Cash Register Manipulation | Till Theft (Case Example)

The owner of an organic supermarket in Zwickau — let’s call him Mr. Colditz — had long suspected one of his long-time employees of embezzling cash from the register. To explain the case in detail, he invited one of our corporate investigators to his home. After a warm welcome, Mr. Colditz reported that the suspected employee had likely been committing property crimes against his business for 2–3 years — only the court-proof evidence was missing. To obtain this proof, he contacted our private detectives (+49 341 6970 4082).

Suspected Method of Operation

The target individual was suspected of logging into the POS system using their own employee ID or that of colleagues and then committing fraud in two main ways:

1. Fictitious bottle returns — fake deposits of returnable containers were entered into the system, and the corresponding cash amounts were removed from the register.
2. Fictitious product returns — supposedly opened food or cosmetics that customers were said to have returned after a mistaken purchase. The “refunds” were also pocketed from the till.

To ensure these manipulations went unnoticed, a receipt was always printed to match the false cash withdrawal. This “withdrawal slip” was then placed in the register along with the day’s takings. Because of this, the client could not immediately detect the fraud. Only after several internal audits and inventory checks did the discrepancies become evident.

After the situation had been reviewed and clearly understood at the client’s home, our detective and Mr. Colditz decided to carry out an immediate observation in the supermarket to witness and document another theft in a legally admissible manner. Several surveillance days might be required.

Surveillance at the Checkout: Transactions Without Customers?

The observation conditions were unusually favorable: a nearby café offered a clear view of the checkout area. Thus, our private investigator did not have to spend hours in a car under harsh weather conditions but could comfortably monitor the register while having coffee and cake — all in service of uncovering a serious case of commercial fraud and embezzlement that could result in up to ten years in prison (§263 StGB, Fraud).

Within 20 minutes of beginning the surveillance, our investigator observed the suspect performing several transactions at the till without any customers present. Less than five minutes later, the same happened again. Outside the suspect’s view, Mr. Colditz and the investigator agreed that the owner would check the transaction data via the store’s computer system. If fraudulent transactions were confirmed, he would signal this to the detective using a prearranged nonverbal cue.

Confrontation and Notarized Acknowledgment of Debt

When the signal came, Mr. Colditz and the investigator confronted the suspect about the observed acts. The detective led the conversation, drawing on his extensive experience in interviews and mediation — skills that often result in the signing of a notarized acknowledgment of debt. Such a document can be tailored in content and typically offers the offender leniency or immunity from prosecution in exchange for a full confession and a commitment to reimburse damages.

The usual pattern unfolded: denial first, then presentation of evidence, followed by the choice — sign the acknowledgment of debt or face criminal and civil proceedings. In most cases, reason prevails. The employee eventually confessed to regularly stealing between €50 and €150 per week over several years. To conceal the thefts, he had fabricated product and bottle return receipts and placed them in the cash drawer for reconciliation.

Damage Assessment and Contract Termination

After the confession, the three men spent several hours reviewing the past incidents. The total loss was estimated at €10,000, a figure that our investigator considered rather lenient. In the end, both parties agreed to an immediate termination of the employment contract, and the employee was banned from the premises for at least one year.

Note

To protect the privacy and personal rights of both clients and suspects, all names and locations in this case report have been altered beyond recognition.