{
  "question": "How can a small business owner or their accountant tell whether an employee is skimming cash sales, taking customers' cash and never ringing or recording the sale, when the theft leaves nothing in the books to find?",
  "slug": "how-to-catch-an-employee-skimming-cash-sales-that-never-get-rung-up",
  "url": "https://www.rightshold.com/answers/how-to-catch-an-employee-skimming-cash-sales-that-never-get-rung-up",
  "short_answer": "You can't find an unrecorded sale by reading the books, because it was never in them, so you test the books against something the skimmer doesn't control. The ACFE defines skimming as stealing an incoming payment before it is recorded, for example accepting a customer's payment, not recording the sale and pocketing the money. The tell-tale effect is that sales come in lower than they should while the cost of what was sold stays the same, so look for a falling gross margin, rising inventory shrinkage, a cash share of sales that drops while card sales hold steady, and customer complaints about missing receipts. The practical checks are independent counts: compare what left the stockroom or kitchen with what was rung up, compare cash sales by shift and person, do surprise cash counts, and ask customers to expect a receipt. In the ACFE's Occupational Fraud 2026 report, skimming appeared in 17% of cases at organizations with fewer than 100 employees against 6% at larger ones, with a median loss of USD 45,000 and a typical duration of 12 months.",
  "checklist": [
    "Work out what sales should have been from cost. Take what you bought and used in a period (stock, ingredients, materials) and apply your normal markup or margin. If recorded sales fall well short, and prices and waste don't explain it, something is going unrecorded.",
    "Track gross margin and inventory shrinkage monthly, and by location, shift or route if you can. Skimming lowers sales without lowering cost, so margins slide while the business seems just as busy.",
    "Watch the cash share of sales. If cash falls as a percentage of total sales at one till, shift or person while card sales hold steady, ask why. Card sales are harder to skim because each card payment leaves a record outside the till.",
    "Compare activity with takings. Covers seated, tickets issued, jobs completed, hours billed, cars parked: if the activity count holds steady and cash revenue drops, the gap needs explaining.",
    "Make the customer your control. Post a sign telling customers to expect a receipt, train staff to hand one over every time, and take complaints about missing or wrong receipts seriously.",
    "Separate taking the order from taking the money where you can, and close out each till with someone who didn't work it during the shift.",
    "Do surprise cash counts and surprise stock counts, and tell staff they happen. A week of tight supervision that produces unusually high takings is itself evidence of what was being lost.",
    "Keep the independent counts somewhere the till staff can't change, dated on the day: stock used, activity counts and cash counted. A record kept in the same POS or spreadsheet as the sales is only as good as the person who can edit it.",
    "If you suspect theft, talk to your accountant or a fraud examiner before confronting anyone, and keep the counts and records as they are."
  ],
  "sections": [
    {
      "heading": "Why skimming doesn't show up in the books",
      "points": [
        "Fraud examiners split cash theft into on-book and off-book schemes. In cash larceny the money is taken after it's recorded, so a register count or bank reconciliation shows a shortage. Skimming is off-book: a 2003 CPA Journal article on investigating these schemes notes that because the cash is taken before it enters the accounting records, no record of the fraud exists on the company's books, and the business generally doesn't know a theft has happened.",
        "The ACFE's 2026 fraud tree splits skimming into three branches: sales (unrecorded or understated), receivables (write-off schemes, lapping and unconcealed) and refunds and other. Unrecorded sales are the simplest: the customer pays, nothing is rung, and the cash goes into a pocket. Understated sales are rung for less than the customer paid.",
        "It needs no cover-up in the books, which is why owners often find out only from indirect signs. The ACFE's 2026 report found that 43% of frauds were first detected by a tip and that 21% of tips came from customers, so a customer who says they never got a receipt is worth listening to."
      ]
    },
    {
      "heading": "The numbers that give it away",
      "points": [
        "A Journal of Accountancy column by the ACFE's founder puts the accounting effect simply: revenue is lower than it should be, but the cost of producing that revenue stays the same. Its list of indicators: flat or declining revenue, increasing cost of sales, excessive or increasing inventory shrinkage, a decreasing ratio of cash sales to card sales, a decreasing ratio of cash sales to total sales, a rising ratio of gross to net sales, differences between the customer's receipt and the company's copy, customer complaints, and missing or altered refund documents.",
        "The CPA Journal case shows the method. A cash-only venue's owner expected 35% margins and was getting 10%. Investigators rebuilt the year's expected revenue from purchases and the venue's own markups and found food sales came in below their cost. They then ran a week of strict supervision, with surprise cash counts and stock changes reconciled to the register tapes: receipts that week were USD 30,960, against USD 25,775 the week before and a USD 22,006 average week, on what staff called a slow week.",
        "The fixes in that case were the ones above: one person responsible for the stock most at risk, stock measured before and after each shift and reconciled to the register, tills closed out by a manager who didn't work them, a monthly margin review, a tip line, and cameras over the registers."
