How can I tell if an employee is stealing cash at the register by voiding sales, ringing fake refunds or opening the drawer with no sale, and how do I stop it?

What should I check, step by step?

1. Give each employee their own POS login or passcode and stop using shared ones. Square, for example, says its shared team passcode can't track sales, time or activity by team member.

2. Limit who can void a completed sale, issue a refund, apply discounts above a set level, or open the drawer without a sale. Make those actions need a manager's passcode, and don't let one person both ring and approve their own refund.
3. Require refunds to be linked to the original sale, and card sales to be refunded to the same card, not in cash.
4. Each week, run void, refund, discount and comp, and no-sale reports by employee and by hour. Flag anyone at two or three times the team average, refunds just under the approval limit, and clusters near shift change or close.
5. Count each drawer at close and compare it with the POS's expected cash, including paid-ins and paid-outs. Record the variance and who counted. Small variances that keep coming out exactly even after a void or refund are a warning sign too.
6. Make the deposit daily and match the bank deposit to the day's cash sales report. Keep the bank statement coming to you directly.
7. Save each day's sales summary and exception list (voids, refunds, no-sales, paid-outs, variances) outside the POS, somewhere the manager and cashiers can't edit, or seal it to a ledger with no edit route.
8. Check inventory against sales for high-value items. Stock that disappears without a sale, or comes back via a refund nobody can link to a customer, points the same way.
9. If you find a pattern, don't confront anyone on the register data alone. Preserve the reports, camera footage and deposit records, and talk to your accountant or a lawyer about next steps.

How do employees hide cash theft at the register with voids and refunds?

Skimming means taking cash before a sale is recorded: the sale is never rung, or it's rung for less. Cash larceny means taking cash after it's been recorded, so the drawer comes up short unless something covers it. Register disbursement schemes cover it with a false entry, typically a fake refund or a void, so the drawer balances.

• That's why the evidence is in the exceptions. A sale voided after the customer has gone, a cash refund with no receipt or customer details, a refund to a card that wasn't used for the sale, a 100% discount, or a drawer opened with no sale shortly before a cash payment is pocketed.
• Most POS systems record these events with a time and the logged-in user. Square's API, for instance, distinguishes no-sale drawer events, cash tender payments, cash refunds, paid-ins and paid-outs on each drawer shift. The record is only as good as the logins: if staff share a passcode or a manager approves with their code left in the terminal, the who is lost.

How much do skimming and cash register fraud cost small businesses?

In the ACFE's Occupational Fraud 2026: A Report to the Nations, skimming made up 9% of cases with a median loss of $45,000, cash larceny 8% with a median loss of $45,000, and register disbursements 3% with a median loss of $14,000. Organisations with fewer than 100 employees had the highest median loss of any size, $126,000.

• The longer a fraud runs, the more it costs, so the goal of weekly exception reviews is to cut the time to detection, not to catch every dollar on day one.

Why keep a copy of POS sales reports that staff can't edit?

Anyone with a manager or full-access role in the POS can often change settings, edit items and sometimes delete records, and the same person may be the one doing the daily close. Square notes that giving someone full access also makes them an authorised representative of the account.

• Keep the owner role yourself, and keep a daily copy of the sales and exception reports outside the POS. If a day's report later doesn't match what the POS shows for that day, you know something was changed after the fact, and when.