Internal Theft vs. External Theft: Preventing Shrink in Retail

Retail shrink continues to put pressure on margins across the industry. Total retail shrink in 2022 was $112.1 billion, up from $93.9 billion in the previous year.

Unfortunately, shrinkage is not a single problem, with internal and external theft making up more than half of all loss in retail. To reduce this, the industry has long relied on tools like CCTV, audits, exception reporting, and security presence to combat theft. And while they still work, modern store environments (especially those with self-checkout, high transaction volumes, and lean staffing) create new challenges for loss prevention teams. 

Below, we'll explore the unique pressures of internal and external theft, why they're harder to manage today, and the best strategies to reduce losses from both.

What is internal theft?

Internal theft refers to loss involving employees, contractors, vendors, or anyone operating with authorized store access.

Internal theft can be harder to catch because the perpetrators already have legitimate access to systems, inventory, and blind spots in security. Their actions are easier to disguise as normal work activity and, therefore, harder to flag. 

According to the NRF, internal theft accounts for 29% of retail shrink, with an average loss of $2,180 per investigated case. This figure does not include cases that don’t get reviewed. 

Types of internal theft in retail

There are many ways employee-related theft leads to loss in a retail store, and many of them aren’t immediately visible. Here are the most relevant examples.

• Merchandise theft: This is the most straightforward and involves employees directly taking stock from the shop floor, the stockroom, or during goods-in. 
• Cash theft and skimming: This involves removing cash from registers, manipulating end-of-day counts, or recording fraudulent voids and refunds.
• Discount and refund abuse: Here, employees apply markdowns outside policy, process refunds without returned goods, or run transactions through their own account to claim discounts on another shopper’s behalf.
• Sweethearting: During sweethearting, the cashier deliberately fails to scan items for a customer they know, and it may happen in a staffed lane or at SCO. 
• Employee collusion with external theft networks: This is less common but could result in a higher loss value. Organized Retail Crime groups may work with insiders with access to security details.
• Fraudulent transactions: This involves everything from voiding completed sales to reversing payments and even manipulating loyalty accounts.

What is external theft?

External theft refers to loss caused by individuals outside the retail operation and typically includes customers, Organized Retail Crime groups, or opportunistic shoplifters.

It is the larger problem for retailers. According to the NRF's National Retail Security Survey, it accounts for 36% of retail shrink. The data also shows that the threat is growing, as 70% of retailers reported an increase in theft from repeat offenders year over year.

Types of external theft in retail

External theft involves more than just "shoplifting" and extends to opportunistic theft and loss that occurs even before the product is stocked.

• Opportunistic shoplifting: This is the most common form of external theft and includes item concealment and in-store consumption. 
• Organized retail crime (ORC): This involves groups coordinating across several visits or locations and targeting items with high resale value.
• Self-checkout exploitation: Self-checkout exploitation is a broad category that covers several types of loss events that might unfold at SCO. Customers may deliberately skip scanning items, switch barcodes to pay a lower price, leave items unscanned in the cart, or abandon a transaction. 

What is the difference between internal and external theft?

The difference comes down to access. Internal theft is committed by people who already have legitimate access to your store's systems, inventory, and cash. These include employees, contractors, and anyone operating with authorized credentials. External theft, on the other hand, is committed by people who don't have this kind of access and are restricted to the shopping area.

How self-checkout complicates both internal and external theft

Self-checkout made in-store transactions more efficient; customers can scan, bag, pay, and walk out with minimal staff interaction. But it also created gaps where theft and loss can occur more easily. 

Based on a study of 8 grocery retailers and 1,300 test stores, data shows that stores with self-checkout see an average 22% increase in loss after implementation. For UK retailers specifically, stores with SCO had an average shrink rate of 1.96%, a 31% increase in shrink compared to stores without.

