Four Layers Deep: Why We Built This to Catch the Team, Not Just the Person

Why “single operator, recurring anomaly” isn’t enough

That model catches the sloppy, solo opportunist. It completely misses:

• The team — front-of-house voids it, back-of-house doesn’t fire the item, a third person’s shift covers the till reconciliation
• The relay — Operator A opens something suspicious, Operator B closes it, because a single operator’s individual numbers look totally clean, the anomaly is split across two clean-looking records
• The cover — a manager or supervisor who’s in on it approves the void, discount, or refund that would otherwise trigger a flag, so the authorization layer itself is compromised
• The rotation — multiple small teams, each operating below the threshold that would flag any one person, on a rotating schedule specifically to avoid pattern detection over time

None of that shows up if a system is only asking “which operator looks the worst on paper.” It has to ask something better. So that’s what we built.

Four Layers of POS Theft Detection, Cross-Checked Against Each Other

Layer one: AI camera detection. Dwell-time near the till, activity in a flagged zone, hand movement near product, repeated glances back toward the till area, body positioning that doesn’t match normal service flow — the system is watching for the moment worth a second look, not running continuously in the background hoping something turns up. This is what tells the other layers where to focus.

Layer two: the login. Every action on the till is tied to an operator ID — who opened the ticket, who modified it, who closed it, who authorized the discount or the void. On its own, this tells you who touched what, but not the full story.

Layer three: the POS report. Voids, discounts, refunds, no-sales, price overrides, reopened tickets — the transaction-level detail, timestamped and cross-referenced against every login on that ticket. This is where the relay and the cover start to surface, because the system isn’t just looking at one operator’s totals, it’s looking at the relationship between the operators involved in the same ticket.

Layer four: a 90-second review window. Once something’s flagged, a short clip around the moment gets pulled for a person to actually watch and make the call — nothing continuous, nothing intrusive, just the seconds that matter. This is what turns “the numbers look a bit odd” into “here’s exactly what happened at the till when it looked odd” — and it’s a person confirming it, not the AI making the call alone.

An optional fifth signal: audio. When the camera angle is blocked or the moment calls for more context than video alone can give, an approved audio transcript can be pulled into the same review window — never running continuously, never listening by default, only attached to an already-flagged moment when it’s genuinely useful. It’s one more way the review window can turn “something looks off” into “here’s exactly what was said and done,” without adding a single extra layer of always-on surveillance.

Individually, each layer has a blind spot. The camera can recognize who’s there and flag a moment worth reviewing, but it has no visibility into the POS itself — it can’t tell you what was actually rung up, voided, or discounted at that till. The login confirms who’s signed in, but on its own it doesn’t explain what happened during that session. The POS report can’t tell you whether two clean-looking operators were quietly working the same anomaly. The review window, without the other three, is just footage with no context to search through. Put together, the four layers cross-check each other — and that’s specifically what closes the team, relay, cover, and rotation gaps that single-operator tracking walks straight past.

This isn’t only about catching a team

Everything above is framed around the gaps a single-operator system misses — the handoffs, the relays, the covers. That’s the hardest problem, so it’s the one worth explaining in depth. But it would be misleading to leave the impression that’s all four layers are for.

The same cross-checking that catches a two-person relay catches a single opportunist just as well — often faster, because a lone operator’s pattern shows up clearly across all four layers at once instead of being split thin across two clean-looking records. Repeated voids from the same login, a hand lingering near a drawer with no matching sale, a discount applied after the till’s already closed for the night — these are exactly the kind of single-operator patterns the system was built to catch from day one. The four-layer design isn’t a replacement for that. It’s what happens when a team gets smart enough to spread the same behavior across more than one person, and the system needs to be smart enough to follow it anyway.

Non-accusatory by design

Here’s the part that matters just as much as the detection itself: this isn’t built to produce a wall of names or a “gotcha” moment. It’s aggregate-first — patterns, trends, and flagged windows for management to actually review, not a running scoreboard of who to distrust. The four-layer cross-check exists to remove ambiguity when something genuinely needs a closer look, not to manufacture suspicion where there isn’t any.

And detection is only half of what this is for. The other half is training. When a flagged pattern gets reviewed, it’s an opportunity to tighten a process, close a gap, or coach a habit — not just a black mark. A venue that catches one incident once is relieved for a week. A venue where the whole team knows every layer is watching, and where that visibility feeds back into better practices over time, is the one that actually moves the leakage number in the right direction and keeps it there.