Our case begins with an automated email alert from POSWatch Enterprise to management indicating the detection of a suspicious check (check #1124263):
Sent: Thursday, October 16, 2014 10:12 AM
To : firstname.lastname@example.org
Subject: veteranshwy: Suspicious Check (affect 1 transactions, from 09:12 to 10:12)
Chk: 1124263 Emp:Smith, Kobi (Start:10/16/2014 09:49:20 End:10/16/2014 09:52:41)
Management uses POSWatch Enterprise Client to pull up and review the suspicious check:
Why is this check suspicious? There are multiple reasons. The check remains open for an extended time period and contains multiple voided items, and the check has a significant time gap between order item entries. The check warrants further investigation, so management can easily retrieve video by selecting the beginning of the check and clicking on the Display Video button.
Upon reviewing the video, management can clearly see the order being rung up and voided out while food is delivered to the customer. Significantly, after the customer receives his food and leaves the counter, the check is held open instead of being tendered out.
Upon further review, management confirms that when the check is finally tendered, it is to a second customer, not the customer who originally received food on this ticket. The time gap observed in the transaction database was the wait period between when the first customer left the counter and the second customer arrived in the store. Management now has clear and actionable forensic evidence which can be used in a counseling discussion with the employee.
Digital Video Solutions, Inc.
828 E. Baltimore Street
Baltimore, Maryland 21202