates a problem, but also conveniently provides a solution to that problem. The problem is the quantity of transactions—there are simply too many for any human to review manually.

However, large datasets enable the identification of what is not “behaviorally normal” or anomalous. This is the heart of EBR.

Inventory and asset tracking technologies have advanced considerably in recent years, providing retailers with more precise and proactive ways to detect internal dishonesty.

Auditing and reviews remain essential tools for detecting internal dishonesty; they create accountability, expose patterns, and reveal breakdowns in supervision that allow employee theft or fraud to occur.

PeopleImages / Shutterstock.com

FEATURE

Detect Internal Dishonesty

A well-designed EBR program can analyze massive amounts of POS and operational data to identify anomalies, such as voids, returns, discounts, overrides, and unusual no-sale transactions (i.e., exceptions to the norm).

If there is one employee or a group of employees who are engaging in these activities more than others, that might be concerning, particularly if there is not a good reason for a team member to do more of this. For example, we would expect a supervisor or manager to engage in far more of these types of activities.

Modern EBR programs can also incorporate other forms of data, enabling additional detection and investigation opportunities. For example, operational data, such as employee schedules, store traffic data, and other forms of data, can be incorporated into EBR programs. Video can be used review and verify exceptions, but there are a lot of potential use cases for video analytics. For example, if you have a dumpster analytic to gauge how often people are taking out trash. This could catch operational inefficiencies or time theft, but it could also catch people who are passing off merchandise via the dumpster. Similarly, analytics could be used to capture when employees have personal bags near registers and how often they engage in certain behaviors or motions. A lot of basic analytics are

Internal Theft Special Issue 2025

| 22 |

available today, such as person detection or object detection, and the use cases will only continue to multiply. There are increasing opportunities for cross-channel anomaly detection, where data from one sale, transaction, or delivery channel can be used to detect anomalous behavior in another channel.

One implication of EBR is that relevant data must be machine-readable and accessible to analysts if it is going to be used effectively. Unfortunately, there is still a lot of the retail business that involves manual processes and handwritten records, signatures, counts, and other important data. If these records are not digitized, they cannot be analyzed at scale, and EBR is not possible. Even if the data is in digital form, LP cannot analyze the data if it is not accessible or in a usable format. For example, there may be a digital record of certain activities, but it may not be available in an easily accessible database.

Auditing and Reviews

Auditing and reviews remain essential tools for detecting internal dishonesty; they create accountability, expose patterns, and reveal breakdowns in supervision that enable employee theft or fraud. For example, access control logs can be cross-referenced with employee schedules or timekeeping data to identify unauthorized entries into cash offices,

LossPreventionMedia.com

stockrooms, or restricted areas. If an employee accesses a secure space while off the clock, or far more frequently than others in similar roles, then this behavior may need to be investigated. Login audits provide another powerful tool. Comparing POS login activity with time clock data can expose when employees may be using others’ credentials. Similarly, reviewing when employees clock in relative to when they begin transactions can uncover small but consistent patterns of time theft.

Physical review processes should not be overlooked. Random bag checks or locker inspections, conducted consistently and respectfully where permitted, can deter both theft and concealment. Likewise, periodic reviews of refund, void, and discount transactions—particularly those processed outside normal patterns—can reveal manipulation that might otherwise appear legitimate.

Process-compliance audits can be just as revealing as financial audits. For example, verifying that merchandise from refunds actually returns to the

shelf, or ensuring that cash variances are properly documented and escalated, can help surface not only dishonesty but also vulnerabilities in the program. The best audit programs focus on risk areas identified through exception reporting, store performance, or past incidents; in other words, they ensure resources are directed to where the likelihood of dishonesty is highest. Therefore, programs must be flexible enough to change focus as risk evolves or shifts.

Conclusion: Risk-Based Detection

In the end, the best way to detect internal dishonesty is to leverage solutions and strategies tailored to the risk.

Throughout this article, we have discussed known risk factors for employee dishonesty and methods for detecting it. To make LP programs as efficient as possible, retailers should assess where they are most likely to face challenges and deploy solutions and strategies to those locations.

Since there is a baseline level of risk throughout the enterprise, retailers should

ensure they have the basics covered while targeting high-risk stores and locations within stores with appropriate strategies. l Cory Lowe, PhD, is the director of research at the Loss Prevention Research Council. He received his doctorate in criminology in 2020 from the University of Florida, where he specialized in crime and delinquency prevention, communities and crime, criminological theory, and research methods and data analysis. Lowe has published in peer-reviewed journals and other scholarly publications on the causes of crime and crime and delinquency prevention. He can be reached at cory@lpresearch.org.

