Internal Threats in Retail

Internal threats – namely employee theft from stores and employee collusion in organised crime – pose a major and growing risk to the retail industry. Retailers need to focus on internal threats as much as they do external threats, such as shoplifting.

In this article, Titan Security Europe’s retail security experts look at examples of employee theft and employee collusion in organised crime, and what retailers can do to protect their stores.

Employee Theft

Employee theft makes up around 30-40% of total retail losses and costs the UK around £3.2 billion annually.

• 44% of employee theft occurs in warehouses and distribution centres.
• 28% of employee theft occurs in the stores themselves.
• 28% of employee theft occurs during goods transport.

Examples

Merchandise Theft

• “Sweethearting”: When a friend or family member of an employee is checking out, employees intentionally do not scan items or give the person an unauthorised discount, costing the store as goods are not selling for the price set.
• Stockroom Theft: As many stockrooms and distribution centres are blind spots, employees take stock directly from these places to sell on after their shift – so some stock never even makes it as far as the shop floor.
• Consuming or Damaging Goods: Staff take sold goods into private unmonitored areas to use them without paying. They eat food sold by the store, use makeup or perfume or other goods, or open packs of items and distribute them amongst themselves.

Cash Handling & Register Fraud

• Till Tipping: When customers are paying in cash, employees planning to steal can under-ring products or not ring them up at all, and proceed to pocket part or all of the cash paid to them instead of putting it in the till, taking money that is supposed to go to the store.
• Fake Returns: Employees process fake refunds for items that have not been returned. They issue the money to themselves as cash or to their card, or issue themselves a gift card. This messes with stock inventory within the store and leads to financial loss.

Solutions

• Exception-Based Reporting (EBR)

Retailers can integrate their Point of Sale (POS) systems with EBR software. This software automatically flags any suspicious transactions, such as:

• Excessive voids
• Unusual price overrides
• Frequent “no sale” drawer openings

When combined with individual logins for registers, repeated suspicious activity will be traceable to specific employees, allowing retailers to launch investigations into potentially malicious behaviour.

• CCTV Placement

CCTV installation in stockrooms and continuous monitoring in warehouses will prevent thefts from these areas, or at the very least allow retail security teams to identify a theft and perpetrator.

CCTV should also be placed strategically behind till points to monitor employees at the register. These systems can be upgraded with AI behavioural analytics that can pick up on suspicious behaviour, as well as allowing security teams to see if employees are using the tills incorrectly on purpose.

• Strict Managerial Controls

Implement that managers are needed to override prices, process voids or discounts, and process returns. As these are often the weak points at point of sale for employee theft, preventing employees from being able to give out these benefits or override price themselves dramatically decreases the risk of employee theft.

• Visible Anti-Theft Messaging

In private staff areas such as staffrooms or stockrooms, place visible messaging reminding employees that there is CCTV around the store, that inventory and register history is frequently checked, and that spot-checks could occur at any moment.

70% of people have reported that they are less likely to attempt theft if they know they are being watched – so visible messaging conveying this will deter employees from theft.

Involvement in Organised Crime Groups (OCR Groups)

Organised crime is sharply rising in the retail industry.

52% of UK retailers believe incidents involving organised crime groups has risen over the past year. Across the rest of Europe, 72% of thefts happen as a result of organised groups as opposed to lone individuals.

21% of retailers in the US have reported an increase in employee collusion with organised crime groups, with 64% reporting that there has been no improvement in the matter.

 Examples

Supply Chain & Logistics Infiltration

• Altered Invoices: Employees working in warehouses work alongside organised crime syndicates by altering delivery notes to mark entire cages of high-value stock as either “damaged” or “missing”, and therefore no good for sale. They redirect the stock to the black market instead of the retail store, receiving a cut of the profits.
• Warehouse and Stockroom Collusion: Employees with access to warehouses or stockrooms deliberately overlook security checks or disable security cameras, allowing OCR groups to have access to the area in order to steal inventory without leaving a trace until the stock is noticed to be missing.

“Blind Spot” Complicity  

• Store blind spots: Employees use their knowledge of store layouts, including areas that go unmonitored, to direct shoplifting gangs to spots they can steal from with little chance of being caught. Employees can also prop open restricted doors to enable “smash-and-grab” incidents without the groups drawing too much attention to themselves.
• Door Bypasses: Employees collude with organised groups by giving them codes or keys to restricted areas or giving them intel on guard patrol timings, allowing the groups to easily enter the buildings out-of-hours.

Solutions

• Duty Segregation

Implement protocol that states that no single employee has end-to-end control over high-risk processes. An employee who signs off on an invoice should not be the one who processes payment. Employees who check inventory should rotate.

By segregating and rotating duties, the damage that can be done through employee collusion is limited, as they cannot guarantee what process they will be in charge of.

• AI Behavioural Analytics

Retailers can use AI behavioural analytics in CCTV and till process to flag suspicious patterns based on pattern recognition. The system will flag any processes that do not match up to the pattern it knows;

• Odd transactions
• Repeated invoice edits
• Strange entry times to stores and warehouses

It will alert store managers or security teams to the suspicious activity, allowing for investigation.

• Managerial Override for Cameras

Install software that prevents CCTV cameras from being disabled unless a specific code or password is entered. Only managers and executives should be aware of these codes and passwords and they should be changed frequently (i.e. monthly).

Preventing below-management employees from being able to disable cameras in warehouses and stockrooms will prevent the chance of organised groups entering without being caught, even with the help of employees.

• Guard Patrols and Biometrics

Instead of having set times for guard patrols to check on a store overnight, randomise the patrols so that employees are not able to share the details of the patrols with organised groups.

Change access control to the stores to biometric systems such as fingerprints or Face ID instead of relying on codes and keys. This ensures that only employees can enter, and entry codes cannot be shared with organised criminals.

Conclusion

Employee theft and collusion in organised crime poses a major threat to retailers, as threats coming from within a company are far harder to track and handle.

Insiders have access to data, are often trusted with stock in unmonitored areas, and can be given control over high-risk processes if trusted enough. Tackling internal threats in retail requires a mix of in-store protocol and hardened security services. By tweaking security services to ensure that CCTV monitors employee conduct a little more closely or that only managers can have control over the CCTV monitoring, and by implementing protocol that takes potentially damaging control away from retail staff, retailers can start to protect their stores from insider thre