SECURITY REPORT | RETAIL
Methods, Patterns, and Safeguards for Retail
POS fraud is not a random act — perpetrators are well-prepared, understand processes, and deliberately exploit weaknesses in procedures and human behavior. The following compilation presents real, documented cases and supplements them with other known patterns that checkout staff should be aware of.
Part 1: Documented Fraud Cases
1. Fictitious Double Charge via Twint
Category: Digital Payment | Risk: Medium
The fraudster claims their Twint account was double-charged and demands a refund directly at the checkout. The alleged double charge does not exist — the amount is credited without any prior charge having occurred.
2. Return Booking via Third-Party QR Code
Category: Social Engineering | Risk: High
A person poses as an accountant or POS technician and demands that a return transaction be processed. The cashier believes they must immediately assist the caller because the caller creates time pressure through their knowledge of the subject matter and by citing deadlines or closing dates.
The fraudster demands information from the cashier to enhance communication. By providing item numbers or EAN codes retrieved from the online shop, the fraudster ensures that the cashier generates one or more return receipts for these items. The refund for the returns requires a refund account. The refund account is transmitted as a QR code to the cashier’s smartphone via SMS, MMS, WhatsApp, or other messengers — the credit goes to the fraudster.
3. Receipt Cancellation After Cash Payment
Category: Internal Fraud | Risk: High
The checkout staff cancels the receipt after the customer has paid the subtotal and does not request a receipt. The transaction remains incompletely booked — the collected cash is embezzled.
4. Return with Inferior Third-Party Goods
Category: Return | Risk: Medium
The fraudster buys an item at a regular store, obtains a cheaper or defective product of the same type online or from discount retailers, and returns it after the return period — along with the original receipt for the newly purchased item.
5. Hidden NFC Debit in a Crowd
Category: NFC / Contactless | Risk: Medium
Using a payment app and a prepared shopping cart, the perpetrator holds their smartphone to strangers’ contactless cards in queues or on public transport and triggers a payment before the cardholder can react.
Other Known Fraud Methods
6. Not Scanning Items (Sweethearting)
Checkout staff or a distracted team allows items to pass through unscanned — intentionally or due to distraction. Often combined with intense conversation to keep the cashier occupied.
7. Swapping or Covering Price Labels
The perpetrator attaches labels from cheaper products to high-priced items or prints fake barcodes that trigger an incorrect price at the checkout.
8. Change Trick (Quick-Change)
The perpetrator confuses checkout staff by rapidly exchanging banknotes and asking targeted questions to get more change than was paid. Typically used during stressful moments or when there is a rush.
9. Return with a Forged Receipt
Original receipts are copied, altered, or found in the trash. These are then used to claim returns for items never purchased from the retailer.
Part 3: Recommendations for Daily Checkout Operations
- Always process refunds only through official channels and with supervisor approval — never to third-party QR codes or accounts. No refund without merchandise. Staff must be trained.
- For Twint and other apps: Payment is only complete when it is confirmed green in your own POS system.
- Always document returns with the original receipt and by checking the item’s condition — take photos if suspicious.
- Consciously perceive attempts at distraction: process transactions calmly, structured, and without haste.
- Alleged technicians or accountants without prior notice: immediately inform supervisors, do not process any transactions.
- Establish regular training and clear escalation paths within the team
This report is aimed at retail employees for awareness. In case of concrete suspicion of fraud: inform supervisors and, if necessary, involve law enforcement authorities.
Are you aware of other fraud cases at the checkout? Email us at the following address: Administration+Sicherheit@adega.ch.