Retailers lose money through two different doors. One is customers walking out with products. The other is staff quietly bending the rules at the register or in the stockroom. Most loss prevention (LP) teams treat these as one “shrink” problem, and that is why so much of the loss never gets fixed.
External theft vs internal theft look different and leave different evidence. They also need different controls. This guide breaks down both so you can see where your own losses are coming from.
Quick Answer
External theft is theft by non-employees: shoplifting, organized retail crime (ORC), return fraud, and scanner manipulation at checkout. Internal theft is theft by employees: cash skimming, fraudulent voids and refunds, discount abuse, sweethearting, and inventory pilferage. External theft is usually caught on the sales floor in real time. Internal theft is usually caught in transaction data and confirmed on video.
Key Takeaways
- External theft was the largest single source of US retail shrink in 2022 at 36.15%, followed by internal theft at 28.85%, according to the National Retail Federation (NRF).
- Together, the two made up roughly 65% of total shrink, per the same NRF survey.
- Total shrink reached $112.1 billion in 2022, or 1.57% of sales on average (NRF).
- External theft is a floor problem. Internal theft is a data problem.
- Controls that stop one type often do nothing against the other.
- The best programs measure shrink by source, store, and shift before buying any tool.
What Counts as External Theft?
External theft covers every loss caused by someone outside your payroll. The most common forms are:
- Shoplifting. Concealing items or walking out without paying. This ranges from opportunistic individuals to repeat offenders.
- Organized retail crime. Groups that steal high-resale goods in volume, often hitting several stores in a short window.
- Return and refund fraud. Returning stolen goods, or returning items with falsified receipts.
- Checkout manipulation. Skip-scanning at self-checkout, ticket switching, and “forgetting” to scan bulky items on the cart base.
What Counts as Internal Theft?
Internal theft is harder to see because it hides inside normal work. The usual patterns are:
- Cash skimming. Taking cash from the till, or ringing sales and pocketing the money.
- Sweethearting. Scanning only some of a friend’s or relative’s items, or applying unauthorized discounts.
- Void and refund fraud. Voiding completed sales after the customer leaves, or issuing refunds with no matching return.
- Inventory pilferage. Taking stock from the back room, or colluding on receiving shortages.
The NRF’s 2022 data put the average loss at about $2,180 per internal theft investigation. That is a small figure per case, which is exactly why these losses go unnoticed until they repeat for months.
External Theft vs Internal Theft: Side-by-Side Comparison
| External theft | Internal theft | |
| Who | Customers, ORC groups | Employees, sometimes with outside help |
| Where it happens | Aisles, fitting rooms, exits, self-checkout | Registers, stockroom, receiving dock |
| How it shows up | Concealment, unusual dwell time, group behavior | Abnormal voids, refunds, no-sales, discounts |
| Detection timing | Real time, on the floor | Pattern-based, over days or weeks |
| Best evidence | Video of the incident | Transaction exceptions confirmed with video |
| Core controls | Layout, visibility, alerts, response protocols | Permissions, audits, exception reports, separation of duties |
How Much Does Each One Cost?
| Shrink source | Share of shrink (NRF, 2022 data) |
| External theft (incl. ORC) | 36.15% |
| Internal theft | 28.85% |
| Process and control errors | 27.29% |
Treat these numbers as a benchmark, not a verdict on your stores. The NRF itself notes that most respondents leave e-commerce and supply chain losses out of their shrink calculations, so the true total is likely higher. Trend data also moves. The Council on Criminal Justice reported that police-reported shoplifting in a sample of US cities fell 10% in 2025 after several years of increases, while cautioning that reported figures undercount actual shoplifting.
The practical takeaway: national averages tell you what is typical. Only your own data tells you what is true for your stores.
Warning Signs to Watch For
External theft signals
- Customers lingering near high-value shelves without browsing
- Repeated visits with no purchase, especially in groups
- Bags, strollers, or clothing used to conceal items
- Items passing the scanner without a beep at staffed or self-checkout
Internal theft signals
- One cashier with void, refund, or no-sale rates well above the store average
- Discounts applied without a manager code
- Till shortages that track to the same shifts or employees
- Refunds issued with no matching return, or to the same card repeatedly
- Inventory gaps that appear after specific deliveries or closing shifts
Why You Need Different Detection for Each
External theft happens fast and in public. A guard or camera has seconds to catch it, so detection has to be live, and alerts have to reach someone who can act.
Internal theft happens slowly and in private. No single transaction looks wrong. The signal is in the pattern across hundreds of transactions, so detection has to compare employees, shifts, and stores against each other.
A program built only for shoplifters will miss the employee who voids $40 a day. A program built only around audits will miss the group that clears a shelf in four minutes.
A 5-Step Plan to Reduce Both
- Find where your shrink really comes from. Break losses down by category, store, department, and shift. Do this before buying anything.
- Tighten POS permissions. Require manager codes for voids, refunds, and discounts above a set threshold, and review the override log weekly.
- Build exception reports. Flag the transactions that break your own norms: high void rates, repeat no-sales, refunds with no receipts.
- Put video behind the flags. An exception is a lead, not proof. Short, matched video clips turn a suspicion into evidence you can act on.
- Pilot, measure, then scale. Start in two or three stores, compare investigation time and shrink before and after, and expand from there.
Loss Prevention
Catch Theft Early Using the Cameras You Already Have
Vidan AI turns existing camera feeds into real-time alerts for suspicious behavior at entrances, aisles, checkout, and back-of-house areas.
Internal Theft in Restaurants and QSRs
Internal theft is often the bigger problem in food service, because so much of the money moves through a handful of terminals and a small team. Watch for excessive comps and voids, till shortages, and “waste” that does not match what was actually thrown out. If you run restaurants or quick-service sites, our guide to QSR video surveillance solutions covers how cameras support these checks.
Where AI Video Analytics Fits
Cameras alone only record. AI video analytics adds the missing step: it reviews footage continuously and alerts your team to suspicious behavior as it happens, so people stop scrubbing hours of video after the loss is booked.
Vidan AI’s theft analytics software works with your existing cameras, alarms and access control systems. It provides real-time alerts, behavior pattern analysis and multi-site monitoring, so a lean LP team can cover more locations. For a broader view of how this fits into a full security stack, see our overview of AI video surveillance software, or our retail solutions.
The Bottom Line
External theft and internal theft are two different problems that share one line on your P&L. Measure them separately, match your controls to each, and use video to turn flags into evidence. Retailers who do that stop guessing where the money goes.