John Matas, CFE, CFCI, is a retail industry consultant with over 30 years of experience in omni-commerce fraud, financial crimes, asset protection, and investigations. John was the VP of investigations, fraud, and ORC for Macy’s for over 25 years. Most recently, John served as the global head of risk and fraud at Etsy Inc., where he oversaw the organization’s fraud strategy and framework. He can be reached at john@ blacklightsecurity.com.

Visual Intelligence Your Edge Against Shrink and Threats.

Shrink costs billions every year. Our Visual Intelligence suite equips your business with proactive, video-first security by combining real-time monitoring, advanced analytics and responsive deterrence.

It’s not just about watching—it’s about understanding threats and proactively acting on them.

Experience intelligent security tailored for you. www.vectorsecuritynetworks.com

Loss Prevention Magazine

| 23 |

Internal Theft Special Issue 2025

FEATURE

Seeing the Truth

Seeing the Truth: How Recording Interviews Protects Retailers and Employees Alike

By Tom Meehan, CFI

I

t is understandable for retailers to focus on external theft in their efforts to reduce shrink especially with the growing scourge of organized retail crime. But internal theft continues to represent a major contributor to shrink losses.

According to a recent survey by the National Retail Federation, 23 percent of shrink losses were attributable to internal theft.

These incidents can range from employees hiding items as they come off the pallet to sophisticated cyber operations by those with access to company data.

Whatever the nature of the incident, it is imperative that managers handle their employee interviews carefully and professionally. That begins with recording each interaction from start to finish. This is now an essential practice recognized by professional organizations as diverse as the American Psychological Association and the National Institute of Military Justice.

I can personally attest to the importance of recording interviews from my experience.

During my employment with a major retailer from 2005 to 2017, we recorded every interview, and the results confirmed the value of the practice. Two real cases from that time show why it’s important to have clear evidence of what happened in an interview.

In the first case, an employee suspected of a minor theft was interviewed in a customary way. But afterward, she claimed the interviewers had screamed at her and put her in a dark room. Fortunately, we had the video evidence that showed none of it was true. Had we not recorded the interview, it would have been a classic he-said, she-said standoff.

In the second case, an employee claimed he had been coerced into writing a statement.

But the video showed the interviewer repeatedly saying he could not dictate what the interviewee should write. The company was vindicated.

The Value of Recording Interviews

The most obvious benefit of recording an interview is to prevent the types of false accusations described above. In the law enforcement realm, improper interview procedures can lead to needless acquittals or dropped charges. The same is true for retailers, who face the added risks of lawsuits and litigation expenses, not to mention reputational harm.

Recording also enables LP staff to improve their professionalism by reviewing their videos.

For some, this may be uncomfortable at first, but they can come to see it as an invaluable tool. Interviewers can view their own body language, tone, and pacing from the camera’s objective viewpoint. They can receive valuable feedback from their peers. And they can adjust their approach accordingly. The video becomes a coaching tool to make the interviewer more professional.

Interview Best Practices

Here are some essentials that can help make every interview effective and irrefutable: 1. If possible, have dedicated interview recording equipment. This helps staff to control the process and avoid unwanted distractions.

2. Provide the subject with proper waivers, stating that the interview may be recorded (video and audio), with the interviewee’s acknowledgment and consent.

3. If interviews happen often, equip the interview site with clearly visible,

Internal Theft Special Issue 2025

| 24 |

appropriate signage, alerting subjects that “Interviews in this room may be audio and/or video recorded for quality and security purposes”—or something similar.

4. Use up-to-date recording equipment. That means investing in professional-quality cameras and audio recorders rather than relying on cellphones or iPads. Having clear audio (and video) of the interview is absolutely critical. The technology available today makes it easier than ever to create high-quality recordings.

5. Provide adequate physical security for all recordings. That means storing them securely in an access-controlled environment and ensuring only authorized personnel can operate the equipment.

6. Test equipment before each interview to make sure it works properly. You don’t want to enter a dispute, relying on your recording for vindication—only to find that it’s unusable or unavailable!

