At close on a Tuesday the drawer counts to the penny. The cashier pulls the tape, the manager signs the sheet, the deposit goes in the safe, and the shift ends the way a good shift is supposed to end. It happens again the next night, and the night after that. Nothing in the paperwork is ever wrong.
Then the quarterly count comes back and the store is down more than it should be, in categories people buy with cash. Nobody can point at a night. Nobody can point at a shift. Every drawer that quarter balanced.
This is the part of cash loss operators find hardest to accept. A drawer that balances is not evidence that nothing was taken. It is evidence that the register agrees with itself.
Reconciliation checks the register against the register
Counting a drawer compares two numbers: the cash you counted, and the sales the register recorded. Both come from the same source. The register only knows about money it was told about.
Consider the simplest theft in a store. A customer buys a $6.50 energy drink and pays cash. The cashier takes the money, hands over the drink, and never rings the sale. The cash goes in a pocket instead of the drawer. At close, the drawer holds exactly what the register expected, because the register was never told about that $6.50. The count is perfect. The inventory is short one energy drink, and nobody will learn that for months.
Forensic accountants have a precise name for this. The Association of Certified Fraud Examiners calls it skimming, and defines it as an incoming payment stolen "before it is recorded on the organization's books". That is the whole problem in eight words. Skimming creates no discrepancy, because it removes the sale and the cash at the same moment, in equal amounts, from both sides of the comparison.
The other kind of cash theft does create one. Money taken from a drawer after the sale was rung leaves the count short, and the shift sheet shows it. Fraud examiners call that cash larceny, and a store's existing process genuinely does catch it. Which means the version of cash theft your controls are built for is the easier one to see, and not the more common one in a store.
What this looks like in retail specifically
The ACFE published its 2026 edition of Occupational Fraud: A Report to the Nations on May 12 of this year, built from 2,402 cases investigated by certified fraud examiners across 143 countries. One hundred and ten of those cases had a retailer as the victim, and the report breaks that group down by scheme.
In retail cases, skimming appeared in 20 percent. Theft of cash on hand appeared in 15 percent. Register disbursements, meaning false voids and false refunds, appeared in 11 percent. Cash larceny appeared in 10 percent. The percentages add to more than 100 across all categories because one case can involve several schemes at once.
The comparison that makes the point is technology companies, where skimming appeared in 1 percent of cases and register disbursements in none at all. There is nothing about retail employees that makes them different. There is something about a counter with a drawer on it and a stranger paying cash.
Two caveats come from the report itself. The industry breakdown reflects the cases fraud examiners happened to submit, not a measure of how common fraud is in one industry versus another. And the median retail case cost $59,000, among the three lowest of any industry. That is not reassurance. A retail cash scheme tends to be small enough per incident that nobody escalates it, which is the condition it needs to keep running.
The duration data says the same thing from another angle. The median scheme in the study ran twelve months before detection, and skimming ran the same twelve. The report also calculates velocity, the loss added for each month a scheme goes unnoticed: $3,800 a month for skimming, $2,200 for theft of cash on hand. Nothing about the act changes over twelve months. Only the total does.
Cash has not left the counter
It is fair to ask whether this still matters where most people tap a card. The Federal Reserve runs an annual diary of how Americans actually pay, and its 2026 findings put cash at 14 percent of payments, with four out of five consumers using it in the previous 30 days. The distribution matters more than the average: rural residents made about nine cash payments a month against six for urban and suburban ones, adults 55 and older averaged ten, and households earning under $25,000 averaged seven. Those groups are not spread evenly across American retail. They concentrate in the kind of store this is written for, and those stores rarely have a loss prevention department.
The second record is the whole answer
You cannot audit a sale that was never created by looking harder at the system that never recorded it. No report, however well designed, can surface a transaction that does not exist. The only way to see skimming is to hold an independent record of the same seconds, made by something other than the register.
In practice that means being able to ask three questions of any window of time. Did a customer stand at the counter, take goods, and leave during a stretch when no transaction was rung? Does the pattern of drawer opens without a sale follow one person across shifts, or does it follow the lane, or the hour? Do the safe drops, the counts, and the deposit agree with who was actually scheduled to be in the building?
That last one matters because the safe is a second place where paperwork can be internally consistent and still wrong. NACS Magazine collected what operators had caught in their own stores. A cashier who said she had exchanged five twenties for a hundred and handed over five ones. An employee who claimed to be filling the ATM and kept the money, more than $20,000 before anyone noticed. That second one never touched a register. The people involved were usually not new hires but long tenured and trusted, which is what buys the alone shift and the benefit of the doubt.
Joining those records is what we build, and it runs on the cameras and registers a store already owns: CASH crossed with POS crossed with CAM crossed with LABOR, continuously. An event gets filed as a record carrying a time, a drawer, an operator, a basket, and a location, so a question that used to take an afternoon of scrubbing video takes seconds instead.
We would rather be careful about what that does and does not do. It does not identify anyone and it does not conclude that a person stole money. It surfaces that a pattern has appeared eleven times, mostly on one operator's shifts, and puts the records beside it so a person can decide. A good share of the time the answer is not theft. It is a drawer left open through a rush because that is how somebody was trained, or a drop procedure nobody has followed since the last manager left. Those are cheaper problems, and worth finding early too.
If your drawers balance and your inventory still does not, we would be glad to compare notes. Argus is in private beta with convenience, gas station, and grocery operators. You can talk to us, or write to support@useargus.co.