Pairing POS data with CCTV to stop shrink at the register

Voids after a sale completes, refunds processed with no customer at the counter, discounts or comps applied post-payment, and no-sale drawer opens. Each one has a legitimate version and a fraudulent version, and the only way to tell them apart is to see the counter at that moment.

Start by pulling a month of these from Clover reporting and ranking them by employee and by dollar value. Patterns show up fast: one cashier with triple the void rate of anyone on the same shift is a conversation, not an accusation.

Without overlay, investigating a suspicious refund means noting a timestamp and scrubbing footage hoping the clock is synced. With overlay, you filter for refunds over a threshold and every match links directly to its clip.

A ten-minute weekly review replaces hours of ad hoc searching. Most of our merchants find their first real recovery in the first two weeks, usually something nobody suspected.

Mount a camera facing the cashier at roughly counter height so you capture hands, drawer and face, not the top of a head. Cover the drawer, the safe, the back door, the stockroom and any waste disposal point, which is a classic exit route for product.

Watch for backlight from storefront windows. A silhouetted figure in front of glass is worthless in a dispute, and it is the most common placement mistake we correct on existing systems.

For a card-present dispute, a clip showing the cardholder at the counter, combined with the signed receipt and EMV authorization data, is strong compelling evidence. Representment windows are short, so exporting quickly matters more than having perfect footage.

Set retention to at least thirty days and confirm your team knows how to export a clip with the timestamp intact. A recorder nobody can operate is not a control.

Cameras and recorders run embedded software that rarely gets patched. Put them on a dedicated VLAN, block them from reaching the payment VLAN, change every default credential and never port forward the recorder to the open internet.

Remote viewing should run through a vendor cloud relay or a VPN. That single choice removes the most commonly exploited path into small business networks.