Register disbursement schemes are a form of employee fraud in which a worker runs a fake refund or void at the point-of-sale terminal to justify pulling cash out of the drawer. Because the phony transaction prints on the register tape, the drawer still balances at the end of the shift, which is what makes the scheme so hard to spot. The Association of Certified Fraud Examiners has found that the median occupational fraud runs 12 months before anyone notices, and register disbursements often outlast that average because the paper trail looks clean on first inspection.
The Two Mechanics: False Refunds and False Voids
Every register disbursement scheme exploits one of two legitimate reasons cash leaves the drawer.
False Refunds
A false refund is a return for merchandise that was never actually brought back. The employee may reuse an old receipt, fabricate a return for a product that doesn’t exist, or work with an accomplice posing as a customer. The POS treats the transaction as legitimate, authorizes a cash payout, and the employee pockets it.
Inventory is where this scheme leaves its first fingerprint. The system records a returned item that never physically arrived, so the shelf count stops matching what the books say should be there. Auditors learn to watch that gap.
False Voids
A false void targets a sale that really happened. The employee rings up the customer, accepts the cash, hands over the goods, and then voids the sale after the customer leaves. The void makes the tape balance as if the sale never occurred, and the cash from the real sale walks out with the employee.
This method thrives in high-volume settings. Fast-casual restaurants, convenience stores, and busy checkout lanes are prime targets because the pace of transactions provides cover for a reversal nobody is watching.
Red Flags in the Transaction Data
The numbers tell you something is wrong before anyone can name a suspect.
Start with the ratio of voids and refunds to total sales. Every store has a baseline, and you need to know yours. When a particular register, shift, or employee runs consistently above that baseline, look closer. Track the metric over time rather than relying on snapshots, because fraudsters tend to escalate gradually.
Refunds that cluster just below the manager-approval threshold are one of the clearest signs of intentional manipulation. If supervisor sign-off kicks in at $150 and your data shows a suspicious number of returns at $145 or $148, someone is gaming the limit. Data mining can flag these near-threshold transactions automatically.
Watch for multiple refunds or voids tied to a single receipt number, or a burst of them processed inside a short window. Real customers don’t return three items on separate transactions in ten minutes. That clustering points to someone maximizing a single session.
Generic product codes are another tell. When refund entries lean on descriptions like “miscellaneous item” or “general merchandise” rather than specific SKUs, the employee is dodging the inventory system’s ability to flag a missing product. Legitimate returns involve identifiable merchandise.
Red Flags in Employee Behavior
An employee who processes a high volume of refunds without being the primary cashier stands out. That usually means someone is logging in under a supervisor’s credentials or has found a workaround to reach functions they shouldn’t have. Cross-reference refund activity against scheduled shifts and assigned registers.
Time-of-day patterns matter. A large cash refund processed right after a significant cash sale suggests the employee is using incoming funds to mask the outflow. Voids and refunds clustered during off-peak hours or just before closing deserve extra scrutiny, because those windows offer less supervision.
Employees who routinely override system warnings or key in transaction data manually when scanning would work are building themselves room to manipulate details. Manual entry bypasses the automated checks the POS was designed to enforce.
Check the documentation itself. Missing transaction numbers, duplicate receipt numbers, reused customer signatures, or gaps in the system log that line up with one person’s shift all point to a breakdown in the transaction record. The paperwork failure almost always travels with the cash theft.
Controls That Prevent Register Fraud
Prevention beats detection. The controls below work by making it structurally hard for one person to run a fraudulent disbursement from start to finish.
Separation of duties is the foundation. Whoever processes a sale should not be the same person who can approve the void or refund of that sale. When two people must be involved in every disbursement, a fraudster can’t close the loop alone. The Office of Justice Programs identifies this separation as a critical element of internal control for cash-handling operations.1Office of Justice Programs. Internal Controls and Separation of Duties Guide Sheet
Lock down void and refund functions inside the POS so they require a unique management override code. Every disbursement should log two sets of credentials: the cashier who initiated it and the supervisor who authorized it. This forces supervisors to physically witness the transaction rather than rubber-stamp it from across the store.
Physical controls back up system controls. Cash drawers should stay locked, with access limited to the assigned cashier. One drawer, one cashier. When drawers are shared, accountability evaporates because nobody can pin a shortage on a specific person.
For every refund, require full documentation before the shift reconciliation can close: the original receipt, a signed customer return form, and the manager’s override slip. Missing any piece should flag automatically. That paper trail creates multiple catch points for a fabricated refund.
Require that non-cash purchases receive non-cash refunds. A credit card sale gets refunded to the original card. A debit transaction goes back to the debit card. This one policy eliminates the most common cash extraction pathway for false refunds, because there is no legitimate reason for cash to leave the drawer on a non-cash return.
Configure the POS to hold any refund that lacks a corresponding inventory scan. The system should force verification that a product is actually being returned before the drawer opens. That blocks the most basic form of false refund, where an employee simply keys in a fictitious return with nothing in hand.
Restrict user permissions aggressively. Cashiers should not have access to transaction history editing, report generation, or supervisory functions. The more tools someone has beyond their operational needs, the more ways they have to cover tracks.
