Employee fraud detection: choosing what comes next
So, you have an established employee fraud detection system, experienced analysts and reports going out to stores. But…
- Too much is manual.
- Your team wastes time checking false alarms.
- And new forms of fraud slip under your radar.
You’re ready to make changes. But you’re not sure whether to improve the system you have, or replace it.
That was the dilemma one retailer brought to our working group this week.
Our study of how strategic marketing can cut internal theft explores how highlighting the risk of being caught can deter staff dishonesty.
Retailers need both prevention and effective detection. This article focuses on choosing the systems, data and people needed to detect fraud.
Before deciding how much to invest in prevention and detection, start by agreeing with senior leaders:
- which risks the business is prepared to accept;
- what controls can realistically achieve;
- and what disruption to stores is reasonable.
Then choose the people, data and technology to support that approach.
These seven questions will help.
1. What should employee fraud detection cover?
Exception-based reporting flags activity that falls outside defined expectations, such as unusual refunds, voids or discounts.
It gives analysts a starting point for investigation and remains useful to many participants. But how far should its remit extend?
One retailer deliberately narrowed its platform’s role to streamline operational tasks. Others wanted a broader view of losses.
You should start by identifying the risks you need to address.
If staff dishonesty is the priority, consider where it can occur beyond the till:
- online fulfilment?
- click-and-collect?
- delivery?
- inventory movements?
- or cash handling elsewhere in the store?
This doesn’t mean putting every business problem into one tool. Think about which risks the investment should cover, and which belong elsewhere.
2. Can your data answer the questions you are asking?
Several retailers described plans limited by fragmented information. Advanced analysis was difficult while records remained in siloed systems.
One retailer thought it had a report that would flag suspicious cash transactions.
After a theft came to light, the team realised the report had not been flagging the activity it was meant to catch.
Before changing your employee fraud detection system, map the information each important use case needs. Check whether:
- it is available;
- correctly understood;
- and reliably linked to the relevant transaction or employee.
Records associated with a shared login, for example, need careful interpretation before assigning responsibility.
Freshness matters too. Daily reporting may suit some investigations; other activity warrants a quicker response.
3. Which patterns warrant investigation?
Participants repeatedly described the value of bringing smaller signals together.
Separate reports might flag unusual refunds, staff discounts or inventory adjustments.
Examined together over time, those activities may provide a stronger reason to investigate.
One retailer reported that moving from individual exceptions towards patterns had produced fewer investigations along with more significant outcomes.
4. Can video make the evidence easier to assess?
Linking transaction records to the relevant footage can save investigators time searching recordings.
Participants described using video to help establish what happened around a flagged transaction and whether it needed further investigation.
One retailer was piloting internally developed computer vision to narrow the periods investigators should review when looking into possible cash theft.
Another had worked with its existing CCTV provider to bring transaction data into its video platform.
These examples suggest several possible routes, but they do not establish that any particular AI application will deliver the same results elsewhere.
5. Should you buy, build or combine?
In our working group, retailers shared examples:
- of buying established platforms;
- of extending existing systems;
- and of developing their own analytics.
The choice depends on how your business stores and analyses data.
One retailer described using its exception-based reporting platform increasingly for case management, while more analysis happened elsewhere.
Before buying or building, check who will maintain the system and whether you would be paying to move.
It’s important to analyse the same data across several locations.
Budget for infrastructure, integration and recurring licence fees, including any weekly charges per camera.
A lower upfront price can still mean a substantial ongoing bill.
AI can reveal patterns across large datasets, but analysts need the skills to test what those patterns mean.
One retailer was using apprenticeships to combine experienced colleagues’ fraud knowledge with new analytical skills.
So, plan how you will recruit, train and retain analysts.
6. Who acts when the system flags something?
More alerts can overwhelm a team without improving its ability to stop losses.
One participant described the workload created when video-linked exceptions began generating hundreds of potential cases.
Retailers had different arrangements for managing this, from central analysts to store managers.
One described preparing cases so that colleagues receiving them had the information needed to act, rather than a raw alert to decipher.
In follow-up feedback, one retailer emphasised that store managers are retailers, not loss prevention specialists, and face competing priorities.
It was exploring ways to reduce the burden by sending stores only those exceptions where action was likely to make a meaningful difference.
The feedback also stressed the importance of training: helping store teams understand why an issue matters and how to investigate it locally.
It called for retail and people teams to agree a consistent approach to internal risk, taking account of both employment and criminal law considerations.
This would support a clear zero-tolerance position on dishonesty while ensuring individual cases were handled appropriately.
When designing your system:
- Decide who reviews the signal, what evidence they need:
- how urgency is assessed;
- and where unresolved work goes.
Track whether the queue is being cleared and what investigators learn from it.
7. What would make the investment worthwhile?
Case numbers tell only part of the story and may lead to misdiagnosis of the issue.
Assess your employee fraud detection against several measures:
- how quickly problems are identified;
- how much investigation time is required;
- the proportion of alerts that prove useful;
- and the losses addressed.
Keep recorded losses separate from estimates of future losses prevented, and make the assumptions behind those estimates visible.
Give prevention a place in the budget alongside detection.
Staff communications can explain acceptable behaviour, the consequences of dishonesty and where to get help.
Start during onboarding and reinforce those messages throughout employment.
Our research on employee engagement and retail loss found an association between stronger engagement and lower losses.
Changes in workplace culture may be harder to measure than cases detected, but they belong in the investment decision.
This discussion began with a retailer asking peers for help with a live decision. If your team faces a similar challenge, let us know.
In our latest research project, Prof Lisa Jack of Portsmouth University explores how to put a value on retail crime prevention. Stay tuned for more details.
Acknowledgements
We thank all the retailers that took part in our research and working groups. With special thanks to the following for reviewing an earlier draft and sharing their perspectives:
