Till fraud: the six patterns worth watching

Most till fraud in hospitality is small. Nobody empties the safe. Instead, a drink is poured and never rung in, a bill is voided after the guest has paid in cash, a friend is charged half price, a refund goes to a card that was never used for a meal. Each one is a few pounds. Over a year, they can add up to more than a member of staff's wages.

The good news is that almost every kind of till fraud leaves a pattern. A single void tells you nothing, but the same kind of void, by the same person, at the same time of night, week after week, tells you a great deal. A manager who knows the six common patterns, and reads the right reports, can usually spot a problem early, and often prevent it.

This guide covers the six patterns of till fraud worth watching, how each one shows up in the reports, the controls that make each harder, and how to respond fairly when a pattern appears. Every venue and figure in it is an example.

Till fraud is usually small because large frauds are easy to notice. A missing day's takings is found at once; a few pounds a night, hidden among hundreds of honest transactions, can go unnoticed for months. The people who commit it are often trusted, long-serving staff who started with one small shortcut and found it was never noticed.

That is why the patterns matter more than any single event. One void after payment may be an honest mistake. Twenty, by one person, are a pattern.

It also means prevention matters more than detection. Clear rules, individual logins and a manager who reads the reports make most till fraud too risky to start.

Before any pattern can be seen, every action on the till must be recorded against the person who took it. That audit trail depends on individual logins: every member of staff signs in as themselves, every time. With a shared login, every void and discount is anonymous, and no pattern can be traced.

Our guide to staff logins: one till, eleven people covers why each person needs their own. Without that foundation, the rest of this guide is guesswork.

The first pattern is the void after payment. A guest pays in cash; the server voids part or all of the bill and keeps the difference. The till shows a smaller sale; the drawer matches the till; the money has gone.

In the reports, it shows as voids made after a bill was printed or paid, often on cash payments, often near the end of a shift and often concentrated on one member of staff.

The control is simple: voids after a bill is printed or paid should need a manager, and some tills refuse them altogether once a payment is recorded. Review every void after payment at close.

The second pattern is the drawer opened without a sale. A cash drawer that opens for no recorded reason may be giving change, or it may be taking money for an unrecorded sale: a drink poured, cash taken, nothing rung in.

In the reports, drawer opens with no sale show as a count by member of staff and by time. A few each shift is normal; many, clustered at busy times, is a pattern.

The control is to record every drawer open, keep the count visible and ask about unusual numbers. Our guide to POS reports a manager should read daily covers the nightly reports.

The third pattern is discount abuse: friends who always pay half price, regulars of one server who always get ten per cent off, discounts with no reason or the same vague reason every time.

In the reports, it shows as discounts concentrated on one member of staff, on the same guests or on the same times. It often looks generous rather than dishonest, which is why it continues.

The control is clear rules on who can give which discount, with a reason recorded every time and a weekly review. Our guide to discounts at the till: who, what and how much sets out the rules.

The fourth pattern is the refund to a card that was never used for a meal, or a refund of a real payment that the guest never asked for. It is rarer than the others, but each one can be larger.

In the reports, it shows as refunds made by one person, refunds to cards that do not match any recent payment, or refunds at times when no guest was present.

The control is that refunds always need a manager, with a reason, and that every refund is reviewed. Refunds should be the rarest action on the till.

The fifth pattern is the comp used as a gift: free drinks for friends, free desserts for regulars, whole meals comped for people the server knows. Like the friendly discount, it feels generous, and it is often the start of something larger.

In the reports, it shows as comps concentrated on one person, on the same guests or with vague reasons. A bartender whose comps are three times the others' deserves a quiet question.

The control is a clear list of what can be comped and by whom, with a reason, reviewed weekly.

The sixth pattern is the hardest to see, because it leaves nothing on the till: a drink poured and sold for cash without being rung in. The till is honest; the stock is not.

It shows up only when stock is compared with sales. If the bar's stock of spirits falls faster than the till's sales of spirits explain, something is being poured and not recorded. Our guide to spot checks: twenty lines, ten minutes, every week covers how to compare stock and sales.

The control is regular stock counts, a till that makes ringing in quick, and a rule that nothing leaves the bar without being rung in.

The six patterns have variations. One is the ghost table: a check opened for a table that does not exist, used to ring in drinks that are paid for in cash and then voided. It shows as checks with no booking and no covers, opened and closed quickly near the bar.

Another is under-ringing: ringing in a cheaper item than the one served, such as the house wine instead of a better bottle, and keeping the difference. It shows when stock of the better wine falls faster than its sales.

A quieter pattern is switching payment methods: recording a card payment as cash, or the other way round, so the drawer and the card terminal no longer match the till in ways that can hide money.

It shows in the payments reconciliation: card takings on the till that do not match the card terminal's total, or cash that is consistently short against the till on certain shifts. Reconcile both every shift, and the pattern has nowhere to hide.

Not every loss is fraud. Shrinkage, the gap between what you should have and what you do, comes from many sources: waste, spillage, over-pouring, breakages, mistakes in counting and mistakes on the till. Theft is only one of them, and often not the largest.

Before concluding that a gap is fraud, look at the other causes. A bar losing stock may be over-pouring, not stealing; a kitchen losing food may be wasting it. Our guide to liquor inventory: counting to the tenth of a bottle covers counting the bar accurately.

A few controls prevent most till fraud. Individual logins, so every action has a name. Clear permissions, so the actions that move money after a sale need a manager. Reasons for every void, comp and discount. Regular stock counts. And a manager who reads the reports, and is seen to read them.

The last one matters most. Most people who might be tempted are deterred simply by knowing that someone looks. Our guide to POS permissions: who can void, who cannot covers setting the permissions.

The wider idea is internal control: routine checks built into the way the business runs, so mistakes and misuse are caught as part of normal work rather than by investigation.

Staff discounts are another route for small losses: a staff rate given to friends or family who are not entitled to it, or staff meals rung in for people who are not working.

It shows as staff discounts on checks that look like guests' checks, at times when the staff member was serving, or as staff meals far above the number of staff on shift. Clear rules on who qualifies, and a weekly look at the staff discounts, stop most of it.

Many patterns show in their timing. Voids and comps that cluster in the last hour of a shift, after the manager has gone home, or on the nights a particular person closes, tell a story that a total for the week hides.

Read the reports by hour and by shift as well as by person. A pattern that appears only when one person is in charge, and disappears when they are not, is worth a careful conversation.

Read the voids, comps, discounts and refunds by member of staff every night at close, and look at the week as a whole every Monday. Look for the patterns above: actions after payment, actions clustered at certain times, actions concentrated on one person or on the same guests.

Compare each person with their colleagues on similar shifts, not with an absolute number. A bartender on the busiest shift will have more voids than one on a quiet lunch; what matters is whether their rate is unusual for the work they do.

Most till fraud involves cash, because cash leaves no record outside the till. A venue that takes mostly card payments has fewer opportunities for fraud, but the cash it does take deserves closer attention.

Count the drawer at the end of every shift, with two people where possible, and compare it with the till's cash total. Record every difference, however small. A regular shortfall on one person's shifts is a question worth asking.

When a pattern appears, respond carefully. Look at the evidence over several weeks, not one night. Consider innocent explanations: a new member of staff learning the till, a difficult dish that is often sent back, a section with many regulars. Talk to the person privately, with the figures in front of you, and listen to their answer.

Many patterns turn out to be training problems or misunderstandings, which are easily fixed. Where they are not, follow your employment policies and take advice before acting.

Good controls protect honest staff as much as they catch dishonest ones. When every action is recorded against a name, a shortfall cannot be blamed on everyone. Staff whose records are clean have evidence to show it.

Explain this to the team. Controls are not a judgement on anyone; they are how a business with money moving through many hands keeps everyone safe, including the people who handle it.

Controls deter most when people know they exist. Tell the team that voids, comps and discounts are read every night, that stock is counted every week and that the reports are compared. Do it as part of training, not as a threat.

People who know the reports are read rarely start. The few who do are caught early, before a small habit becomes a large loss.

Talking about till fraud openly, as part of how the venue runs, helps honest staff as much as it deters dishonest ones. Explain that the controls protect everyone, that every member of staff's record is their own and that a clean record is the best protection against suspicion.

Invite staff to raise concerns privately if they see something wrong. In many cases, colleagues notice a pattern long before the reports do.

Sometimes a pattern is serious enough to need outside help: a large loss, evidence of organised theft or a situation where the manager is involved. Take advice from your accountant, your HR adviser or a solicitor before acting, and keep the evidence safe.

Do not confront anyone without evidence, and do not make accusations in front of the team. A fair process protects the business as well as the person.

The cost of ignoring till fraud is rarely one large loss. It is a slow leak that continues for months, a culture in which small shortcuts become normal, and honest staff who feel the business does not care.

Compare that cost with the effort of the controls: individual logins, a short list of rules, ten minutes on the reports each night and a weekly stock count. For most venues, the controls cost far less than the leak they stop.

In bars, open tabs are another place for losses to hide. A tab left open at the end of the night may be a guest who walked out, a tab paid in cash that was never closed on the till or drinks given away under the cover of a tab.

Close or explain every open tab before the bar closes. A pattern of tabs left open, or closed the next day with cash, on one person's shifts deserves a quiet question.

Gift cards and vouchers can be misused too: a voucher redeemed that the guest never had, a gift card balance used up by someone other than its owner, or the same voucher number used twice.

Record every voucher redeemed, with its number, and check the numbers against those you issued. Most voucher problems are simple mistakes, but the record is what lets you tell.

New staff are sometimes drawn into small frauds by colleagues who have been doing them for a while: a friend's drink not rung in, a discount for a regular "everyone gives". A new starter who refuses can feel they are breaking the team's rules.

Make the rules clear from the first day, and make it easy for new staff to raise a concern privately. The best protection for a new starter is knowing exactly what is allowed.

An invented bar notices that its spirits stock falls faster than its sales. The manager starts reading voids, comps and drawer opens by member of staff every night. One bartender's voids after payment are far higher than anyone else's, almost all on cash payments near closing time.

The manager compares several weeks of reports, rules out the obvious explanations and talks to the bartender privately with the figures. The bartender's explanation does not fit the evidence. The bar takes advice, follows its procedures and the bartender leaves. The bar also changes its rules: voids after payment now need a manager, and the drawer is counted by two people at every close.

Over the next quarter, the gap between stock and sales closes to the level explained by normal waste.

In servearound, every member of staff signs in on the till with their own name and PIN, so each order, void and comp is recorded against the person who took it, and a voided line stays on the check, struck through, with its reason, rather than disappearing. Once any payment has been recorded against a check, the till will not void or comp it, and each void and comp raises a notification for the team.

Payment analytics show voids and comps by member of staff, and order analytics show the void and comp rates and the value voided and comped, while the network's transactions list every bill with who took it. servearound does not connect to cash drawers, has no discount button and does not issue refunds, so drawer opens and refunds are watched in your card terminal's and drawer's own records. See Analytics and Order Fulfillment.

Taking money or stock through the till: voids after payment, unrecorded sales, friendly discounts, refunds and comps used as gifts.

No. It is usually small and repeated, which is why patterns matter more than single events.

Voids after payment, drawer opens with no sale, friendly discounts, quiet refunds, comps that never end and sales never rung in.

Read voids, comps, discounts, refunds and drawer opens by member of staff, and compare stock with sales.

No. Waste, over-pouring, breakages and counting mistakes cause shrinkage too.

Individual logins, clear permissions, reasons for every action, stock counts and a manager who reads the reports.

Look at weeks of evidence, consider innocent explanations, talk privately and follow your procedures.

Explained well, they protect honest staff by making clear who did what.

Till fraud is usually small and repeated, and it leaves patterns. Watch for six: voids after payment, drawer opens with no sale, friendly discounts, quiet refunds, comps that never end and sales never rung in. Each shows in the reports, or in the gap between stock and sales, if every action is recorded against a name.

Build an audit trail with individual logins, require a manager for actions that move money after a sale, record reasons, count stock and cash, read the reports by member of staff, separate fraud from ordinary shrinkage, and respond to any pattern with evidence and a fair process.