Following these practices can help ensure that theft and loss events are resolved effectively. A modest investment can thus yield great rewards in legal advantage and efficiency. l Tom Meehan, CFI, is retail technology editor for LP Magazine as well as CEO of CONTROLTEK. Previously, Meehan was director of technology and investigations with Bloomingdale’s, where he was responsible for physical security, internal investigations, and systems and data analytics. He currently serves as the chair of the Loss Prevention Research Council’s (LPRC) Innovations Working Group. Meehan recently published his first book titled Evolution of Retail Asset Protection: Protecting Your Profit in a Digital Age. He can be reached at TomM@ LossPreventionMedia.com.

LossPreventionMedia.com

metamorworks / Shutterstock.com

ASK THE EXPERT

Miller, business development manager at Hanwh has spent more than two decades designing and delivering advanced video surveillance solutions specifically for retail environments, from big-box and specialty to grocery and convenience formats.

Cliff Miller

Making the Case for AI Video Surveillance LPM: Talk about the current state of AI-driven video surveillance and how it’s evolved beyond security to enhance retail operations in new ways?

Cliff Miller: The shift in CCTV’s value proposition is happening fast.

Traditional systems were designed to look back, to provide footage after an incident. But today’s AI-enabled cameras are designed to operate in real time, offering a proactive, analytical view of the store environment.

Retailers are using people counting, queue monitoring, and dwell time analytics to fine-tune everything from staffing to layout.

With heat mapping, managers can visualize which areas of a store attract the most attention and adjust product placement accordingly. Modern systems can integrate with POS data, traffic patterns, and other sensors. What used to be a static video feed is now a dynamic, decision-making engine.

LPM: Has the advancement of video surveillance technology into an operational tool “changed the conversation” with the C-suite?

Miller: For many organizations, video surveillance still sits squarely within the domain of loss prevention, but that’s changing. As AI-enabled surveillance continues to deliver measurable value beyond shrink reduction, it’s becoming a critical operational tool.

This presents a unique opportunity for LP professionals to lead the conversation at the executive level.

By reframing surveillance as a source of operational intelligence, LP leaders can position themselves as strategic partners in driving efficiency, improving customer experience, and increasing profitability. The data and insights generated by modern CCTV systems are relevant to operations, marketing, HR, and finance, making it a technology worth championing beyond the security office.

Presenting AI-powered video solutions to the C-suite as more than just a way to reduce loss, but also as a platform to optimize performance, can help secure cross-functional support and unlock greater organizational impact.

LPM: Describe the deployment of video surveillance as both a security tool and an operational engine.

Miller: For years, video surveillance in retail has been associated almost exclusively with loss prevention. While reducing shrink will always be a critical part of retail security, the modern retail landscape is evolving rapidly.

AI-powered CCTV has moved beyond simply recording incidents or monitoring for theft. It now can help retailers understand customer behavior, optimize staff deployment, identify merchandising opportunities, and drive better overall store performance overall.

Loss Prevention Magazine

LPM: How are retailers using AI-based video surveillance to gain a competitive edge?

Miller: Consumer expectations are higher than ever, and retail success depends on both experience and efficiency.

AI-driven video helps retailers strike that balance. Just a few examples include: ● Improved labor management: With real-time people counting and occupancy monitoring, retailers can adjust staffing levels based on actual in-store traffic patterns, not assumptions. ● Optimized store layout: Heat mapping and dwell time analytics identify areas of high engagement and “cold zones” that may need layout adjustments or product repositioning. ● Faster response to operational issues: AI can trigger alerts when queues get too long, entrances are blocked, or aisles are congested. ● Consistency across locations: Centralized video management systems allow regional or corporate teams to ensure consistency across multiple stores. ● Reduced inventory handling errors: Surveillance integrated with stockroom and receiving areas helps monitor process compliance and detect inefficiencies or unauthorized access, reducing internal errors that impact stock availability and sales.

LPM: What are compelling arguments retailers can use when “making the business case” for investing in video surveillance and justifying the technology investment?

Miller: In challenging economic conditions, every investment has to prove its value. AI-enabled surveillance offers multi‑departmental ROI, supporting not just asset protection, but also operations, marketing, customer service, and human resources. Forward-thinking retailers are moving surveillance decisions beyond the LP silo and bringing operations leaders into the conversation.

By reframing video surveillance as a business intelligence tool, retail organizations unlock greater value from existing infrastructure. Cameras that were once seen only as a cost center are now generating insight that impacts everything from how long customers wait in line to which endcap drives more engagement.

