Staff Theft in Hospitality - Part 2

Part 2: The Mechanisms

Part one made the case that this is more common than the numbers suggest, and explained why the numbers can't be trusted to show it. This post is about what it actually looks like. Not in theory - in the till, in the cellar, and in the areas where nobody is looking.

Split into two groups. The first happens at the till, where there's always a digital trail if you know where to look. The second happens away from it, where there often isn't one at all.

At the till

1. Under-ringing

A cash sale gets registered in the till at less than what was actually charged. A pint sold for £6, rung through as £1, with the difference pocketed. Drinks with nice round values are easy pickings, this one especially where a £5 note can be lifted and concealed easier than five one pound coins can. Done once, it's invisible. Done repeatedly across a shift, it needs to be tracked somehow, and that tracking is often the tell.

I've seen this done with coins. A 50p piece moved into the wrong section of the till drawer, one for every £5 under-ring, so the person doing it knows exactly how much is sitting there to lift out at a quiet moment without having to count anything or write anything down. I've also seen it done with matchboxes moved around on top of the till, same idea, different object.

The lesson isn't just “watch for under-ringing.” It's that someone running this scheme needs a private way to count their own theft without leaving a record, and that private tally is usually improvised out of whatever's already lying around. Coins in the wrong denomination slot. An object on the till that doesn't belong there and moves through a shift. Either one, on its own, means nothing. Both should send alarm bells ringing.

2. Disguised voids

A real sale is served, paid for in cash, and then voided off the system after the money's already been taken. Done cleanly, the till still balances at the end of the shift, because the till roll no longer recognises that the sale ever took place.

One version of this I actually investigated was more deliberate than a straight void.

A pot of tea for two and cakes, paid for in cash at the table. Registered in the till as it was table service, then upon discovering that the guest wished to settle with cash the team voided all products and rang through a 50p vanilla syrup instead, just to get the drawer open without it looking like an unexplained no-sale. Fifty pence through the till. Ten pounds in their pocket.

That's worth understanding properly, because it's cleverer than it first looks. The point wasn't the syrup. It was needing a plausible reason for the drawer to open at all, so that opening it didn't stand out on its own. Any small, cheap item rung through, especially multiple times, needs investigation - The first question asked in the disciplinary was how a shot of vanilla syup is served... The answer "we don't serve syrup on it's own".

3. Reopened and doctored checks

A closed check is reopened after payment's been taken, and items are removed or the total's adjusted downward, with the difference pocketed. In my experience this one tends to be messy rather than sophisticated, hard to decipher at first glance, but the intent is always the same: lower what the system says was owed, after the cash for the real amount has already gone into someone's pocket rather than the till.

Look for clusters of instances of voids and adjustments on your server reports.

4. Refund fraud

A refund is processed against a transaction that was never actually returned, and the “refunded” cash is pocketed, or a card refund is redirected. This should never be possible without a manager's authorisation and a logged reason, given before the refund processes, not after. Putting a Refund Register in place for these transactions to be listed, explained and accountability signed for can help here.

5. Comp and discount abuse

A staff discount, manager comp, or promotional code applied to a full-price sale, with the difference either pocketed in cash or handed to someone who was never entitled to it. Same principle as under-ringing: the sale looks legitimate, it's just recorded at less than what was actually paid. Look for high instances of discounts and comps, especially in relation to colleagues who work similar, or the same, shifts.

6. No-sale drawer opens with no linked transaction

The till opened using the no-sale function, not to give change, but to access cash directly. A small number of these across a shift is normal. A high or clustered number, especially from one person, isn't. If this is occurring, look at the setup and make these functions unavailable to non-supervisory staff.

7. Passing drinks or food across the bar with no transaction at all

This is the hardest of the seven to catch, because there's nothing to catch on the till side. Nothing's rung through, so there's no void, no discrepancy, no drawer opening to flag. It doesn't show up as a cash problem. It shows up as a stock problem - losses of product on line checks ,on shifts worked by a specific person.

Detection here has to come from the stock side, not the till side, which is exactly why the two need to be checked against each other, not just checked separately. Insisting that a receipt if presented to the guest with every sale can help discourage this.

Away from the till

8. Delivery shortages before stock even reaches the cellar

Stock going missing between the supplier's van and the locked cellar, before it's ever counted in. Every delivery note needs cross-referencing against the purchase order at the point of delivery, not assumed to match because the invoice or the delivery driver says so.

9. Overnight and early-morning stock removal

Proteins and other high-value stock removed from the premises when nobody's supervising the building - Overnight, or in the early morning before service starts.

This is where cleaners and early-shift staff carry a disproportionate share of risk, simply because they're often alone in the building with keys and no oversight. The same applies to bar fridges, not just kitchen stock.

The fix isn't complicated: count what's there last thing at night, and count it again first thing in the morning. If a gap only ever appears overnight, you've isolated exactly when it's happening, which tells you exactly who had access to it.

10. Access given to people who should never have had it

Not theft by someone with legitimate access misusing it - This is theft made possible because access was handed out that never should have existed.

A back door left ajar every morning so a greengrocer can let himself in and drop off deliveries unsupervised. A keycode given to a delivery driver so nobody has to be there to let him in.

Both of those hand an outsider unsupervised run of the building, not just the goods on his invoice. This isn't a detection problem the way the previous nine are. It's a policy failure sitting a step upstream of everything else on this list, and it's worth checking before looking for anything more sophisticated: who actually has keys, and why.

That's the full picture of how it happens.

Part three covers how you actually catch it, and just as importantly, why “I trust my team” is the sentence that lets most of this go unnoticed for as long as it does.

Visit Part 1 : The Official Numbers Say It Isn't Happening... It Is.

Visit Part 3 : How You Actually Catch It