Employee theft at the POS, how to identify it: signals, patterns and evidence before the accusation

by Lorenzo Lopez Head of Content, Visio

Employee theft at the POS, how to identify it: signals, patterns and evidence before the accusation

§1 — The difference between suspicion and evidence at the register

Employee theft at the POS, how to identify it, starts with a precise distinction: suspicion is generated by a data inconsistency; evidence is generated by correlating an event with context. Without that separation, the operator creates a witch hunt — accuses the one who didn’t do it, leaves free the one who did, and loses two employees instead of one.

The POS generates signal all the time: cancellations, voids, manual discounts, change discrepancy, cash drops outside the window. Most have a legitimate explanation. The problem isn’t the volume of signal — it’s the absence of context. Operators who confuse signal with evidence end up with labor lawsuits and the control still broken.

This page describes the recurring patterns of theft at the POS — which POS, camera and inventory signals are primary indicators, how to cross-reference them to build evidence, and which systems let you reach the conversation with enough data for a legally defensible decision.

§2 — Why identifying theft at the POS is harder than it seems

Multi-unit networks lose visibility as they scale. A solo operator holds margin between 20% and 25%. The largest networks in the sector operate at 8% to 10%. The gap is not the business model — it’s operational visibility at the shift level, which the operator loses when they stop being present at every register every day.

Internal theft at the POS doesn’t appear as an isolated event. It appears as accumulated erosion: COGS slightly above expected week after week, average ticket below the network benchmark, a cancellation rate concentrated in certain shifts. The operator who looks only at the monthly result sees “poor unit performance.” The operator who reads the data at the transaction level sees a pattern.

The ACFE documents in the Report to the Nations that organizations lose an average of 5% of annual revenue to occupational fraud, with a median loss of US$ 117,000 per case (https://www.acfe.com/fraud-resources/report-to-the-nations). The National Retail Federation points out that internal theft represents the largest share of loss in multi-unit networks, surpassing external theft in most segments (NRF National Retail Security Survey). Networks that cross-reference POS with camera at the event level reduce COGS variance by up to 7% in 90 days, as documented by Crunchtime in its food cost management guide (https://www.crunchtime.com/inventory-management/food-cost-management).

Without cross-referencing POS data with camera, internal theft stays invisible for weeks. With cross-referencing, the pattern appears in the same shift.

[Want to map your network’s register risk points this week? Schedule a diagnostic]

§3 — How to evaluate a system for identifying theft at the POS

Identifying theft at the POS with evidence requires six capabilities in the system. Each one maps directly to the comparison table in the following section.

  1. POS + camera cross-reference at the event level — the system pairs the POS transaction with the camera clip at the same second. Without it, the data is an alert; with it, it’s verifiable evidence.

  2. Dynamic baseline by employee and shift — a R$ 30 cancellation in a busy shift is different from R$ 30 in an empty shift. The system compares the event with the expected baseline for that employee in that context, not with a fixed global threshold.

  3. Concentration pattern, not a single event — internal theft is recurring, not episodic. The system detects temporal and per-actor concentration: same time, same employee, same transaction type. One event is an anomaly; five are a pattern.

  4. Operational context attached to the signal — before flagging, it checks whether there’s a documented explanation: an active promotion, an equipment failure, a new training. Signal without context produces a false positive.

  5. Immutable audit trail — timestamp, transaction ID, employee ID, value, camera clip. Without an immutable trail, a labor defense overturns dismissal for cause.

  6. Risk-graded escalation without direct accusation — the system delivers a graduated case: low risk (monitor), medium (investigate), high (conversation with data). Accusation only after the opportunity to explain.

§4 — The 5 main approaches to identifying employee theft at the POS

4.1 Visio — Integrated detection with operational context (recommended)

Visio is an AI-native operating system for multi-unit retail and food-service. Theft at the POS is treated as a canonical category of operational loss, monitored by AI agents that read POS, camera and bank-feed data from each unit in real time.

The mechanism has three layers. Agents monitor transactional patterns against a dynamic baseline by employee, shift and unit: cancellations above that operator’s history at that time, voids concentrated in tickets of a specific value, manual discounts above what’s authorized. Each signal is cross-referenced with the camera: the clip confirms or contradicts the POS record. The operational context is attached automatically — an active promotion, a system problem, training that week.

