Restaurant theft prevention: how to stop the 4% profit leak

Short answer: internal theft costs restaurants around 4% of sales (up to ~7% in quick service), and roughly 75% of inventory shrinkage is theft rather than waste, in an industry whose entire net margin is often 3–5%. The response is not suspicion; it is design: individual POS logins with permission tiers, manager sign-off on voids and refunds, five weekly outlier reports, blind cash counts, regular stock counts that turn theft visible, disclosed cameras over money paths, and a culture that frames all of it as protecting the honest majority, because that is exactly what it does. Here is the system, scam by scam.

The numbers that justify the boring work

Two framings follow. First, a venue that closes half this leak adds more profit than most marketing campaigns, silently. Second, the honest majority of your team pays for theft too, in missing stock they get blamed for, tills that do not balance on their shift, and margins that suppress wages, which is why the controls below protect them first.

The transactional scams and their controls

• The void scam (take cash, void an item, pocket the gap): individual logins, void permission above a small threshold reserved to managers, and the weekly voids-by-staff report, outliers against team average are the tell.
• Sweethearting / not ringing sales (cash taken, no sale recorded): drawer opens only on transactions, no-sale report reviewed weekly, receipts offered by default (a customer expecting a receipt forces a ring-up).
• Comp and discount abuse: named comp reasons required, per-person comp authority with limits (generous enough for real service recovery, logged always, see the customer-service comp system), and the comps-by-staff report beside it.
• Fake refunds: refunds require manager PIN + reason, matched weekly against actual returns and reversals.

The pattern in all four: individual accountability plus a threshold plus a weekly outlier read. None of it slows honest service; all of it deletes the opportunity story.

Cash: routines beat trust and suspicion alike

Where cash still flows, the routine is the control: one person per drawer per shift (variance becomes attributable), blind counts at close (the counter does not see the expected total first), drops to the safe above a stated float ceiling, dual sign-off on banking, and variance logged by shift with a stated tolerance, investigated when a pattern forms, not when a single $4 goes missing. The quiet benefit of the direct-payment era: every card and online order is already un-stealable at the till, which is one more reason the connected POS and your own ordering channel pay for themselves.

Stock: counts are the detection layer

Back-of-house theft hides inside “waste” until counting makes it visible. The machinery you already run for margin doubles as security: weekly counts of the expensive movers (proteins, alcohol, seafood), theoretical-versus-actual usage from your recipes (the gap method in food cost and inventory), goods-in checked against invoices by someone other than the orderer, and a back door that is locked, alarmed or observed. A kitchen that counts weekly has shrinkage conversations measured in days; one that counts quarterly donates a season before noticing.

Cameras, done legally and calmly

Cameras over the registers, safe and back door, disclosed openly, never in break rooms or bathrooms, and compliant with local notification law, deter far more than they catch: the mere possibility that a void can be matched to footage removes the opportunity narrative. Retain footage per local rules, restrict who reviews it, and treat it as the complement to controls, not the substitute, a camera that nobody cross-references with the void report is furniture.

Culture, and the day you catch someone

Introduce every control as what it is: protection for the honest, who are most of your team, most of the time. Pay correctly and on time (theft rationalisation feeds on grievance), keep comp authority generous and logged so service recovery never needs sneaking, and review the reports visibly and boringly, deterrence is mostly the knowledge that someone looks. If the day comes: document first (reports, footage, statements), suspend rather than ambush, take employment-law advice before dismissal, process errors convert thieves into successful claimants, decide police involvement on scale, and then fix the control that made it possible. Quiet, clean, systemic.

Mistakes that keep the leak open

• Shared POS PINs, accountability dies at the first shared login.
• Void and comp powers for everyone, with no reports behind them.
• Counting stock quarterly and calling the gap “waste”.
• Confronting a suspect mid-shift on instinct, and losing the employment case that follows.
• Treating controls as insults to staff instead of protection for them, framing decides whether the system builds trust or corrodes it.

Frequently asked questions

How common is employee theft in restaurants?
Common enough to budget for: industry estimates put internal theft around 4% of restaurant sales (and up to ~7% in quick service), with roughly 75% of inventory shrinkage attributed to theft rather than waste or error. In a 3–5% net-margin industry, that means unmanaged shrinkage can quietly consume the entire profit line. This is a systems problem, not a hiring-bad-people problem.

What are the most common ways staff steal from restaurants?
The classics are transactional: voiding items after taking cash (customer pays $48, one item gets voided, the difference pockets), not ringing sales at all (“sweethearting” the register), comp and discount abuse, and fake refunds. Then the physical: stock walking out the back door, over-pouring for tips, and grazing that scales. Every one of them shows up in data if the data is watched.

How do I prevent theft without treating staff like suspects?
Design the environment so honesty is the easy default: individual POS logins (never shared PINs), manager approval on voids/refunds/discounts above a threshold, blind cash drops and till counts, regular inventory counts, and visible, boring review of the numbers. Frame it as protecting the honest majority, which it genuinely is, the same controls that catch a thief also clear an innocent person when cash is short.

What POS reports catch theft?
Five weekly reads: voids by staff member (the single most revealing report), comps and discounts by staff, refunds, no-sale drawer opens, and cash variance by shift. You are looking for outliers against the team average, one server voiding 4x the norm is either badly trained or running the oldest scam in hospitality, and both need the same conversation. Modern POS permission systems make these reports a glance.

Should I install cameras in my restaurant?
Over the register, the safe and the back door, yes, disclosed openly and covering money and stock paths, not staff break areas. Cameras deter more than they catch: the knowledge that voids can be matched to footage removes the opportunity story entirely. Check local law on placement and notification, and remember cameras complement controls; they never replace them.

What do I do if I catch an employee stealing?
Follow process, not fury: document everything (reports, footage, statements), suspend rather than confront mid-shift, get employment-law advice before dismissing (process failures turn thieves into successful unfair-dismissal claimants), decide on police involvement based on scale and evidence, and then fix the control that made it possible. The goal is a clean exit and a stronger system, not a scene.