Surprise Cash Audits
Scheduled audits are predictable, and a fraudster who knows the schedule keeps the drawer clean on audit day. Unannounced counts catch what routine reconciliation misses.
When you arrive, ask the cashier for their starting cash figure, then count every bill, coin, and cash equivalent while the cashier observes. Document on a reconciliation form as you count, not after.
The real value of a surprise count comes from reconciling by payment method. Breaking the count into cash, checks, and card transactions separately can expose ghost activity, such as a cashier using a personal check to cover a cash shortage. Hunt for any informal “kitty fund” or side cash pool. Those pools let employees force-balance a short drawer and should be eliminated on sight.
Verify that receipts are sequential, that checks have the payee line filled out, and that deposits are being made on schedule with amounts matching recorded totals. Document any significant discrepancy, discuss it with the cashier and management, and if the pattern suggests intentional fraud, report it to the appropriate authorities.
Exception Reporting and Employee Tips
Manual review can only cover so many transactions. Exception-based reporting software scans every transaction against predefined thresholds and surfaces the outliers.
These systems pull from data the POS already collects and highlight patterns a human auditor would need weeks to find: voids that spike during certain shifts, cash drawer shortages that repeat at one register, returns entered without a matching sale, refunds processed after hours or without a customer present, and manual discounts that one employee enters far more often than anyone else. The practical advantage is scale. A manager cannot review every transaction across five registers and three shifts, but exception reporting reduces thousands of daily transactions to a handful of flagged events. Over time, these systems also establish what “normal” looks like at each location, so deviations grow more obvious as the baseline firms up.
One finding from the Association of Certified Fraud Examiners is worth building policy around: tips from employees and outsiders account for roughly 43% of all fraud detections, more than internal audit and management review combined. Pair your analytics with an anonymous reporting channel, whether a hotline, a web form, or a mobile app. Technology catches statistical outliers; people catch behavioral ones.
What to Do When You Discover a Scheme
The moment you suspect register fraud, the priority shifts from prevention to evidence preservation. How you handle the next 48 hours determines whether you can recover losses, pursue prosecution, or terminate the employee without legal exposure.
Secure the evidence before the employee knows they’re under suspicion. Pull and preserve all relevant POS transaction logs, surveillance footage, register tapes, and refund documentation. Restrict the suspect’s system access quietly. Notify your legal counsel, HR, and loss prevention team at the same time so everyone is working from the same playbook. Do not confront the employee until you’ve consulted counsel; a premature confrontation gives the fraudster time to destroy records or coordinate with accomplices.
File a police report. Criminal prosecution runs under state theft or embezzlement statutes, and the severity of charges typically depends on the total amount stolen. Most states escalate from misdemeanor to felony theft once the cumulative loss crosses a dollar threshold that varies by state but commonly falls between $500 and $2,500. The police report also creates the official record you’ll need for insurance recovery or a civil claim.
Courts can order a convicted employee to repay what they stole. In federal cases, restitution reimburses victims for financial losses directly caused by the crime, and a federal restitution order can be enforced for 20 years from the date of judgment plus any time the offender spends incarcerated.2U.S. Department of Justice. Restitution Process State restitution rules vary, but the principle holds: the court calculates what was taken and orders repayment, often as a condition of probation or supervised release. Restitution doesn’t cover your investigation costs or legal fees, and collecting from someone without assets can be slow, but it’s worth pursuing.
Beyond criminal restitution, many states have civil recovery statutes that let a business demand repayment through a separate civil action. That route doesn’t require a criminal conviction and may allow recovery of investigation costs that criminal restitution wouldn’t.
Recovering the Loss: Insurance and the Tax Deduction
Internal controls reduce the odds of theft, but insurance protects you when controls fail. A fidelity bond, sometimes called employee dishonesty insurance, reimburses a business for financial losses caused by dishonest employee conduct. For businesses outside the financial sector, the standard product is a commercial crime insurance policy. These policies typically cover theft of cash, inventory, and other business property by employees. The coverage kicks in after you document the loss and file a claim.
Employee theft is also a deductible loss for federal tax purposes. The IRS defines theft for this purpose as the taking and removal of money or property with intent to deprive the owner, where the taking is illegal under state law and done with criminal intent.3Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses A register disbursement scheme fits that definition.
You deduct a theft loss in the year you discovered it, not the year the theft occurred. For an employee who skimmed for two years before getting caught, the entire loss goes on the return for the year of discovery. The deductible amount is generally the adjusted basis of the stolen property, reduced by any insurance reimbursement you receive or expect to receive.4Internal Revenue Service. Publication 547 (2025), Casualties, Disasters, and Thefts
Report the loss on IRS Form 4684, using Section B for business property. Losses on business property are not subject to the $100-per-incident and 10% of adjusted gross income floors that apply to personal casualty losses, so business owners can deduct the full unreimbursed amount.5Internal Revenue Service. Instructions for Form 4684 (2025) From Form 4684, the loss flows to your business return: Schedule C for sole proprietors, Form 1065 for partnerships, or Form 1120 for corporations.
Substantiation matters. Keep the police report, internal investigation documentation, POS transaction logs showing the fraudulent activity, and records of any insurance claims. If you received partial restitution or an insurance payout, reduce your deduction by that amount. The IRS can disallow the deduction if you can’t document both the theft and the amount lost.