SCO implementation can make both internal and external theft harder to prevent. Here’s how:

• Reduced friction for external theft: In busy stores where one associate is watching multiple bays at once, it’s much harder to catch instances of skip scans and product switches.
• Override permissions create internal risk. Associates need the ability to approve interventions, dismiss alerts, and process overrides. But that makes it harder to differentiate misuse from legitimate action during auditing.
• Alert volume strains coverage: For every 10,000 additional SCO transactions, stores see an average of 1,000 additional calls to staff for assistance. This reduces response by an average of 2.27 seconds and widens the gap for loss to complete. [ECR Loss]
• Loss patterns multiply: For every additional 1% of transactions moving through SCO, loss increases by a further 0.03% to 0.05%.

Some retailers have responded by scaling back self-checkout. Target restricted self-checkout to customers with 10 items or fewer, and Walmart removed it from at least two stores in 2024. 

But scaling back is not the solution because it trades the efficiency gains of SCO without resolving the problem; internal and external theft still exist in stores with staffed checkout.

The real solution is to reduce the opportunity for internal and external theft while preserving what self-checkout offers. Below, we look at how retailers are doing that.

How to reduce internal and external theft in retail

No single measure can eliminate retail theft, but the following strategies can help reduce it to an acceptable degree and make it easier to identify loss patterns as they occur.

CCTV and visible deterrence

Visible camera coverage remains one of the most widely used tools in retail loss prevention, and for good reason. They deter both external theft (like opportunistic shoplifting) and internal theft (e.g., merchandise theft). CCTV footage also provides a reliable record for investigations, giving LP teams the ability to review incidents after the fact and build cases where needed.

Screening and access controls

Background screening during the hiring process can address employee-based internal theft to a significant degree. Once staff are onboarded, implementing access controls can limit what any one person can do within the store and reduce the opportunity for abuse. 

Execution may include restricting override permissions, limiting back-of-house entry, and having different employees be responsible for cash handling and discount approval.

Staff training

Data shows that training for staff can have a significant impact on a store’s loss rates and overall efficiency. ECR Loss reports that giving SCO supervisors enhanced training improves store shrink by 23 basis points and increases response time to alerts by 30%.

Regular audits and inventory counts

Routine counts can reveal patterns across separate, seemingly individual incidents. For example, when shrinkage is revealed to concentrate in specific SKUs, shifts, or locations, LP teams can easily chase down the cause. Ad hoc spot checks can add another level of deterrence to the equation with frequent and unpredictable audits that make it harder to time theft.

Exception reporting

Some signals are consistent with both internal and external theft, like high void rates, unusual refund patterns, or a suspiciously high number of discounts. When these come up, they aren’t concrete proof of theft, but they can help teams get to the bottom of the issue.

Anonymous reporting channels

Very often, other employees will notice instances of internal theft before any member of the management staff. Anonymous reporting channels can help them file reports without fear or concern.

Store layout and product placement

Store layout is critical for reducing external theft. Simple strategies include placing valuable products in high-visibility areas, creating clear sightlines across the shop floor, and positioning staff for natural coverage of blind spots and entry/exit points.

Exit controls

Receipt verification and exit gates have a measurable impact on external shrink. Data from ECR Loss shows that exit gates improve store loss by 30 to 40 basis points over a 12-month period. They also reduce cancelled receipts and walkaways by 30% and 28%, respectively.

Reducing retail shrink and loss with Vision AI and Everseen

Retailers have used all of these strategies with varying degrees of success. Many reduce theft and loss, but they largely fall into two categories: deterrent (discouraging theft before it happens) and reporting (quantifying loss after it has occurred). They rarely allow teams to address loss as it happens.

That's why many retailers turn to Vision AI solutions like Everseen. Everseen monitors transactions as they happen across the store, from checkout to the aisle, and gives retailers the tools to catch and stop loss in real time.

Everseen rarely needs staff intervention, and over 80% of non-scan incidents are cleared through a soft nudge alone. Teams can also access a full record of prevented loss across the estate to identify patterns, prioritize coverage, and direct attention where it's needed most.

Everseen recovers $500 million annually for retail partners and is trusted by 11 of the top 20 grocery retailers worldwide.

If you'd like to see how it works for your team's internal and external theft detection, schedule a demo.