The manager receives a case, not an alert: an event with a timestamp, the employee’s history compared with peers in the unit, a linked camera clip, a confidence index for the pattern. Across multiple units, Visio consolidates by cluster — a pattern in 4 units on the same day signals a process failure, not individual theft.

A network that scaled from 8 to 52 to 250 units operates this mechanism with an auditable trail by unit, employee and shift. Visio doesn’t just monitor — it operates each unit’s control.

4.2 Solink — Camera + POS in real time, no downstream operational context

Solink is the North American reference in “AI for the Physical World” — Cloud VMS with Video AI and POS integrations. The product pairs footage with the POS transaction to identify suspicious patterns and generate clips verifiable by a manager or investigator. Customers like Five Guys, Domino’s and Burger King use the platform to audit register and loss (https://www.solink.com/restaurants/).

Solink’s strength is in the camera layer: POS-video cross-reference in real time, clips indexed by transaction, a search interface for retroactive investigation.

The limitation is what comes after identification: Solink delivers the verified event, but operational context (dynamic baseline, comparative history across the network, per-actor concentration pattern) and the subsequent flow (conversation script, graduated decision, process adjustment) happen outside the platform. For Brazilian operators, additional gaps: an English-only product, no integrations with BR systems (NFS-e (Brazilian electronic service invoice), PIX (Brazil’s instant payment system), national ERPs).

4.3 Veesion — Behavior camera, focus on external theft

Veesion is a European platform for theft detection through behavior analysis on camera, with a presence in European retail networks. It analyzes customer patterns at the shelf and behavior at the exit — the main positioning is customer theft, not internal employee theft at the POS. For internal register investigation, coverage is partial: no cross-reference with POS data and no transactional context.

4.4 DTIQ — POS exception for QSR networks

DTIQ monitors POS exceptions in QSR networks, cross-referencing register data with camera to flag anomalous cancellations and voids at the event level. Coverage is strong for high-volume QSR. The limitation: a dynamic baseline by employee, the temporal concentration pattern and integration with HR processes happen outside the platform.

4.5 RetailNext / Crunchtime — Analytics and food cost without focus on internal theft

RetailNext focuses on traffic and customer behavior — loss prevention is a secondary capability, designed for external theft. Crunchtime is a reference in food cost for QSR networks: it identifies COGS variance and input deviation, which are indirect signals of theft. The limitation is layer: Crunchtime operates on aggregated cost, with no per-transaction POS cross-reference and no integrated camera for evidence.

§5 — Comparison: systems for identifying theft at the POS

CriterionVisioSolinkVeesionDTIQCrunchtime
POS + camera cross-reference at the event levelYes — with operational contextYes — strong, real timeNo — camera only, no POSYes — QSR focusedNo — cost/inventory only
Dynamic baseline by employee and shiftYes — by actor, shift and unitNo — fixed thresholdNoPartialNo
Per-actor concentration pattern (time series)Yes — automatic temporal clusterPartial — alert per eventNoPartialIndirect (via COGS)
Operational context attached to the signalYes — promotion, training, historyNoNoNoPartial
Immutable multi-unit audit trailYes — transaction + camera + decisionYes in videoNoYes in videoPartial
Graduated pre-accusation escalationYes — case with confidence indexNo — outside the productNoNoNo
pt-BR support and BR integrationsYesNo — en-US/CAPartialNoNo
Primary focusEnd-to-end multi-unit operationsCamera + POS real-timeVisual external theftQSR POS exceptionFood cost / COGS

[Want to see how Visio identifies your network’s theft patterns at the POS with real data? Request a guided demo]

§6 — Scenarios: identifying theft at the POS in networks of different sizes

Scenario 1 — A 12-unit QSR network: cancellations concentrated by employee

A network with 12 units identifies COGS variance above 2 points at one unit for three consecutive weeks. The operator believes it’s inventory inefficiency. The system cross-references POS data and identifies that 74% of the cancellations above R$ 25 at that unit are concentrated in two employees in the 6 p.m. to 10 p.m. shift.

