Register disbursement schemes are a form of employee fraud in which a worker runs a bogus transaction through the point-of-sale system to justify pulling cash out of the drawer. The two variants are false refunds and false voids, and both work by producing paperwork that lets the drawer balance at the end of the shift even though cash is missing. That built-in cover is what makes them hard to catch: the register tape looks clean, and the theft hides inside transactions that legitimately move money out of the till.
The Two Mechanisms: False Refunds and False Voids
A false refund is a return for merchandise that was never actually brought back. The employee reuses an old receipt, invents a return for a product that doesn’t exist, or works with an accomplice posing as a customer. The POS treats the transaction as legitimate, authorizes a cash payout, and the employee pockets it. The tell sits on the inventory side. The system records a returned item that never physically arrived, so the shelf count drifts away from what the books say should be there.
A false void targets a sale that actually happened. The employee rings up a real transaction, takes the customer’s cash, and then voids the sale once the customer has walked away. The void makes the tape read as though the sale never occurred, and the cash from the completed sale walks out with the employee. This method thrives in fast-casual restaurants, convenience stores, and busy retail lanes where dozens of transactions happen per hour and no one notices one getting reversed moments after it closed.
Red Flags in the Transaction Data
Start with the ratio of voids and refunds to total sales. Every store has a normal baseline, and you need to know yours. When a particular register, shift, or employee runs consistently above that baseline, look closer. The trend over time matters more than any single snapshot, because fraudsters tend to escalate gradually.
Refunds that cluster just below your management approval threshold are one of the clearest signs of intentional manipulation. If refunds over $150 need a supervisor sign-off and your data shows a suspicious number of returns at $145 or $148, someone is gaming the threshold. Data mining can flag these near-cutoff transactions automatically.
Watch for multiple refunds or voids tied to a single receipt, or a burst of them inside a short window. Legitimate customers don’t return three items on separate transactions within ten minutes. Generic product codes are another tell: when refund transactions consistently use descriptions like “miscellaneous item” or “general merchandise” instead of specific SKUs, the employee is dodging the inventory check that would flag a missing product.
Red Flags in Employee Behavior
An employee who processes a high volume of refunds but isn’t the primary cashier stands out. This usually means someone is logging in under a supervisor’s credentials or has found a workaround. Cross-reference refund activity against scheduled shifts and assigned registers.
Timing tells you a lot. A large cash refund processed immediately after a significant cash sale suggests the employee is using incoming money to mask the outflow. Voids or refunds clustered right before closing or during off-peak hours deserve scrutiny because those windows offer less supervision.
Employees who frequently override system warnings or key in transaction data manually when scanning would work are creating opportunities to manipulate details. Habitual overrides suggest someone working around controls rather than through them. Documentation failures matter too: missing transaction numbers, duplicate receipts, reused customer signatures, or gaps in the system log that line up with a specific employee’s shift.
Internal Controls That Prevent Register Fraud
Separation of duties is the foundation. The person who processes a sale should not be the person who approves the void or refund of that sale. The Office of Justice Programs identifies this separation as a critical element of internal control, and for cash-handling operations the ideal setup divides receiving, depositing, recording, and reconciling across different people so that each person’s output checks the next.1Office of Justice Programs. Internal Controls and Separation of Duties Guide Sheet
Lock down void and refund functions in the POS so they require a unique management override code. Every disbursement should log two sets of credentials: the cashier who initiated it and the supervisor who authorized it. This forces the supervisor to witness the transaction rather than rubber-stamping it from across the store.
Physical controls reinforce system controls. Cash drawers should stay locked, with keys or access codes limited to the assigned cashier. When drawers are shared, accountability evaporates because no one can pin a shortage on a specific person. One drawer, one cashier.
For every refund, require documentation before the register reconciliation can close: the original receipt, a signed customer return form, and the manager’s override slip. Missing any piece should trigger an automatic flag.
Require that non-cash purchases receive non-cash refunds. A credit card sale gets refunded to the original card. A debit transaction goes back to the debit card. This single policy eliminates the most common cash extraction pathway for false refunds, because there is no legitimate reason for cash to leave the drawer on a non-cash return.
Configure the POS to hold any refund that lacks a corresponding inventory scan or item check. The system should force verification that a product is actually being returned before the drawer can open. And restrict user permissions aggressively. Cashiers should not have access to transaction history editing, report generation, or supervisory functions. The more access an employee has beyond immediate operational needs, the more tools they have to cover their tracks.
Surprise Cash Audits
Scheduled audits are predictable. A fraudster who knows the audit schedule simply keeps the drawer clean on audit days. Unannounced counts catch what routine reconciliation misses.
Ask the cashier for their starting cash amount, then count every bill, coin, and cash equivalent while the cashier observes. Document as you count, not after. The real value comes from reconciling by payment method: break the count into cash, checks, and card transactions separately. That separation can expose ghost transactions, such as a cashier using a personal check to cover a cash shortage. Look for any informal “kitty fund” or side cash pool. These pools let employees force-balance a short drawer and should be eliminated on sight.
