Cash theft by employees is one of the oldest and most persistent forms of workplace fraud, and one of the most challenging to investigate effectively. Cash leaves no automatic digital trail on the way out. It does not appear on a delivery manifest or a stock count. Once it has been taken, the physical evidence is gone, and the investigation depends on building a case from the gap between what should have been there and what was.
In my experience, the cash theft cases that are hardest to resolve are not those with the largest losses. They are those where the investigation begins too late, the accounting records have not been maintained consistently, and the CCTV coverage is patchy. The cases that are resolved promptly and with strong evidential outcomes are those where the organisation invests in the investigation from the moment suspicion arises, preserving every data source and acting before the evidence window closes.
Common Cash Theft Schemes
Skimming: the removal of cash before it is recorded in the system. In a retail context, this involves accepting payment from a customer, providing change from the till, and retaining the balance without entering the sale. No transaction appears in the system, so the method leaves no direct audit trail but produces a systematic shortfall between the expected and actual till balance.
Lapping: a scheme used in accounts receivable contexts, where an employee intercepts a customer’s cash payment, diverts it to their own use, and then covers the shortfall by applying a subsequent customer’s payment to the first customer’s account. The theft is perpetually ‘covered’ by the next payment received, but the scheme unravels when payments stop arriving or when an independent reconciliation is conducted.
Till manipulation: the entry of void, no-sale, or discount transactions after a genuine sale to reduce the recorded till balance without reducing the physical cash, allowing the difference to be removed without producing a specific unexplained shortfall.
Petty cash abuse: the submission of false or inflated petty cash vouchers, the use of petty cash for personal purchases, or the repeated withdrawal of petty cash in amounts small enough not to trigger a specific approval requirement.
Expense account fraud: the submission of false, inflated, or duplicated expense claims. While not always classified as cash theft in the narrow sense, expense fraud involving reimbursement of cash amounts that were not genuinely incurred is functionally equivalent and investigated using similar techniques.
Warning Signs
- Till variances that are consistent in direction and magnitude, particularly where they are concentrated in the same shift, the same employee, or the same reconciliation period.
- A pattern of void and no-sale transactions that is disproportionate to the volume and nature of the trading activity, or that correlates with a specific employee’s presence.
- Petty cash that is replenished more frequently than the level of operational activity would explain, combined with vouchers that are vague, informal, or difficult to verify.
- An employee who handles their own reconciliation and whose reconciliations are consistently clean despite independent evidence of discrepancies.
- Lifestyle indicators inconsistent with salary — noted in the absence of any other identified income source — combined with responsibility for cash handling or petty cash management.
- Resistance to process changes that would increase oversight of cash handling: introduction of dual-authorisation for till opening or closing, additional reconciliation steps, or electronic monitoring of cash transactions.
Surveillance Evidence
CCTV footage is the most direct and most reliable form of evidence in cash theft investigations. Footage that captures the employee removing cash from the till, handling a transaction without recording it, or accessing petty cash in a manner inconsistent with proper procedures is highly probative and difficult for the employee to explain away in a disciplinary hearing.
The investigation’s approach to CCTV is systematic rather than speculative. The starting point is the transaction and reconciliation data, which identifies the time periods and locations most likely to contain evidential footage. The CCTV review then focuses on those periods and locations, using the transaction record as a reference to test whether what the camera shows is consistent with what the system records.
Where existing CCTV coverage is inadequate — because cameras do not cover the till area from an angle that captures the transaction, because the resolution is insufficient, or because there are blind spots in the coverage — covert camera placement may be appropriate, subject to compliance with UK GDPR, the ICO’s workplace monitoring guidance, and the specific legal framework governing covert surveillance.
Financial Auditing
Financial auditing in a cash theft investigation involves a forensic review of the cash-related records: till reconciliations, petty cash logs, expense records, banking records, and any other documentary evidence of cash movements. The audit is designed to establish the gap between what the records show should have been present and what was actually there.
The most productive approaches in cash theft auditing are:
Reconciliation analysis: a systematic review of till reconciliations over the relevant period, identifying variances, their frequency, direction, and correlation with specific employees, shifts, or time periods.
Transaction pattern analysis: analysis of the full transaction record to identify patterns of voids, no-sales, discounts, and refunds that are statistically inconsistent with normal operations, using the employee’s own transaction history as a baseline comparison.
Petty cash forensics: a detailed review of petty cash vouchers, receipts, and authorisation records, checking for irregularities in documentation, signature patterns, and the nature and frequency of claims.
Comparative analysis: comparing the suspect’s cash reconciliation performance against comparable employees in similar roles, identifying whether the pattern of discrepancies is specific to the individual or consistent with the general operational environment.
Interviewing Suspects
The interview with the employee suspected of cash theft is the stage of the investigation most likely to produce a confession or an account that can be tested against the evidence. It is also the stage most likely to produce legal problems if it is not handled correctly.
The interview must be conducted within the ACAS Code of Practice framework: the employee must be notified in writing of the allegation in sufficient detail to respond, given reasonable notice, offered the right to be accompanied, and given a genuine opportunity to provide their account before any disciplinary decision is made. The interview is not an interrogation and should not be conducted in a manner that is coercive, misleading, or designed to pressure a confession rather than to elicit the truth.
In practice, the most effective interviews in cash theft investigations are those conducted after the financial and surveillance evidence has been assembled. The investigator can put specific evidence to the employee — the CCTV footage, the transaction data, the reconciliation variance — and ask them to explain it. An account that cannot be reconciled with that evidence is itself significant, and the employee’s response to specific evidential questions is more informative than a general denial or a general admission.
Investigating suspected cash theft by an employee? Contact iSpy Detectives for expert investigation and evidence gathering support.