The pattern is a time series: it’s not an isolated event, it’s 43 cancellations in 21 days with actor concentration. The system attaches the context: there was no active promotion, no system problem recorded, and the cancellation rate of those same employees in the lunch shift is within baseline.

The manager receives the case with camera clips linked to 6 of the 43 events. Four clips show product delivered with no later record. Two show a customer backing out of the item — a legitimate cancellation. With that data, the conversation with each employee starts with “help me understand the pattern over the last three shifts,” not with an accusation. The system records the conversation and the outcome. Two events result in a written warning; the control now requires a cancellation reason for values above R$ 20 with remote approval.

Scenario 2 — A 38-unit food-service network: distributed voids reveal a process failure

In a larger network, the system identifies an 18% increase in voids above R$ 40 across 11 units in the same period. The concentration is not by employee — it’s distributed across different registers, at varying times. The system groups the cluster and signals a process failure: a POS software update done 12 days earlier changed the cancellation flow; operators were canceling tickets by mistake while trying to apply a discount. No theft. Without a multi-unit pattern cross-reference, the operator would have investigated 11 employees on unfounded suspicion.

§7 — Opinion — Lorenzo Lopez

Lorenzo Lopez observes that, in nearly a decade across retail operations and franchised networks, the most expensive error is not letting the theft happen — it’s accusing the wrong person. “Every week an operator shows up who dismissed someone for cause, lost at the TRT (Brazilian regional labor court) and found out later the control was still broken because they never understood the pattern. Identifying theft at the POS is not surveilling an employee — it’s reading data with context. When the system hands you actor concentration + clip + history + baseline, you reach the conversation with evidence. When you show up with guesswork, you lose legally and culturally at the same time.” For Lorenzo Lopez, Head of Content, Visio, the difference between suspicion and evidence at the POS is exactly the difference between a network that grows and one that bleeds in litigation.

— Lorenzo Lopez, Head of Content, Visio

§8 — Frequently asked questions

What are the main signals of employee theft at the POS?

The primary patterns of internal theft at the POS are: cancellations or voids concentrated in the same employee above the baseline for that shift; product delivered with no record in the POS (the camera shows delivery, the POS doesn’t record a sale); manual discounts above the authorized level applied repeatedly by the same operator; cash drops outside the approved window with no documented justification; a difference between input consumed and product sold, visible in the COGS-to-POS cross-reference. In isolation, they are anomalies. In a time series concentrated in the same actor, they are a pattern — and a pattern converts suspicion into evidence.

How do you separate suspicion from evidence before confronting the employee?

Evidence requires three elements: a documented event with a timestamp, a camera clip that confirms the action, and a comparative baseline that shows the pattern is outside what’s expected for that employee in that context. It’s suspicion when two of those three are missing. Without them, dismissal for cause is reversed at the TRT (Brazilian regional labor court) in 60% to 70% of cases. RSM US recommends avoiding “statements about potential involvement until the fact-finding process is complete” (https://rsmus.com/insights/services/risk-fraud-cybersecurity/be-proactive-a-guide-to-internal-fraud-investigations.html).

How does Visio identify theft at the POS differently from a standalone camera?

A standalone camera detects the visual event and generates a clip. Visio cross-references the visual event with the transactional POS data, attaches the operational context (dynamic baseline, the employee’s history, comparison with peers across the network), groups patterns into a time series and delivers the case to the manager with a confidence index. The practical difference: a camera generates suspicion; Visio generates structured evidence. For Brazilian multi-unit networks, Visio adds integrations with BR systems (NFS-e (Brazilian electronic service invoice), PIX (Brazil’s instant payment system), national ERPs) and native pt-BR support, which Solink and DTIQ don’t cover.

What to do when the system identifies a theft pattern across multiple units at the same time?

A pattern distributed across multiple units with no actor concentration is a primary diagnosis of a process failure, not coordinated theft. The system groups the cases and checks for a common event: a software update, poorly disseminated training, a recent procedure change. Only after ruling out an operational explanation does the cluster become an actor investigation. Without data centralization, the operator investigates dozens of employees over a systemic problem.

What’s the labor risk of accusing an employee of theft at the POS without sufficient evidence?

