How Proactive Loss Prevention Monitoring Identified Transaction Fraud and Recovered 3% in Beverage Revenue
A multi-location operator was losing recorded beverage revenue. The transactions were happening but the money was not reaching the register. Here is what our analysts found, how we documented it, and what changed for our client.
Operator Snapshot
| Operator Type | Multi-location operator, approximately 200 locations. |
| Industry | Quick service dining. |
| Challenge | Beverage revenue and product mix data not accurately reflected in reported figures. |
| Root Cause | Systematic transaction voiding on cash sales, combined with improper employee discounting. |
| Services Applied | Proactive Loss Prevention Monitoring. |
| Outcome | 3% increase in recorded beverage sales. |
| Monitoring Method | Daily analyst review, POS transaction cross-referencing, trend-based video evidence reports. |
| Time to Identification | One Day |
| Locations Affected | Multiple |
Think your revenue numbers are accurate? Find out what proactive loss prevention monitoring actually shows.
Why Recorded Beverage Revenue Was Not Matching Actual Sales
Beverage is the highest-margin category in most food service and hospitality operations. It is what operators want to be selling more of, and it is the first place to look when revenue figures do not add up.
For this operator, the beverages were being sold. The problem was that the revenue from those sales was not being captured. What looked like a product mix issue was a transaction fraud pattern that had been running undetected, because without someone actively monitoring daily, there was no mechanism to find it.
What Proactive Loss Prevention Monitoring Identified at the Register
Through daily proactive loss prevention monitoring, Pembroke’s analysts identified two distinct behaviors happening repeatedly across this operator’s locations.
Transaction Voiding on Cash Sales
Employees were taking cash payments from customers and then voiding out beverage orders. The difference between what the customer paid and what the register recorded was going directly into the employee’s pocket.
On paper, the register was showing a lower-value transaction. Nothing would look wrong unless someone was watching transaction behavior consistently over time.
One or two of those transactions does not show up in the data. It has to be a recurring pattern across multiple employees and multiple shifts before it becomes visible, and that is exactly what our analysts found.
Systematic Employee Discounting
Alongside the voiding behavior, analysts also identified widespread improper discounting. Multiple items would be ordered, with fewer items charged for. The transactions were processed and the customers were leaving satisfied. The revenue gap it created accumulated quietly in the background.
Neither behavior is easily visible in a one-time audit. Both are visible when you are monitoring daily and building evidence over time.
The Evidence: What Was Documented and How
This is where the difference between a periodic audit and continuous monitoring produced a real outcome for this multi-location operator. An audit captures a moment, whereas monitoring builds a file.
Pembroke’s analysts documented a pattern of timestamped incidents referencing specific video footage. Each entry in the report contained the date, time, behavior observed, and a video reference. Here is what was recorded:
Documented Incident Timeline
| Date and Time | Behavior Documented |
|---|---|
| Day 1 | The customer receives a beverage, but the employee fails to record the transaction and instead keeps the payment. |
| Two days later | The same employee provided multiple beverages to another customer while improperly applying an employee discount. |
These entries were not isolated incidents. Together they represented a documented pattern of behavior, consolidated into a trend-based evidence report that went through Pembroke’s internal approval process before being delivered to the operator.
The operator received a finished, defensible evidence file, not a flag to investigate. That distinction matters when the next step involves an HR process, a disciplinary conversation, or a termination decision. The operator received a finished, defensible evidence file, not a flag to investigate.
Every Pembroke client receives a finished, verified evidence file. Find out how proactive loss prevention monitoring works.
The Result: What Changed When the Behavior Stopped
When the behavior was addressed, two things happened.
Revenue increased. The full transaction amounts were now being captured. The gap between what customers were paying and what the register was recording closed.
Product mix data corrected. Beverages were now being recorded as beverages. That matters beyond the revenue line. Inaccurate product mix data affects purchasing decisions, inventory planning, and how performance is evaluated across a portfolio of locations. Correcting it gave our client an accurate picture of what they were actually selling.
The combined result was a 3% increase in recorded beverage sales.
That 3% was not new sales volume. It was revenue that was already being generated from transactions that were already happening, but it was being taken before it could reach our client.
Pembroke’s monitoring identified the pattern, documented the evidence, and stopped it.
What a 3% Revenue Recovery Means Across a Multi-Location Portfolio
In a category with margins as high as beverages, a 3% recovery is significant. It is revenue that was being generated, served to the customer, and never captured at the register. Multiply that across a portfolio of any size and the financial impact becomes clear fast.
An important question for any multi-location operator is whether the same pattern exists across their own locations right now. Transaction fraud of this kind does not typically start and stop at one employee, or one location, the behavior can spread.
Around 70% of multi-location operators currently have no proactive loss prevention monitoring in place. For most of them, a version of this problem may be active right now. It simply has not been documented yet.
How Pembroke’s Proactive Loss Prevention Monitoring Works
Pembroke did not find this pattern through a one-time review. It was identified because analysts were monitoring this operator’s locations every day, cross-referencing POS transaction data against video footage and tracking behavior over time.
