Investigative Tactics and Strategies

Field techniques and tests for detecting internal retail theft, including double buys, combination buys, and refund buys

Defensive Techniques to Minimize and Identify Burglary and Property Losses

Tactics and Strategies

A highly skilled investigator possesses two fundamental traits: first, the investigator knows the territory to which he or she is assigned, its personalities, its geographic location, its layout, and its overall operation; and second, the investigator is able to apply theory in practical situations. Thus, a private security investigator enlisted by a retail establishment to determine how goods are being pilfered should have a comprehensive understanding of the establishment. Prospective suspects will be numerous; before proceeding on wild goose chases or professional conjecture, become familiar with the assigned area. As always, use common sense when formulating an investigative strategy and practices.

1. Site Security Surveys and Their Application

By evaluating the physical and procedural weaknesses of business establishments and then making recommendations on corrective action, the security survey makes a remarkable contribution to crime deterrence. Police departments, private security companies, and other consultants all engage in survey design and analysis. Upon completion of a field survey, a permanent record should be kept on file.

2. Determining Organizational Characteristics

Investigators, especially those working in institutional settings, should have a feel for the organizational and administrative makeup of their clients. Companies that are loosely organized and have administrative problems will be more likely to have serious problems with internal theft and pilferage. The National Institute of Justice urges:

"[T]he control of employee taking of property seems to be a problem that the business organization must keep visible on its list of priorities and objectives. It cannot be ignored or relegated to a topic of temporary or minimal importance, nor should it be assigned as a task for a specialized portion of the organization's management team. This research suggests that only by exhibiting a conspicuous and consistent climate of concern about the control of internal theft at all occupational levels can an organization hope to have a significant effect on the behavior of its employees."- U.S. Department of Justice, National Institute of Justice, Theft by Employees in Work Organizations (1983), 2.

The entire corporate or institutional environment influences an investigator's judgment. To perform the job properly, the investigator must know how management operates, how it intends to pursue parties who are apprehended, and how it oversees the scheme of things. Companies that treat their employees poorly, that provide little or no feedback on performance, and that do not restrict or restrain conduct or behavior risk far greater losses due to employee misconduct. In essence, a lack of control results in an almost chaotic environment. As a rule of thumb, if employees feel the scrutiny of management, that there are repercussions to illegal and immoral conduct, and that the company has invested significant time and energy in ensuring the protection of its assets, it is less likely that criminal conduct will occur. There are many factors that enhance the potentiality for criminal conduct, especially internal theft, fraud, and embezzlement within the business entity, including:

  • Inadequate pay, benefits, job security, and promotional opportunities
  • Ambiguity in job roles, relationships, responsibilities, and areas of accountability
  • Lack of recognition for good work, loyalty, longevity, and effort
  • Lack of periodic audits and inspections
  • Ambiguous corporate social values and ethical norms
  • Tolerance or indifference toward antisocial behavior
  • Bias or unfairness in selection, promotion, compensation, or appraisal
  • Inadequate training on security matters and company policies with respect to sanctions for security breaches
  • Failure to screen applicants thoroughly for sensitive positions before appointment
  • General job-related stress or anxiety

-J. Bologna, Corporate Fraud: The Basics of Prevention and Detection (Butterworth-Heinemann, 1984), 98-99.

The company that invests resources in the detection and prevention of criminality will most likely be rewarded with lower internal theft rates.

3. Theft Tests

Testing for internal and external shoplifting and pilferage falls into two major categories: honesty and service tests. When conducting an honesty test, the investigator determines whether employees are stealing cash during customer purchase transactions. In service testing, the investigator reports to management how he or she was treated during a specific transaction while observations were made.

Web Exercise: Visit the web page for Jack Hayes International, a firm that specializes in assisting business with inventory shrinkage and retail theft controls at:

a. Honesty Testing

To detect theft, deception, fraud, pilferage, or other illegal conduct on the part of employees, investigators conduct honesty testing. In this type of test, the investigator simultaneously buys two of the same items. Prices can be the same or different. The investigator notes the register reading for the previous sale. The investigator then selects two of the same items and pays the employee the exact amount for the entire purchase. The investigator should then observe whether the cash register drawer was opened or closed before, after, or at the time of the purchase.

Also on Security at the Point of Sale

In addition, the investigator should check whether the employee issued a receipt. The investigator should formally document these facts, the subsequent items purchased, and their related costs. Other notations worthy of mention:

  • Was the purchase wrapped or was payment received from the investigator?
  • Did the clerk call back the amount of the purchase or the amount of money tendered?
  • Was the correct change given?
  • Was the amount of the sale correctly recorded on the register?

Troubling or suspicious conduct should be reflected in the report.