LPM: What’s ahead for AI-powered CCTV, and what should retailers focus on for success?

Miller: Retailers that embrace AI-powered CCTV now are setting themselves up not just to protect what they have, but to grow.

The future of video surveillance in retail is about more than just seeing, it’s about understanding. And with the right technology and expertise, retailers can turn that understanding into smarter, faster decisions across their entire business. l

| 25 |

Internal Theft Special Issue 2025

FEATURE

Stopping the Snowball

Stopping the Snowball:

How Policies and Technology Can Prevent Internal Refund Fraud

By Courtney Wolfe

R

ecently, a video went viral that shows a Napa Auto Parts employee being arrested for allegedly running a refund fraud scheme that amounted to over $2,100.

The employee used the store’s point-of-sale system to create fake returns and then refund the money to her own personal credit card.

Internal Theft Special Issue 2025

Known as a “false refund” or “register disbursement,” this is one of many ways that employees can commit refund fraud. And while this type of theft may not earn much media attention, it is a serious threat to retailers’ bottom lines. “[Internal refund fraud] is one of the most significant contributors to retail

| 26 |

LossPreventionMedia.com

The power of speech, sound, and light.

AXIS D4200-VE Network Strobe Speaker Save time and money while improving safety for your organization with dearly detection. Our visual and audible deterrent proactively addresses this by combining a powerful built-in speaker with a visual deterrent. When paired with an Axis network camera and AXIS Object Analytics, it detects potential intruders and immediately triggers a clear, audible warning – either pre-recorded or live – along with flashing strobe lights, helping to prevent break-ins before they happen.

Powerful all-in-one strobe and speaker: > > > > >

Multiple LED colors and custom audio Built-in speaker with two-way audio AXIS Audio Manager support PoE out to power additional devices IP66-, NEMA-4X- and IK09-rated

SCAN ME

FEATURE

Stopping the Snowball loss today,” said Pedro Ramos, chief revenue officer for Appriss Retail. “While it doesn’t make headlines like organized retail crime, its cumulative impact can Pedro Ramos be just as damaging and sometimes even greater. What makes it challenging is its subtlety; it’s rarely a high-dollar event, but rather a pattern of small, repeated actions that add up over time. It remains one of the top KPIs for exception-based reporting (EBR) analysts searching for transaction fraud.”

Total returns for the retail industry amounted to $685 billion worth of merchandise in 2024, representing 13.21 percent of total retail sales, according to Appriss’ 2024 “Consumer Returns in the Retail Industry” report. The report also showed that fraudulent returns and claims resulted in a $103 billion loss for retailers in 2024, with 15.14 percent of all returns determined to be fraudulent.

The 150 retail executives surveyed for this report were asked to identify the most common types of returns fraud and abuse they have encountered: wardrobing (60%); returns from fraudulent or stolen tender/gift card fraud (55%); returns of stolen merchandise (48%); returns with counterfeit receipts/e-receipts (48%); bracketing (47%); and employee return fraud or collusion (39%).

“Internal refund fraud continues to be a major source of shrinkage across retail,” said Genetec National Director for Signature Brands Scott Thomas.

Scott Thomas “While organized retail crime has recently overtaken internal theft as the top source of retail shrink, employee theft and collusion, including refund fraud, is growing proportionately.”

The retail return landscape is transforming drastically as e-commerce grows and economic uncertainty makes customer loyalty even more crucial, and return fraud is transforming as well. Add in a staffing shortage that has created a revolving door of store associates, and combating internal refund fraud has become even more complicated.

“Based on what we see with our customers, it seems that internal refund fraud is an ever-present issue,”

said Scott Pethuyne, senior analytics solution consultant for Zebra Technologies. “While it may surge or ebb from time to time, even retailers that do a great Scott Pethuyne job addressing it will still always have new associates joining the organization, processing changes, and other complicating factors that leave them exposed to the risk of internal refund fraud.”

Different Types of Internal Refund Fraud

According to the sources we spoke with for this story, internal refund fraudsters typically start slow, testing the waters of what they can get away with.

“Internal refund fraud is very commonly a type of fraud that can snowball,” Pethuyne shared. “Often an associate will be in a position of financial need, and in their desperation will resort to refund fraud so they can make the month’s rent, pay for a car repair, or handle some other event that has put them in a bad situation. If that instance goes unnoticed, it tends to embolden the associate since they ‘got away with it.’ That’s the scenario where refund fraud becomes an ongoing scheme, as the associate now feels like they can continue the fraud without consequence.”

