What is a sales suppression device or zapper, is it illegal, and how do tax authorities find deleted or altered register sales? If I run a restaurant or shop, how can I show that my point-of-sale records weren't changed after the fact?

What should I check, step by step?

1. Check your POS settings: who can void, refund, discount, delete or edit a closed ticket, and whether those actions keep a history. Turn on whatever audit or activity log the system offers and give each person their own login.

2. Remove delete-after-close and bulk-delete rights from everyone who doesn't need them, including managers. A tool that lets someone wipe a day's tickets in seconds is the capability these laws target.
3. Export the end-of-day (Z) report and the transaction detail every day, as files, before anyone can touch them. Keep the file, not just a screen view.
4. Hash each day's export (SHA-256) and seal the hash somewhere outside the POS and outside your staff's reach, with the date. If the POS numbers change later, the hash won't match.
5. Compare sources monthly: POS daily totals against card processor settlements, bank deposits and delivery-platform payouts. Tax authorities run the same comparison with third-party data.
6. Watch for gaps: missing ticket numbers, days whose totals fall after closing, cash sales dropping while card sales hold, and voids or deletions clustered after hours.
7. Be careful with anyone who offers to clean up or reduce your reported sales, and with unexplained add-ons, USB devices or remote-access tools on the POS. Possessing or installing one is itself an offense in many states.
8. Keep the daily exports, hashes and reconciliations as long as your tax records; in many states a sales tax audit can reach back three years or longer.

What do state zapper and phantom-ware laws prohibit, and what are the penalties?

Florida section 213.295 defines an automated sales suppression device or zapper as a software program that falsifies the electronic records of electronic cash registers or other point-of-sale systems, including transaction data and transaction reports, and includes the software, any device carrying it, or an internet link to it. Phantom-ware is a hidden programming option in the register that can create a second set of records or eliminate or manipulate transaction records. Transaction data covers items, prices, tax, amount tendered, change, date and time, and receipt or invoice number; a transaction report includes end-of-day or shift tapes and electronic logs of every action on the register.

• Knowingly selling, purchasing, installing, transferring, possessing, using or accessing one is a third-degree felony in Florida. The person is also responsible for all taxes, fees, penalties and interest that result, forfeits all profits from the sale or use, and the device is contraband subject to seizure.
• Other states use similar wording. Texas (Business and Commerce Code chapter 326) makes knowingly selling, purchasing, installing, transferring, using or possessing one a state jail felony. North Carolina (G.S. 14-118.7) makes it a Class H felony with a fine of up to $10,000. Wisconsin's 2023 Act 73 made it a Class D felony from December 8, 2023, unless for a legitimate purpose.
• Coverage isn't uniform: a 50-state chart from a defense practice, reviewed against primary sources in July 2026, counts 33 states with some form of anti-zapper law and notes there's no federal statute. Check your own state's law.

How do tax authorities detect deleted or altered point-of-sale sales records?

India's Income Tax Department said in March 2026 that it had compared restaurants' transaction data with the turnover in their returns using AI-enabled analytics, covering about 1.77 lakh (177,000) restaurants and about 60 terabytes of data from 2019 on. It reported that in many cases bills were deleted or modified after being recorded, and that a survey of 62 restaurants across 46 cities in 22 states on March 8, 2026 found about ₹408 crore of suppressed sales on a preliminary basis. It then asked about 63,000 restaurants to update their returns.

• According to the same report, some billing software let operators record every sale and later delete invoices or change bill values, including bulk deletion in seconds, and one widely used platform stored the data on central servers. The point for any owner: when data sits on a vendor's servers, the history of what was entered and then removed may still exist, and it isn't under your control.
• Other countries build the check into the register. Germany requires electronic cash registers to use a certified technical security device and, from 2025, to be reported to the tax office through its ELSTER portal. Germany's tax offices set July 31, 2025 as the deadline for systems already in use; systems bought from July 1, 2025 must be reported within a month.

How can a small business prove its point-of-sale sales records weren't altered after the fact?

An audit log inside the POS helps, but whoever controls the POS can usually change its settings, and the log lives with the data it describes. An outside record of each day's totals, made at the time, is stronger: it shows what the register said that night.

• The simple version is a daily export plus a hash sealed outside the business: if the export is later altered, re-hashing it won't match the sealed value. It can't prove a sale was rung up in the first place, so pair it with processor and bank reconciliations, which come from third parties.
• If an employee has been deleting or editing tickets, the same daily seals show when the numbers changed and narrow down who had access at the time. The register-side signs (voids, refunds, no-sales) are covered in the related page on cash theft at the register.