J. Kirk Barefoot comments on arranging this type of testing:

"It is normally up to the agency supervisor or the retail security manager to make arrangements with the crew chief for storing the purchases while the target stores are being shopped. Ultimately, all merchandise is normally returned to the company for full credit, and this is usually handled through a high-ranking member of the store accounting staff. In this way, the rank-and-file sales personnel do not become aware that the merchandise has been returned for credit. "-J. Kirk Barefoot, Undercover Investigation, 3rd ed. (Butterworth-Heinemann, 1995), 117.

(1) The Combination Buy

In a combination buy, the investigator buys two or more different items at the same time and pays the employee the exact amount for the entire purchase. Observe and record whether the employee rings up all, part, or none of the transaction. The investigator records whether a receipt was received for the purchase. In a follow-up report, the investigator inserts findings regarding the exact time of the purchase and the reading on the register before the clerk rang up the transaction. (This is helpful if the employee fails to give you a receipt.) By knowing the amount on the register prior to your purchase, it will be easy to check the sale for which no receipt was received.

(2) The Double Buy

In effecting a double buy, the investigator buys one or more items. The transaction should result in paying an uneven amount of money, larger than the price of the goods in total, resulting in change. Because an overage of funds exists, the cash register tabulates the difference, and a receipt is remitted to the investigator. In this scenario, the investigator receives a receipt to identify either the cash register used or reference to its employee operator. This serves the first purpose of the double-buy process, namely, identification.

The second phase of the double-buy investigation tests the honesty of the employee. After the employee has returned change, the investigator purchases an additional item. In buying the second item, the exact purchase price should be paid. The investigator should request that the employee put the second purchase in the same bag used for the first purchase. (The employee may even suggest this.) The investigator should be alert at this point to record whether a second receipt is received.

Pinkerton's, Inc., relates other sensible information regarding the double-buy process:

"Use common sense when making a double buy. It would not be normal, for example, to spend 39 cents on the first buy and ten dollars on your second buy. & Plan your approach and articles to be purchased prior to making your first buy. In this way you can control the type of goods in the first part so the bag will be large enough to hold the goods bought on the second part. & In picking items for your second buy in a double buy, try to locate goods as far away as possible from the register. & It is also possible to wear out or take out an unwrapped item which you have purchased on the second part of a double-buy test. This could be the case when buying at a jewelry department. "- Pinkerton's, Inc., Investigations Department Training Manual (1990), 165.

As one final caution, in a double-buy test, the second purchase must occur immediately after the first purchase so that the factual chain and monetary sequence are not interrupted by other purchasers. The investigator should not act in a contrived or awkward manner; he or she should appear completely disinterested and aloof. Upon the second buy, the investigator should immediately leave the retail area without waiting for a receipt (but if the employee harkens you to accept it, do so).

(3) The Exchange Buy

When customers have difficulty in choosing between multiple products, dishonest employees succumb to temptation. In the exchange buy, the investigator has two or more items to consider. In the investigator's original decision, the choice is to purchase the less costly item. The investigator then pays the employee with an uneven amount of money. Upon receipt of change, package, and sales receipt, the investigator, acting as a bewildered customer, changes heart and decides to take the higher-priced item. The purchaser (investigator) then must pay the difference between the lower-priced item and the higher-priced item. At this juncture, the investigator should watch carefully to see whether the employee records, registers, or makes notation of the difference between the two prices or simply pockets the difference.

(4) The Refund Buy

Investigators who perform the refund test return an item to the selling department. After receipt of the cash or credit refund, the money is then used to make an even money purchase. The objective of the refund buy is to test the store's system by attempting to get a refund without a receipt. If the employee will not grant the refund without the receipt, the investigator can then "discover" the receipt and complete the transaction.

b. Service Testing

In service testing, the scrutinized employee is assessed on diverse issues:

  • Approach
  • Suggested purchase
  • Appearance
  • Service effect
  • Courtesy
  • Product knowledge
  • Salesmanship
  • Closing of the sale

Service testing should take the following questions into account:

  • How much of a product was purchased?
  • What is the description of the merchandise?
  • What is the price of the merchandise?
  • What is the tax or other special assessment on the merchandise?
  • What was the total amount paid?
  • What money denominations were used as payment?
  • Was the money handled at the register in compliance with the store's system?
  • Was a receipt issued and what were its contents?
  • Did the clerk charge the correct price and give the correct change?
  • Was the clerk busy? Orderly? Clean?
  • How did the employee act? Careless? Complaining? Professional?

Testing an employee's service level is a circumstantial tool for management, targeting employees who are weak in customer service or who are disgruntled, difficult, and likely to cause problems for the business enterprise.

Excerpted from Private Security and the Investigative Process, Third Edition

by Charles P. Nemeth (CRC press, 2010).

Copyright © 2010 IDG Communications, Inc.

7 hot cybersecurity trends (and 2 going cold)