      ]
    },
    {
      "heading": "What the 2026 ACFE figures say",
      "points": [
        "Occupational Fraud 2026: A Report to the Nations covers 2,402 cases. Skimming was 9% of asset misappropriation cases (219 cases) with a median loss of USD 45,000; the middle half of skimming losses ran from USD 10,000 to USD 200,000.",
        "Skimming schemes lasted a median 12 months and cost a median USD 3,800 a month. Small organizations are hit harder: skimming showed up in 17% of cases at organizations with fewer than 100 employees and 6% at larger ones, one of the three biggest gaps by size in the report.",
        "Of the controls the ACFE measured, management review, proactive data monitoring, a code of conduct and surprise audits were linked to the largest cuts in both median loss and duration. Only 44% of the organizations in the study used surprise audits."
      ]
    }
  ],
  "checks": [],
  "ask_rightshold": {
    "start": "https://www.rightshold.com/start?ref=seo",
    "mcp_endpoint": "https://www.rightshold.com/mcp",
    "ask": "Verify the Rightshold ledger my mirror-ledger entries are written to. Each night I seal the day's counted cash and our independent counts (stock used and covers served) there, and I want to confirm the record is intact before my accountant compares it with the POS sales for the month.",
    "mcp_call": {
      "tool": "ledger_verify",
      "arguments": {}
    },
    "also": [
      "Free, no key (MCP toolset=ledger). It recomputes every payload, leaf and block hash, Merkle root, chain link and signature on Rightshold's ledger.",
      "The mirror ledger is a REST API with an API key you hold: POST /v1/mirror-ledgers opens one under a neutral label, and POST /v1/mirror-ledgers/{id}/entries seals an entry. There's no daily-takings entry type, so seal each day's close as a payment entry: invoice_ref set to your own day reference (for example DAY-2026-11-10), amount_cents for the cash counted, plus your own fields such as card_cents, covers, stock_used_cost_cents and counted_by_ref.",
      "GET /v1/mirror-entries/{id} is free and needs no account. Your accountant can line the sealed daily counts up against the POS sales for the same days without your login.",
      "Entries can't be edited or deleted; a correction is a new adjustment or dispute_note entry. Content with names, emails, phone numbers, addresses or tax ids is refused, so use staff and till references, not names."
    ],
    "scope": "Rightshold doesn't connect to any POS, bank or accounting software, count cash or stock, or detect skimming. A mirror entry proves what you sealed and when; it can't show a sale nobody rang up, and the comparison with your sales is a step you or your accountant run. ACFE figures are from Occupational Fraud 2026; the venue case is from a 2003 CPA Journal article. Not legal, audit or accounting advice."
  },
  "sources": [
    {
      "title": "ACFE: Occupational Fraud 2026, A Report to the Nations",
      "url": "https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf"
    },
    {
      "title": "ACFE: The Fraud Tree 2026 (skimming: unrecorded and understated sales)",
      "url": "https://cms.acfe.com/-/media/files/acfe/pdfs/rttn/2026/infographics/the-fraud-tree-2026-fem.pdf"
    },
    {
      "title": "Journal of Accountancy: ...And One for Me (skimming indicators)",
      "url": "https://www.journalofaccountancy.com/issues/2002/jan/andoneforme/"
    },
    {
      "title": "The CPA Journal: Exotic Embezzling, Investigating Off-Book Fraud Schemes (September 2003; archived copy of the http-only original)",
      "url": "https://web.archive.org/web/20260906154141/http://archives.cpajournal.com/2003/0903/dept/d095603.htm"
    }
  ],
  "related": [
    {
      "title": "How to tell if an employee is stealing cash with voids, refunds or no-sales at the register",
      "url": "https://www.rightshold.com/answers/how-to-tell-if-an-employee-is-stealing-cash-with-voids-refunds-or-no-sales-at-the-register"
    },
    {
      "title": "What is sales suppression (zapper) software, and how do you prove your POS sales records weren't altered?",
      "url": "https://www.rightshold.com/answers/what-is-sales-suppression-zapper-software-and-how-do-you-prove-your-pos-sales-records-werent-altered"
    },
    {
      "title": "What is lapping, and how do you catch a bookkeeper moving customer payments between accounts?",
      "url": "https://www.rightshold.com/answers/what-is-lapping-and-how-to-catch-a-bookkeeper-moving-customer-payments-between-accounts-to-hide-theft"
    },
    {
      "title": "How to keep a copy of your business books that your bookkeeper can't edit",
      "url": "https://www.rightshold.com/answers/how-to-keep-a-copy-of-your-business-books-that-your-bookkeeper-cant-edit"
    }
  ],
  "computed_from": "Curated guidance; license verdicts computed from Rightshold's license profiles at render time. Not legal advice.",
  "updated": "2026-11-11"
}