Check that receipts are sequential and that checks have the payee line filled out. Verify that deposits happen on a regular basis and that deposit amounts match recorded totals. Document any significant discrepancy, discuss it with the cashier and management, and if it suggests intentional fraud, report it to the appropriate authorities.
Exception Reporting and Employee Tips
Manual review can only cover so many transactions. Exception-based reporting software scans every transaction against predefined thresholds and flags the outliers: voids spiking on certain shifts, cash shortages repeating at one register, returns entered without a matching sale, refunds processed after hours or without a customer present, manual discounts one employee enters far more often than anyone else.
The practical advantage is scale. A manager can’t review every transaction across five registers and three shifts. Exception reporting reduces thousands of daily transactions to a handful of flagged events. Over time, these systems firm up what “normal” looks like for each location, making deviations more obvious.
Pair the analytics with an anonymous reporting channel. The Association of Certified Fraud Examiners has found that tips from employees and outsiders account for roughly 43% of all fraud detections, more than internal audit and management review combined. A hotline, web form, or mobile app gives employees who notice something off a safe way to speak up. Technology catching statistical outliers plus people catching behavioral red flags is stronger than either alone.
What to Do After You Discover a Scheme
The moment you suspect register fraud, the priority shifts from prevention to evidence preservation. Secure the evidence before the employee knows they’re under suspicion. Pull and preserve POS transaction logs, surveillance footage, register tapes, and refund documentation. Restrict the suspect’s system access quietly. Notify legal counsel, HR, and loss prevention at the same time so everyone is working from the same playbook. Do not confront the employee until you have consulted counsel, because a premature confrontation gives the fraudster time to destroy records or coordinate with accomplices.
File a police report. Criminal prosecution runs under state theft or embezzlement statutes, and the severity of the charges typically depends on the total amount stolen. Most states escalate from misdemeanor to felony theft once cumulative loss crosses a dollar threshold, which varies by state but commonly falls between $500 and $2,500. The police report also creates the official record you’ll need for insurance recovery or a civil claim.
Courts can order a convicted employee to repay what they stole. In federal cases, restitution reimburses victims for financial losses directly caused by the crime, and a federal restitution order can be enforced for 20 years from the date of judgment plus any time the offender spends incarcerated.2U.S. Department of Justice. Restitution Process State restitution rules vary, but the principle is the same: the court calculates what the employee took and orders repayment, often as a condition of probation. Restitution doesn’t cover your investigation costs or legal fees, and collecting from someone without assets can be slow. Many states also have civil recovery statutes that let businesses demand repayment through a separate civil action, which doesn’t require a criminal conviction and may allow recovery of investigation costs.
Deducting the Loss on Your Taxes
Employee theft from a business is a deductible loss for federal tax purposes. The IRS defines theft as the taking and removal of money or property with intent to deprive the owner, where the taking is illegal under state law and done with criminal intent.3Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses A register disbursement scheme fits squarely within that definition.
You deduct the loss in the tax year you discovered it, not the year the theft occurred. For an employee who has been skimming for two years before getting caught, the entire loss goes on the return for the year of discovery. The deductible amount is generally the adjusted basis of the stolen property, reduced by any insurance reimbursement you receive or expect to receive.4Internal Revenue Service. Publication 547 (2025), Casualties, Disasters, and Thefts
Report the loss on IRS Form 4684, using Section B for business property. Losses on business property are not subject to the $100-per-incident and 10% of adjusted gross income floors that apply to personal casualty losses, so business owners can deduct the full unreimbursed amount.5Internal Revenue Service. Instructions for Form 4684 (2025) From Form 4684 the loss flows to your business return: Schedule C for sole proprietors, Form 1065 for partnerships, or Form 1120 for corporations.
Keep the police report, internal investigation documentation, POS transaction logs showing the fraudulent activity, and records of any insurance claims. If you received partial restitution or an insurance payout, reduce your deduction by that amount. The IRS can disallow the deduction if you can’t document both the theft itself and the amount lost.
Fidelity Bonds and Crime Insurance
Controls reduce the likelihood of theft; insurance protects you when controls fail. A fidelity bond, sometimes called employee dishonesty insurance, reimburses a business for financial losses caused by dishonest employee conduct. For businesses outside the financial sector, the standard product is a commercial crime insurance policy.
These policies typically cover theft of cash, inventory, and other business property by employees. Coverage kicks in after you document the loss and file a claim, and the payout reduces what you’d otherwise absorb out of pocket. If you later claim a tax deduction on the loss, reduce the deduction by whatever the insurance paid.
The application process itself often forces a business to evaluate its controls, because underwriters ask about separation of duties, supervision practices, and background check policies before issuing coverage. Some insurers require specific safeguards as a condition of the policy, which means the bond effectively mandates the same controls that prevent register fraud in the first place.