The ways in which employees can commit return fraud are varied, and include: ● One trend that has gained momentum with the increasing omnichannel environment has been refund fraud involving both in-store and online channels. For example, an associate may enter an online receipt into the register for a fake return transaction because their register is not configured to validate the original items and tender, and they can more easily get what they want from the transaction. ● A call center associate could be working with a friend or family member to have them call in and report an order as “not delivered,” giving them an opportunity to credit the amount of the order back to the person. ● Bricking collusion, where an

Internal Theft Special Issue 2025

| 28 |

Advice for Retailers Experiencing Large Amounts of Internal Refund Fraud “Internal refund fraud doesn’t grab headlines the way organized retail crime does, but it’s equally damaging and often a substantially larger case. The key to identifying these crimes is visibility— combining video, transaction data, and analytics into a single platform. When retailers can see what’s happening across their enterprise in real time, they can intervene faster, investigate, and deter future incidents.”

—Scott Thomas

“Refunds have an adverse and negative impact on sales. However, legitimate refunds tell a story and can create opportunities to improve the operational impact to the business. There are many stakeholders that should be involved in reducing internal fraud and can gain insight into recognizing internal refund fraud where it is a sales reducer and change it to a sales enabler.”

—Greg Collins

“As with any fraud, as the environment changes, the potential fraudster changes their approach to try and identify whatever kind of advantage they can. As LP practitioners, we have to stay alert, continue to look for these new approaches, and change our approach appropriately to manage the associated risk.”

—Scott Pethuyne

“My biggest piece of advice for retailers is to view internal refund fraud as part of their total retail loss, not as a separate issue. It starts with incorporating all systems into applications to facilitate total enterprise decisioning.”

LossPreventionMedia.com

—Pedro Ramos

Meet Your Loss Prevention Team’s New Secret Weapon Simplify Internal Investigations with Smart Battery Power Catch theft in action with the Gridless Covert Unit—a portable, battery-powered system with discreet Axis sensors for covert surveillance.

+ Real-time alerts + 140+ hours runtime + LTE/Wi-Fi connectivity + Universal VMS integration

Smarter protection starts with a quick conversation.

Let’s work together to power up your LP strategy. Book a demo today.

go.gridless.com/covert

Covert Cameras Even Smaller Than a Nickel The Axis F7225-RE Pinhole Sensor, an ultradiscreet camera equipped with an ultra-small sensor, is ideal for undetected surveillance.

Extend Your Security to Parking Lots, Loading Docks, and Beyond No power? No problem. With Gridless and Axis, you can power any camera, anywhere, anytime.

Learn More

FEATURE

Stopping the Snowball employee is partnering with a customer who returns an empty package of high-value items which were legitimately purchased. ● An employee can accept a return from an accomplice who either hasn’t paid for the item or doesn’t have a receipt. They can also override return policies to issue refunds for items that aren’t eligible for return, such as products that were worn, used, or purchased with a stolen gift card or credit card. ● Ghost returns, where employees create fake return transactions and process refunds to gift cards or fake accounts that they can later use or redeem for cash or merchandise. ● Another common tactic involves reusing receipts, whether their own, from online orders, or those left behind by customers. These returns can be processed to accounts different from the original purchasing account. Associates with access to manager codes can easily circumvent or override POS controls to complete these fraudulent transactions. ● Non-receipted returns are among the easiest for associates to commit. In many cases, they’re working alone at the return desk and can override POS controls. To avoid detection, they may route the refund value to personal credit cards, digital wallets, or gift cards.

Using multiple accounts and mixing in

cash transactions can further reduce the markers that EBR relies on to flag suspicious activity.

How to Identify and Prevent Internal Refund Fraud

With so many opportunities for fraud, loss prevention teams must take a multi-pronged approach to preventing returns abuse. According to Appriss’ 2024 report, the top return fraud prevention efforts/tools deployed were: requiring receipts/proof of purchase (67%); limiting return windows to thirty days or less (59%); manually monitoring transaction data for fraudulent behavior (54%); and implementing real-time return technology to approve, warn, or deny a return or claim based on behavior patterns (35%).

Retailers must balance preventing return fraud with fostering customer loyalty, though—55 percent of consumers have decided not to buy from retailers due to restrictive return policies, and 89 percent would make more purchases if they had positive return experiences.

