You suspect a staff member is stealing from the till — what to do (and not do)

Two facts sit in tension here, and a good response respects both. First: if someone is taking cash, every week you wait costs you money. Second: if you're wrong — and owners often are — a public accusation destroys a good employee, your team's trust, and potentially lands you with a legal claim. The steps below are ordered so that you act quickly on the business while staying slow and careful about the person.

The five steps

1. Say nothing — start a written log

   Don't confront, don't hint, don't change how you treat anyone. From today, write down each thing you notice: the date, the shift, who was working, what you saw or what the numbers showed, and the amount if you know it. Specific beats dramatic — "Tue 8th, till 1, void of £12 at 21:14, shop had customers" is evidence-shaped; "I think Dave's at it" is not.

   The log matters for two reasons: patterns only become visible in writing, and if this ever reaches a disciplinary process, a contemporaneous record of why you investigated is exactly what a fair process is built on.

2. Rule out the innocent explanations

   Most till discrepancies aren't theft. Before you go further, honestly check: Is it a training gap — does everyone actually know how to ring voids and refunds properly? Do several people share one drawer (in which case nobody can be responsible for it)? Has the menu, rota or delivery mix changed in a way that would move the numbers? A shop that finds a process problem here has still fixed a leak — money lost to honest mistakes is just as gone.

3. Quietly tighten the process

   None of these accuse anyone, all of them protect you, and each one makes any real pattern easier to see:

   • One person, one drawer per shift wherever possible — accountability needs ownership.
   • A receipt with every sale, as policy — it forces every sale through the till.
   • Manager-only voids and refunds, if your till supports it — and keep the code genuinely private.
   • Blind counts — whoever counts the drawer at close shouldn't see the till's expected total first.
   • Read the logs you already have — voids, refunds, no-sales and discounts by person, monthly. Our guide to the six signals in your existing reports covers exactly what to pull.

4. Gather evidence properly

   If the pattern survives steps 2 and 3, you need evidence that's specific, dated, and fair — patterns and hunches are grounds to investigate, never to act against a person.

   Your existing CCTV is usually your best tool, and using it for theft investigation is generally legitimate provided staff know monitoring is in place — which is what your CCTV signage and staff policies are for. Check yours actually say what you think they say. Be careful with the idea of covert recording (hidden cameras, secretly extending monitoring): UK data-protection rules restrict it to exceptional cases with strict safeguards — take advice before going anywhere near it. And never, ever share footage of an employee outside the people who need to see it — posting a clip to a WhatsApp group or social media is the fastest way to turn the wronged party into you.

5. If the evidence is real, follow a fair process

   Even with a clip that seems undeniable, process is what protects you. Broadly, a fair process means: investigate first; tell the person what they're accused of and show them the evidence; hold a proper disciplinary meeting where they can respond and be accompanied; decide after, not before; and confirm the outcome in writing with a right of appeal. The ACAS Code of Practice is the standard tribunals measure you against — follow it even when you're angry, especially when you're angry. Theft is also a crime, so reporting to the police is your call to make; the employment process and the criminal one are separate tracks.

The do's and don'ts, on one screen

The trap in the middle

Notice the gap between step 3 and step 5: you can be almost sure, and still be unable to act — because "the numbers look wrong on his shifts" isn't something you can fairly put to a person. That's the position most owners get stuck in for months. What gets you out of it is specific, dated, moment-by-moment evidence: this transaction, this time, this is what the till says, this is what actually happened.

That's the part TillGuard automates. It cross-checks the till record against what actually happens at the counter and sends you only the moments that don't line up — each with a short clip, timestamped, tied to the transaction. It flags; it never accuses. Often the clip shows an honest mistake, and you've just saved a good employee from your own suspicion — which is worth as much as catching a real problem. Either way, you walk into any conversation holding facts instead of feelings.