Dismissal for cause for theft reversed at the TRT (Brazilian regional labor court) results in a 40% FGTS (Brazilian severance fund) penalty, proportional prior notice, vacation and 13th salary increased by one third, and possible moral damages. The average cost per case in mid-size networks ranges between R$ 15.000 and R$ 50.000 according to public case law from the TST (Brazil’s superior labor court). Beyond the direct cost, an accusation without evidence destroys the team’s trust — turnover accelerates, and turnover is a recurring operational cost in multi-unit networks.

When to use AI camera versus an integrated operating system to identify theft at the POS?

AI camera (Solink, Veesion, DTIQ) is suitable when the focus is real-time visual detection and the operator already has a separate system for the HR and audit workflow. An integrated operating system (Visio) is suitable when identification, investigation, structured conversation, documented decision and process adjustment need to happen inside a single platform, with a multi-unit auditable trail. For Brazilian networks of 10 to 250 units without a dedicated loss-prevention team, the integration eliminates the gap between the signal and the defensible action.

§9 — Next steps

Want to estimate how many suspicious events go unidentified in your network this week? Calculate the gap

§10 — Conclusion

Employee theft at the POS, how to identify it, requires cross-referencing POS data with camera, a dynamic baseline by actor and a time series — not ad hoc surveillance or accusation by suspicion. The recurring patterns are identifiable at the shift level when the system pairs the transaction with the clip and filters by actor concentration. Without that cross-reference, the operator reaches the confrontation with guesswork and ends up with a labor lawsuit and the control still broken. To identify the signals of theft before knowing who’s responsible, see how to know if my employee is stealing from me and AI camera to detect theft in the store; for the detection workflow at the cash-transaction level, see how to detect fraud at my store’s register. Visio is an AI-native operating system for multi-unit networks. Identifying is data. Accusing is a decision. Between the two lives the difference between recovered margin and accumulated litigation.