When dealing with Greg Collins, LPC high rates of internal return fraud, Pethuyne recommends first reviewing the company’s return policies and practices to create a more controlled environment. Greg Collins, LPC, manager of solutions and innovation with i3 International, agrees, suggesting that retailers should not allow employees to process their own refunds unattended, or they should require secondary approvals on higher-tiered refunds.

“Consider your LP awareness program,” Pethuyne added. “Are associates really aware that their activity at the POS is being monitored? An off-cycle communication from the LP or operations team could potentially open some associates’ eyes and cause them to reevaluate their behavior.”

And of course, make sure their activity at the POS is being monitored. As internal refund fraud tactics have evolved, so too have the technologies created to combat them. CCTV video, AI, and data analytics capturing key POS metrics complemented by proper internal controls and key reconciliation processes are essential, according to Collins.

Internal Theft Special Issue 2025

| 30 |

“An analytics tool that can take in multiple data streams from different sources, automatically detect anomalies, and generate investigative leads complete with detailed data and CCTV video goes a long way in helping a retailer mitigate refund fraud, regardless of what form it takes,” Pethuyne said.

Also, be sure to consider how you are utilizing your POS transaction data.

Sending coaching-focused exception alerts to stores allows a retailer to both fix the specific behavior in question and increase the perception of control within the store.

The best part is that this allows the retailer to take action before the behavior escalates to fraud or another terminable offense, avoiding the costly terminate/ recruit/hire/train process involved in replacing an associate. With the right analytics tools, this store-level alerting can be generated automatically with no corporate analyst involvement.

“Creating standard benchmark reports that identify exceptions that are addressed each and every week in every location with actions taken will help to prevent fraud,” Collins said. “As the saying goes: what gets measured gets done. Companies should excel at their ability to harvest actionable data and drive meaningful results, leading to a positive valuation and reductions in shrink.”

The key here is to be proactive rather than reactive. Since this is typically a “snowball” crime, it’s essential to catch fraud as it is happening, before a one-off attempt turns into a multi-year scheme.

“Real-time solutions that leverage systems to identify and stop fraud as it happens are the optimal approach,” Ramos stressed. “Detecting internal fraud months or years after it began does not prevent any of the negative impacts.

True prevention occurs when fraud is stopped in real time, before internal bad actors mature into sophisticated refund launderers converting refunds into cash.” l Courtney Wolfe is LPM’s managing editor focusing on creating and curating editorial content for the magazine’s print publication and website. Prior to LPM, she was managing editor for SDM Magazine, a trade publication for security systems integrators. She received her bachelor’s degree in multimedia journalism from Columbia College Chicago. She can be reached at CourtneyW@LossPreventionMedia.com.

LossPreventionMedia.com

Sports Arena’s

Industrial

Storefront Security

Commercial Dock doors Schools Access Control Installed coast to coast throughout North America

1-800-835-0214

info@xpandasecuritygates.com www.xpandasecuritygates.com

Scan me

and see why so many professionals choose Xpanda

Man Doors

SECURITY WHEN YOU NEED IT GONE WHEN YOU DON’T!

Frustrating criminals for 30 years

20 000 storefronts secured (and counting)

SOLUTIONS SHOWCASE

CISCO

Physical Security Reimagined with Cloud-based Video Surveillance D

id you know that a large number of cybercrime incidents can be linked to oversights in physical security practices?

Legacy surveillance systems that include network video recorders (NVRs) or video management systems (VMSs) are not only inefficient at identifying and responding to security incidents, but they also introduce critical cybersecurity vulnerabilities. They also lack the advanced intelligence capabilities found in modern setups. As physical workspaces evolve and hybrid work and employee well-being become major priorities, modern physical security can provide great strategic benefits to organizations.

cybersecurity and physical security controls with AI and cloud management.

The challenges posed by traditional security cameras include: Complex configuration: Legacy systems often require manual intervention, deep technical expertise, and extensive personnel training.

Lack of scalability: Legacy systems require on-prem servers and software that make distributed deployments slow and complicated.

Lack of accessibility: Traditional security systems lack flexible and secure access controls, link-based sharing with law enforcement, and remote viewing, leaving critical blind spots.

High costs: Legacy cameras require costly upgrades and extraneous hardware, and introduce threats that can cost businesses even more.

