Caught an employee stealing inventory: the response playbook

The costliest move in this situation is the confrontation on day one. Accuse without records and you risk a wrongful-termination claim, tip off anyone else involved, and destroy the trail you needed intact. The merchants who come out of this whole do it backwards: document first, secure access second, consult before confronting, and act only when the record speaks for itself. Here's the sequence — and the evidence you already have without buying anything.

Before anything: rule out the boring causes

Variance is not theft. Most inventory that goes missing was never taken — it was miscast: receiving miscounts, damage nobody logged, returns that never restocked, unit-of-measure slips, transfer errors. Run the variance investigation on your worst-variance SKUs first and give the innocent explanations a real chance. What escalates to suspicion is a pattern that survives that process: the same staff account, the same reason code, the same shift, repeatedly, on the same kinds of items. Innocent errors scatter. Patterns point.

The evidence you already have in Shopify

Every inventory change in Shopify is recorded: the adjustment history shows the date, who made the change — a staff member, app, or sales channel — and the effect on your quantities, along with the reason selected, including reasons like Damaged and Theft or loss (Shopify Help Center, "Viewing inventory adjustment history," accessed November 2026). The product-level view holds the last 180 days; beyond that, the Inventory adjustment changes report filters by SKU, location, staff member, app, and adjustment reason. This audit trail is the backbone of the response — how it works and what each field means is worth knowing cold before you need it, and it's annotated in the adjustments article.

Two honest limits on the evidence. It records adjustments, not shelf-taking — a pattern in the log is circumstantial evidence of a habit, not proof of a hand in a pocket. And it only covers inventory edits: POS refunds, discounts, and voids are separate levers with their own reports, and a person stealing through the till leaves different footprints than one stealing from the shelf. Check both if you're checking one.

Reading the pattern: a worked example

A hiking-gear store, one retail location plus online. The owner filters the adjustments report by staff member r.mendez and reason Damaged (all entries illustrative):

Nine entries over seven weeks (two more in August), every one on a Thursday between 6 and 9pm — after the owner leaves — every one on STK-MER-CHAR-L, the store's best-selling merino sock. No damage adjustments appear on weeks the owner closed.

The arithmetic that made it invisible: 47 units × $6.40 cost ≈ $300.80 estimated at cost, roughly $43 a week — small enough to dissolve into ordinary shrinkage, large enough that it wasn't accidental. What converts a log into a case is exactly this: rhythm (same day, same shift), scope (one SKU, pocketable), and absence of corroboration (no matching damaged-goods disposal, no supplier credits, no bin).

The first 48 hours: a checklist

1. Export before you touch anything. Screenshot the filtered history, run the adjustments report, and store copies off-device and off the shared drive. If access changes or a dispute follows, your evidence should predate every reaction.
2. Secure access — deliberately. Change shared passwords and remove or restrict the account's inventory-editing permissions; who can edit what lives in your staff permission settings. The tension: continued access means continuing loss, but a sudden lockout tips off the person — and anyone else involved. If police or insurance are in play, many owners document one more cycle before acting; weigh that with counsel, not alone.
3. Check your insurance before assuming the loss is yours. Crime or fidelity coverage may respond to employee theft, but policies commonly require documentation and often a police report; the records a stock coverage claim requires are the same ones from step one. Read your policy's claim steps before the conversation, not after.
4. Consult before you confront. Employment rules on accusations, deductions from pay, and terminations vary by state and country — and this is an ops playbook, not legal advice. A one-hour consult with counsel before the conversation is cheaper than any claim filed after it. Your state's rules and your lawyer own this part.
5. Hold the conversation with records, not adjectives. Second person present, factual script: "Forty-seven units of this SKU were written off as damaged on Thursdays under your login since August. I haven't found matching damage disposal. I want to hear what you know." Then listen. Don't litigate in the room and don't reveal your full evidence — that's for the process, whichever process follows.
6. Run a targeted count. Count the SKUs the account touched, plus adjacent pocketable high-value stock. Native counts let you select products, count, and have the result approved before quantities change (Shopify Help Center, "Stock counts," accessed November 2026). This turns a suspicion into a number.
7. Correct the books truthfully. Units logged as Damaged that were never damaged: re-adjust with the Theft or loss reason so the trail reflects what happened. Don't try to erase the false entries — history can't be deleted in Shopify, and you shouldn't want it to be. A clean, honest correction chain is what the next section's readers will rely on.

After the conversation

Whatever follows — termination, police report, insurance claim — runs on the record you built, which is why the order above matters more than any single step. And the honest closing sentence on prevention: permissions least-privilege by role, a counting cadence that touches pocketable SKUs weekly, and a receiving process with a second set of eyes are the stack that makes this rare, and it's laid out properly in the shrinkage prevention guide — this article stops at the response, because that's where you are.

Common questions

I think an employee is stealing inventory — what do I do first? Document before confronting: export the adjustment history filtered by that staff member and reason, secure copies off-device, and rule out innocent causes like receiving errors and unlogged damage. Confrontation without records risks a wrongful-termination claim, tips off anyone involved, and burns the evidence you'll want for insurance or police.

Can Shopify show who adjusted inventory? Yes. Adjustment history records the date, who made the change (staff member, app, or sales channel), the quantity effect, and the selected reason — including Damaged and Theft or loss. The product view holds 180 days, and the Inventory adjustment changes report filters by staff member, SKU, location, and reason (Shopify Help Center, accessed November 2026).

Should I call the police about inventory theft? Often yes — theft is reportable, and insurers commonly require a police report before paying a fidelity or crime claim. But the timing (evidence preservation versus immediate reporting) and your jurisdiction's specifics are questions for counsel. Many owners consult a lawyer before filing; that consult usually improves both the report and the claim.

Can I deduct the stolen value from the employee's pay? Usually regulated and often prohibited — wage deduction rules vary sharply by state and country, and doing it wrong converts your claim against them into one against you. Consult your state's rules or counsel before touching any wages. Recovery more often flows through insurance or civil routes than through the final paycheck.

How do I stop this happening again? Three layers do most of the work: least-privilege inventory permissions so no single account can adjust stock unsupervised, a weekly count on pocketable high-value SKUs, and a two-person receiving process. The full prevention stack — all four layers, in priority order — is covered in the shrinkage prevention deep-dive.

Next step

Even with no suspicion at all, run a ten-minute review this week: open the adjustments report, filter by reason Damaged and Theft or loss, and scan the last 90 days for rhythm — same account, same day, same SKU. Patterns need weeks to form, and this ten-minute habit is what sees them forming. Then keep the habit on a weekly calendar slot; it's the cheapest fraud control a small store can run, and the prevention guide will tell you what to layer on top of it.