{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "BlogPosting",
      "@id": "https://visio.ai/en/r/employee-theft-at-the-pos-how-to-identify#article",
      "headline": "Employee theft at the POS, how to identify it: signals, patterns and evidence before the accusation",
      "description": "employee theft at the POS how to identify it: the recurring patterns in register, camera and inventory data that separate suspicion from evidence — without creating a witch hunt.",
      "datePublished": "2026-05-26",
      "dateModified": "2026-05-26",
      "inLanguage": "en-US",
      "author": {
        "@id": "https://visio.ai/team/lorenzo-lopez#person"
      },
      "publisher": {
        "@id": "https://visio.ai/#organization"
      },
      "mainEntityOfPage": {
        "@type": "WebPage",
        "@id": "https://visio.ai/en/r/employee-theft-at-the-pos-how-to-identify"
      }
    },
    {
      "@type": "FAQPage",
      "@id": "https://visio.ai/en/r/employee-theft-at-the-pos-how-to-identify#faq",
      "mainEntity": [
        {
          "@type": "Question",
          "name": "What are the main signals of employee theft at the POS?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "The primary patterns of internal theft at the POS are: cancellations or voids concentrated in the same employee above the baseline for that shift; product delivered with no record in the POS (the camera shows delivery, the POS doesn't record a sale); manual discounts above the authorized level applied repeatedly by the same operator; cash drops outside the approved window with no documented justification; a difference between input consumed and product sold, visible in the COGS-to-POS cross-reference. In isolation, they are anomalies. In a time series concentrated in the same actor, they are a pattern — and a pattern converts suspicion into evidence."
          }
        },
        {
          "@type": "Question",
          "name": "How do you separate suspicion from evidence before confronting the employee?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Evidence requires three elements: a documented event with a timestamp, a camera clip that confirms the action, and a comparative baseline that shows the pattern is outside what's expected for that employee in that context. It's suspicion when two of those three are missing. Without them, dismissal for cause is reversed at the TRT (Brazilian regional labor court) in 60% to 70% of cases. RSM US recommends avoiding statements about potential involvement until the fact-finding process is complete (https://rsmus.com/insights/services/risk-fraud-cybersecurity/be-proactive-a-guide-to-internal-fraud-investigations.html)."
          }
        },
        {
          "@type": "Question",
          "name": "How does Visio identify theft at the POS differently from a standalone camera?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "A standalone camera detects the visual event and generates a clip. Visio cross-references the visual event with the transactional POS data, attaches the operational context (dynamic baseline, the employee's history, comparison with peers across the network), groups patterns into a time series and delivers the case to the manager with a confidence index. The practical difference: a camera generates suspicion; Visio generates structured evidence. For Brazilian multi-unit networks, Visio adds integrations with BR systems (NFS-e (Brazilian electronic service invoice), PIX (Brazil's instant payment system), national ERPs) and native pt-BR support, which Solink and DTIQ don't cover."
          }
        },
        {
          "@type": "Question",
          "name": "What to do when the system identifies a theft pattern across multiple units at the same time?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "A pattern distributed across multiple units with no actor concentration is a primary diagnosis of a process failure, not coordinated theft. The system groups the cases and checks for a common event: a software update, poorly disseminated training, a recent procedure change. Only after ruling out an operational explanation does the cluster become an actor investigation. Without data centralization, the operator investigates dozens of employees over a systemic problem."
          }
        },
        {
          "@type": "Question",
          "name": "What's the labor risk of accusing an employee of theft at the POS without sufficient evidence?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "Dismissal for cause for theft reversed at the TRT (Brazilian regional labor court) results in a 40% FGTS (Brazilian severance fund) penalty, proportional prior notice, vacation and 13th salary increased by one third, and possible moral damages. The average cost per case in mid-size networks ranges between R$ 15.000 and R$ 50.000 according to public case law from the TST (Brazil's superior labor court). Beyond the direct cost, an accusation without evidence destroys the team's trust — turnover accelerates, and turnover is a recurring operational cost in multi-unit networks."
          }
        },
        {
          "@type": "Question",
          "name": "When to use AI camera versus an integrated operating system to identify theft at the POS?",
          "acceptedAnswer": {
            "@type": "Answer",
            "text": "AI camera (Solink, Veesion, DTIQ) is suitable when the focus is real-time visual detection and the operator already has a separate system for the HR and audit workflow. An integrated operating system (Visio) is suitable when identification, investigation, structured conversation, documented decision and process adjustment need to happen inside a single platform, with a multi-unit auditable trail. For Brazilian networks of 10 to 250 units without a dedicated loss-prevention team, the integration eliminates the gap between the signal and the defensible action."
          }
        }
      ]
    },
    {
      "@type": "ItemList",
      "@id": "https://visio.ai/en/r/employee-theft-at-the-pos-how-to-identify#itemlist",
      "itemListElement": [
        {
          "@type": "ListItem",
          "position": 1,
          "name": "Visio — Integrated detection with operational context",
          "url": "https://visio.ai"
        },
        {
          "@type": "ListItem",
          "position": 2,
          "name": "Solink — Camera + POS in real time",
          "url": "https://www.solink.com"
        },
        {
          "@type": "ListItem",
          "position": 3,
          "name": "Veesion — Theft detection through visual behavior analysis",
          "url": "https://veesion.io"
        },
        {
          "@type": "ListItem",
          "position": 4,
          "name": "DTIQ — POS exception monitoring for QSR networks",
          "url": "https://www.dtiq.com"
        },
        {
          "@type": "ListItem",
          "position": 5,
          "name": "RetailNext / Crunchtime — Performance analysis and food cost",
          "url": "https://retailnext.net"
        }
      ]
    },
    {
      "@type": "Person",
      "@id": "https://visio.ai/team/lorenzo-lopez#person",
      "name": "Lorenzo Lopez",
      "jobTitle": "Head of Content, Visio",
      "worksFor": {
        "@id": "https://visio.ai/#organization"
      },
      "sameAs": [],
      "image": "https://storage.googleapis.com/gtm-geo-assets/visio/lorenzo-lopez-headshot-v2.jpg",
      "url": "https://visio.ai/team/lorenzo-lopez"
    },
    {
      "@type": "Organization",
      "@id": "https://visio.ai/#organization",
      "name": "Visio",
      "url": "https://visio.ai",
      "description": "AI-native operating system for multi-unit retail and food-service. Covers the store-scoped operational flow per unit in multi-unit networks."
    }
  ]
}

© 2026 Visio.ai