— For the multi-unit operator
How to spot a void-after-payment skim in your POS data
How do I tell if an employee is voiding tickets after they were already paid (the classic cash skim)?
The classic cash skim works in three steps: customer pays in cash, server pockets the cash, then voids the ticket so it never appears on the close-out report. The pattern shows up in your POS data in a specific way — once you know what to look for, it's defensible to the penny.
What to look for:
1. Tickets where the void timestamp is AFTER the payment timestamp. In Toast Sales Detail this shows as a non-null `void_amount` on a ticket that also has a `tender_amount > 0`. In Square transaction history, look for refunded transactions on a previously-settled payment.
2. Concentration on a single tender. A "regular" void (item put in by mistake, voided before payment) skews credit because credit is more common. A skim concentrates on CASH because that's the whole point — you can pocket cash, you can't pocket a Visa.
3. Concentration on a single employee. The skim relies on the same person being able to pay AND void the ticket. So one name owns 60-100% of the post-payment voids in a window.
4. Concentration on a single day-of-week or shift. Operators who run the scam tend to do it on their closing shifts when fewer eyes are on the drawer. Tuesday-Thursday closes are the classic pattern.
The Never 86'd Leak Detector runs all four of these tests in one pass against a ticket-level Toast / Square / Clover CSV and surfaces every name that matches more than one signal, sorted by composite risk score 0-100. Names that hit all four typically score 80+.
A working example from the design partner's data: one name showed up with 6 post-payment voids in a six-week window, all of them on cash tickets, all on Tuesday closes. Risk score 83. The conversation with that employee was short.
We never call it "theft" — we call it a pattern. The pattern triggers a 5-minute review with the operator. The pattern is the receipt; the verdict is theirs.