Subscriber Discussion

Employee Theft At Point Of Sale

Avatar
Derek Ward
Mar 16, 2015
Hanwha

I was in CVS today, and as the cashier was ringing up my items, I handed him my credit card and he said he would not take it. He told me he wouldn't take my card due to company policy, and he himself was under watch by surveillance cameras. I asked him if it had anything to do with cashiers taking $5 or so as cash back and people not checking their receipts, and he replied with yes, as well as a number of other factors.

Have you seen or experienced this? If you are in retail, are you mindful of these types of thefts or has it happened to you and, if so, what steps did you take to decrease/stop employee theft in this context?

(1)
SM
Steve Mitchell
Mar 16, 2015

I don't fully understand your situation. Do you mean CVS no longer accepts credit cards, or do you mean the employee said he couldn't handle your card, and I assume you needed to do the card swipe yourself?

Avatar
Derek Ward
Mar 16, 2015
Hanwha

Steve, I had to swipe the card myself due to CVS policy. I'm asking if others have experienced this, along with any feedback from those in retail about employee theft at the point of sale.

(1)
SM
Steve Mitchell
Mar 16, 2015

Derek, I suspect a lot of retailers are instituting policy to discourage an employee from handling the card in order to prevent employee skimming. But most of the focus is on the security of the terminal itself--where compromised card readers are being used to skim the credit card info in plain sight. For example Visa and PCI talk a lot about skimming technology detection in their guidelines but do not explicitly recommend against employees handling cards.

A few years ago there was an explosion of bad-guy skimming technology on the streets--including hand held readers employees can use. While the credit card processors and retailers have responded with many counter measures, they're still most concerned with the safety of the card reader:

This document contains a non-exhaustive list of security guidelines that can help merchants to:

Our customers tend to scrutinize employee behavior based on sales reports (looking for excessive refunds, etc), then review video to spot check employee behavior. I've seen a lot of recommendations that managers make sure employees know they're being watched and their activities scrutinized (like your CVS clerk) to prevent activity like skimming among other employee fraud.

Of course video is also used after the fact to find out when a reader might have been tampered with. I recall a customer not too long ago who was looking for video of the installation of a skimmer on his in-store ATM machine..

Diligence is a key and I think retailers know that. Retailers look at video of their cash registers about 40-50% of the time they look at any video in the store. Obviously this is when the customer interaction happens at many retailers, but it's also where the money is..

(3)
MI
Matt Ion
Mar 16, 2015

I forget sometimes, that the US seems to be significantly behind Canada when it comes to institution "tap" and "chip-and-pin" technologies. Around here, almost everyone now has chip readers, and they simply won't accept a chip-enabled card being swiped. Most stores also have the card reader anchored to the counter on a little swivel stand, placed for the customer to use rather than handing over the card to the cashier.

(2)
U
Undisclosed #1
Mar 17, 2015
IPVMU Certified

I asked him if it had anything to do with cashiers taking $5 or so as cash back and people not checking their receipts...

How does the $5 grift work exactly?

What does the Amount Due Readout show? If the cashier says a different amount than what is shown he'll be gone in less than a day. Does he say the right amount but then count back the change wrong?

My favorite example of pos employee grift was years back when the CT turnpike started accepting tokens as well as cash. It was a buck in cash, or you could by 10 tokens for $7.50. It didn't take long for the toll both workers to figure out they should invest a couple hundred bucks in their own tokens, then substitute the tender, thereby pocketing the difference when someone used cash. Legend has it they were given away by the jingling and bulging of the tokens themselves.

Like a poor man's currency arbitrage.

(1)
Avatar
Derek Ward
Mar 17, 2015
Hanwha

Basically, a cashier would either ring up an extra item or take out some amount of cash back while ringing up items and ask customers if they wanted their receipt. If the customer said no, then they would go ahead and add a dollar or two to the total, and keep the change.

(1)
MH
Matthew Huppatz
Mar 23, 2015

The scam works pretty much like this.

Customer asks to pay their bill by Eftpos/Credit Card. Operator asks if they would like any cash out, customer can say yes or no and the operator will then enter a larger cash out figure into the system, customer will then enter their pin/sign the slip.

Now if the customer notices that the cash out amount is incorrect, then the operator will say sorry it was a mistake and ask if they want to correct it or take the larger cash out. No money stolen, but also not caught and the customer doesn't report to management as they don't want to get the operator in trouble for a silly mistake.

But if the customer doesn't notice, then their till will be up, so to get rid of the money, they get a friend to come buy something small, and then when giving them the change, give them the extra cash out they stole from the other customers. This will then balance their till and to the casual observer look legit and even when viewed on video. Hard to catch but with some intergrated POS & CCTV systems it is a lot easier to find once you know it is happening or do spot checks as part of your loss prevention.

(1)
U
Undisclosed #1
Mar 23, 2015
IPVMU Certified

...ask if they want to correct it or take the larger cash out.

If the customer wants to correct it, wouldn't that necessitate the strident call of "I need a Manager on 3, please!". Especially if they have to open the till without a new transaction.

It doesn't seem like a grift you could get away with long for; it would just take a couple of customers suspecting they were shorted. Many people run their balance right down to the last dollar every week, so you would want to choose wisely your targets.

VL
Vickee Liang
Mar 19, 2015
IPVMU Certified

I have seen a portable credit card swipe machine when I was in Canada's restaurant.

When I pay for the bill, I don't have to give my card to cashier, they will bring the machine to you to swipe.

Also in US, I see Chilli's & Red Robin restaurant has a machine where you can pay for the check on your table. That way your credit card don't leave you & have the chance that it might get copy.

(1)
MI
Matt Ion
Mar 20, 2015

Yeah, the wireless terminals are getting more and more common here. I've seen some WiFi ones, some that use Bluetooth, but I think most now are using a dedicated 3G connection (all encrypted, of course).

New discussion

Ask questions and get answers to your physical security questions from IPVM team members and fellow subscribers.

Newest discussions