You Need Modern Physical Security: Scalable, Secure, Agile, and Smart Video surveillance is the key to ensuring a safe work environment for employees and visitors and securing IT assets on-site. While the legacy connected camera systems did a fine job in the past, the future calls for a modern approach. This new approach must focus on proactive intelligence above reactive security by converging

Internal Theft Special Issue 2025

| 32 |

Cisco MV cloud-managed smart cameras offer privacy and security-first infrastructure with easy configurability, maintenance, and protection. Some of the line’s key highlights include: AI-powered analytics: Precise searching with attribute filters, intelligent object detection, line crossing, and advanced people counting capabilities.

Centralized cloud management: Simple configuration and monitoring from anywhere without the need for additional onpremises NVRs, video management systems, or servers.

Built-in security: Safeguard camera data and ensure protection against unauthorized access with automatic video encryption, granular access controls, and more.

Scalability: Quickly deploy and manage anywhere from one to over 10,000 cameras—the process is the same no matter the size of deployment.

Part of the Cisco platform: Seamless integration with other Cisco products (like sensors, switching, wireless, and more)

LossPreventionMedia.com

for a comprehensive solution that is all accessible from the Cisco dashboard.

Zero disruption: Seamless updates equip your organization with the latest cutting-edge tech designed to protect your people and assets, all without disrupting operations.

Cisco MV Architecture

Cisco MV smart cameras feature cloud-augmented edge storage for easy installation and operation. With no need for an NVR, they reduce CapEx and simplify architecture to lower OpEx. Integrated storage allows for scalable expansion without extra purchases. Cameras keep recording during network outages, with footage accessible locally or from the cloud.

Attribute Search—Quickly find key events based on attributes of video subjects. For example, search for video segments containing “RED PANTS” or “GREEN BICYCLE.” Presence AnalyticS—A suite of features, including line crossing, person detection, object detection, and occupancy, allows for optimization and management of physical spaces. These features can be used for both safety purposes as well as business insights.

Smart Retention—When enabled, MV cameras optimize video storage based on whether important events are detected within a frame. Standard definition backup footage is recorded, too, to ensure nothing important is lost.

Custom Ml Models—When MV cameras are paired with an MV Sense license, organizations can create and train their own ML models powered by MV’s computer vision capabilities. Get in touch with a sales engineer to learn more about custom solutions for your organization.

Let’s Get Started!

Request a demo to see how smart cameras can enable safety and security for your organization.

Innovate and build customized experiences to create safer environments and smarter spaces through our partners and APIs. Take smarter security for a test drive with an MV Smart Camera trial; simply scan the QR code to get started. l

Your Physical Security Solution Can Do More than Protect Your Space

The onboard processor in every MV camera unlocks edge AI functionality across several features, all of which are included with a standard MV license unless otherwise noted:

Loss Prevention Magazine

| 33 |

Internal Theft Special Issue 2025

EMPLOYEE BREAKROOM

We see you.

We trust you.

Don’t break that trust.

You’re Catching Just 2% of Internal Theft—So, What About the Rest?

By Colin Peacock

I

f retailers think they’ve got a handle on internal theft, maybe it is time to think again. Despite all the different tools at their disposal—from exception-based POS data analytics to whistleblowing hotlines—our evidence suggests they’re probably detecting just 2 percent of what’s really going on inside their business.

Yes, staff dishonesty and internal theft are and have always been awkward to talk about.

No one wants to point the finger at their own

Internal Theft Special Issue 2025

people, especially when retention is fragile and recruitment is a daily grind. However, internal theft comes with a considerable cost impact, from lost margin and on-shelf availability to morale and turnover, and ignoring it can hurt store culture more than it helps.

When honest staff see others breaking the rules and getting away with it, it will impact their motivation and job satisfaction.

That includes everything from fraudulently

| 34 |

LossPreventionMedia.com

PintoArt / Shutterstock.com

FEATURE

You’re Catching Just 2% of Internal Theft

When honest staff see others breaking the rules and getting away with it, it will impact their motivation and job satisfaction.

voiding a sale, to taking merchandise, to manipulating returns, to “sweethearting” for their friends, and increasingly exploiting fulfillment handoffs such as BOPIS (Buy Online Pick-up In-store) and BORIS (Buy Online Return In-store).

While pre-employment screening has a clear role to play, the high levels of staff turnover and the requirement to hire at speed make it hard to execute for retailers. But you can influence behavior.