The Three-Step Process
| Step | What Happens |
|---|---|
| 1. Daily Proactive Monitoring | A Pembroke analyst monitors your locations continuously. They are reviewing transaction behavior and video footage with one objective: identify patterns, not just incidents. |
| 2. Trend-Based Evidence Reports | When a pattern is confirmed, analysts consolidate the documented incidents into a report. Every report goes through a rigorous internal approval process. What the operator receives is a finished, verified evidence file, not a raw alert. |
| 3. Delivery and Action | The report is delivered directly to the operator. It contains everything needed to act, whether that means an HR conversation, a disciplinary process, or an operational correction, with the documented record to support it. |
AI Verification
Pembroke also applies AI verification as part of the monitoring process. AI flags potential transactions for analyst review. Human analysts then verify those flags, filter out false positives, and confirm legitimate incidents before anything reaches a report. Automation identifies. Humans verify.
That distinction is especially important when findings are being used in an HR or disciplinary context.
Pembroke works with your existing video system. No new hardware is required to get started.
Where Transaction Fraud and Revenue Loss Hit Businesses Hardest
Transaction voiding, under-ringing, and improper discounting are not unique to food service. Any multi-location operation that handles cash transactions, employee-controlled registers, or high-volume product sales faces the same exposure. Pembroke works across the following sectors:
| Industry | Common Exposure Areas |
|---|---|
| Quick Service and Fast Casual Dining | Product under-ringing, transaction voiding, employee discounting |
| Full-Service Restaurants | Bar and beverage fraud, voids and comps, cash handling |
| Retail | Under-ringing, employee discount abuse, refund fraud |
| Hospitality | Mini-bar and service charge discrepancies, cash handling at front desk |
| Fuel Stations and Micro Markets | Cash transaction gaps, inventory shrinkage, product theft |
| Salons and Personal Services | Service charge adjustments, cash payment gaps, not charging for products used |
| Urgent Care and Healthcare | Transaction discrepancies, billing irregularities, supply theft, patient walk outs |
| Transport and Logistics | Inventory and product accountability, supply discrepancies, unscheduled stops and trips |
| Manufacturing | Product and supply shrinkage, inventory discrepancies |
| Property Management | Payment handling, vendor and contractor accountability |
| Nonprofits | Donation handling, financial accountability, cash management |
Find out what proactive loss prevention monitoring can recover for your business.
Frequently Asked Questions
What is proactive loss prevention monitoring and how is it different from an audit?
An audit is periodic and reactive. It reviews what has already happened at a point in time. Proactive monitoring means trained analysts are reviewing your locations daily, tracking transaction behavior and video footage continuously to identify patterns as they develop, before they compound. The output is not a checklist. It is a documented evidence file built over time.
How does transaction manipulation work and why is it hard to detect without monitoring?
Transaction manipulation happens when an employee processes a cash sale, takes the customer’s payment, and then voids or modifies the transaction in the register to show a lower-value item. The customer receives their order and leaves. Nothing appears wrong at the point of sale. Without someone cross-referencing transaction data against video footage over time, the pattern is invisible.
Can one employee’s behavior produce a measurable shift in reported revenue?
Yes, when it happens repeatedly across multiple transactions. A single voided transaction does not show up in the data. A recurring pattern, once identified and stopped, can produce a measurable change in recorded revenue. In this case, addressing the behavior produced a 3% increase in recorded beverage sales.
What does a Pembroke evidence report contain?
Each report contains specific, timestamped incidents referencing video footage, documented by an analyst and verified through an internal approval process. The operator receives a finished file that includes dates, times, behavior observed, and the video references needed to act on it, whether through HR, a disciplinary process, or an operational correction.
Does Pembroke replace our existing camera system?
No. Pembroke integrates with your existing video system and applies its own technology to enhance what you already have in place. There is no hardware investment required to get started.
How long does it take to identify a pattern like this?
In many cases, a potential pattern of unwanted behavior can begin to emerge within minutes or several hours of investigation, depending on transaction volume and monitoring activity. While early indicators can often be identified quickly, continued monitoring over time provides a clearer picture and allows businesses to track improvements, confirm trends, and measure the effectiveness of corrective actions.
Which industries does Pembroke work with?
Pembroke works with multi-location operators across quick service and fast casual dining, and full-service restaurants. We also support businesses in retail, hospitality, fuel stations, micro markets, salons, urgent care, transport and logistics, manufacturing, property management, and nonprofits. The core service, proactive monitoring and documented evidence reporting, applies wherever there are employees handling transactions across multiple locations.
What happens after a report is delivered?
That is the operator’s decision. Pembroke delivers the evidence. The operator decides how to act on it. Most use the report to support an HR or disciplinary process. Some use it to identify a training or operational gap. In either case, they are acting with a documented record rather than a suspicion.
Read More Case Studies from Pembroke
-
How Proactive Loss Prevention Monitoring Identified Five Employees Costing a QSR Location Over 15% of Sales
-
How Proactive Loss Prevention Monitoring Reduced Improper Employee Discounting by Over 90%
-
How Pembroke’s HR Consulting Helped a Growing Business Build the Right Policies and Structure