To test this theory, we partnered with five retailers (Boots, Next, River Island, and Tesco) and brought in marketing MSc students from Loughborough Business School. We then asked them to do what marketers do best: change minds and influence behavior.

PNG BOARD / Shutterstock.com

While pre-employment screening has a clear role to play, the high levels of staff turnover and the requirement to hire at speed make it hard to execute for retailers.

Their brief was to use proven behavioral science to speak to the would-be thief, the tempted, the borderline, the young new hires, and those celebrating thirty years of long service—not with blanket suspicion or clumsy threats, but with smart, brandaligned messaging that taps into pride, loyalty, family, and social pressure.

Their campaigns created posters with purpose, clearly communicating: “We see you. We trust you. Don’t break that trust.”

What happened when similar messaging went live? In one UK grocer’s 12-week trial, tobacco losses fell 78 percent in intervention stores. Compared with matched controls, losses were 293 percent lower. Prepared food losses ended 33 percent lower than controls.

In another retailer, adding clear “we are monitoring” messaging alongside the launch of a remote CCTV hub correlated with a 15 percent reduction in shrink and 5 percent less cash loss over two years (matched-store design).

The evidence is gathering. And therein lies the power of low-cost, well-designed internal messaging. So, if you’ve previously written off staff posters and internal communications as just background noise, our report suggests that it’s time

to think again. Done properly, they don’t just inform, they can engage staff and shift culture.

Internal theft today isn’t about taking home a sandwich; it’s iPhones in the mail, it’s refund fraud, it’s manipulation of fulfillment models like BOPIS and BORIS, and, in some cases, it’s organized crime networks exploiting seasonal bulk hiring peaks.

While retailers will continue to invest to catch more than 2 percent, including AI, computer vision, and exception analytics, detection alone won’t close the gap.

The case we set out in Professor Taylor’s report is to pair enforcement with influence: respectful, brand-fit messaging that targets the “tempted middle.”

In trials and case studies, targeted campaigns have delivered double-digit improvements on the behaviors and categories they aim at, with realistic potential to reduce your annual shrink results materially at very low cost.

What’s the Science Behind “Posters with Purpose”?

The campaign ideas were anchored in well-established models that criminologists use every day.

Break the Fraud Triangle (pressure, opportunity, rationalization) Messages directly challenge talk, such as “it’ll be thrown out anyway” or “no one gets hurt.”

Theory of Planned Behavior

We targeted attitudes (pride in team), norms (“people like me do the right thing”), and perceived control (simple, correct steps at POS).

The “Watching Eyes” Effect (and salient oversight cues)

Inexpensive visual prompts can lift pro-social behavior and deter theft in real-world settings.

While retailers will continue to invest to catch more than 2 percent, including AI, computer vision, and exception analytics, detection alone won’t close the gap.

And as a next step, along the lines of what we did with this project, retailers can ask their marketing teams and agencies for inspiration and support.

Be specific about the behaviors you want to change (e.g., void abuse, refund manipulation), make oversight visible but fair, and script the “right next step” in plain English at the point of risk. As one UK retailer says, every little bit of help from others in the business helps!

This article draws on findings from Prof.

Emmeline Taylor’s new report for ECR Retail Loss, “The 98%: Strategic Marketing to Mitigate Internal Theft in Retail.” l

Loss Prevention Magazine

| 35 |

Colin Peacock is the group strategy coordinator for ECR Retail Loss, a platform for collaboration that seeks to find new, imaginative ways to tackle the problem of retail loss through collaboration. Over 400 retailers and CPGs participate in the group’s activities that include commissioning and publishing new research projects, regular in-person and online meetings, and Innovation Challenges. For thirty years, Colin worked for Procter & Gamble in the UK and Europe, and held global positions in marketing, customer development, brand protection, and retail store execution. Colin sits on the logistics and operations management advisory board at the Cariff Business School and is governor at a primary school in North London.

Internal Theft Special Issue 2025

Reliability Starts with the Right Partner Not all solution providers are created equal.

From order to installation, CONTROLTEK delivers EAS and RFID solutions faster and with more precision than anyone in the industry.

Certified EAS Systems: CE, UL & FCC High Stock, Fast Delivery Dedicated Field Technicians Global Manufacturing Network Best-in-Class Warranty Security you trust. Service you deserve. That’s CONTROLTEK.

Scan the QR code to see why leading retailers trust CONTROLTEK

controltekusa.com