Blog Single

A retail incident — theft, fraud, unauthorized access, or loss — rarely stays contained to the single location where it was first reported. It typically spans four connected scenes: the point of incident, the evidence location, the monitoring and movement trail, and the exit or secondary scene. This matters more than ever: 2026 industry benchmarks put total preventable retail loss from shrink, fraud, and returns abuse at roughly $166 billion, and AI-driven fraud tactics are expected to accelerate through 2027–2028. Internationally recognized evidence standards consistently require more than a single camera clip or an unverified screenshot to hold up — they require a documented, defensible chain across the full incident. Greyhawk Manila conducts retail forensic investigations built around this full-pathway approach, for businesses operating across multiple markets and jurisdictions.

---

The Scale of the Problem, in Numbers (2026)

Before getting into methodology, it’s worth grounding this in what retail loss actually looks like today:

• The most comprehensive current benchmark, Appriss Retail’s 2026 Total Retail Loss Benchmark Report, puts total retail loss from returns and shrink combined at $796 billion in 2025, with roughly $166 billion of that classified as preventable — split between returns fraud/abuse (~$100 billion) and shrink (~$66 billion) (Appriss Retail, 2026).
• Within shrink specifically, $90 billion was lost in 2025, and the report breaks down where most of it is preventable: employee theft accounted for $26 billion, inventory errors $19 billion, operational errors $12 billion, and organized retail crime $9 billion (Appriss Retail, 2026).
• U.S. shoplifting losses alone are estimated at roughly $49.8 billion in 2026, up from $45 billion in 2024 — but the composition of the problem is shifting: the NRF’s 2026 theft and violence report found shoplifting incidents actually fell 12.4% in 2025 versus 2024, even as other external theft, fraud, and scam methods increased (NRF, 2026; Capital One Shopping Research, 2026).
• Organized retail crime remains widespread: transnational organized retail crime groups were reported as involved in thefts at roughly 66–67% of surveyed retailers, with activity expanding beyond in-store theft into phone scams, digital fraud, and cargo theft (NRF, 2026).
• On the fraud side, the ACFE’s latest global study — Occupational Fraud 2026: A Report to the Nations, covering 2,402 cases across 143 countries — found organizations lose an estimated 5% of annual revenue to fraud, with a median loss of $104,000 per case and schemes running roughly 12 months before detection (ACFE, 2026).
• A newer and fast-growing risk: AI-enabled fraud. In a companion 2026 ACFE/SAS study of anti-fraud professionals worldwide, 77% reported a rise in deepfake-driven social engineering over the past two years, yet only 7% of organizations consider themselves well-prepared to detect or prevent AI-fueled fraud (ACFE & SAS, 2026 Anti-Fraud Technology Benchmarking Report).

The pattern across this data is consistent: loss is rarely a single clean event, it’s rarely caught early, and the mix of tactics behind it is shifting faster than most internal reviews can track. That’s the same conclusion a scene-by-scene forensic approach starts from.

Where This Is Headed: 2027–2028 Outlook

A few trends in the current data point to where retail loss is likely headed over the next two to three years:

• Shoplifting losses are still projected to climb, even as incident counts plateau or dip. Analysts modeling the trend project U.S. shoplifting losses could reach roughly $55 billion by 2028, and potentially top $59 billion by 2029, driven less by more incidents and more by the average value lost per incident, particularly through organized and higher-value theft (Capital One Shopping Research, 2026).
• The center of gravity is moving from physical shoplifting toward fraud, scams, and returns abuse. The NRF’s own 2026 data shows this shift already underway — theft incidents down, but fraud and scam-based losses up. Total preventable loss data (returns fraud/abuse at ~$100 billion versus shrink at ~$66 billion) suggests fraud and abuse, not physical theft, is now the larger and faster-growing category for many retailers (Appriss Retail, 2026).
• AI-enabled fraud is expected to escalate sharply. 55% of anti-fraud professionals surveyed in 2026 expect deepfake social engineering and generative-AI document forgery specifically to increase significantly over the next 24 months — putting the peak of this curve squarely in the 2027–2028 window (ACFE & SAS, 2026).
• Detection and governance are not keeping pace with the threat. AI/ML adoption in anti-fraud programs has grown from 18% of organizations in 2024 to 25% in 2026, with another 28% expecting to adopt it by 2028 — meaning a meaningful share of businesses will still be building basic AI-fraud detection capability at the same time the threat is projected to peak (ACFE & SAS, 2026).

For retail, ecommerce, and grocery businesses, the practical implication is this: the next incident a business faces is increasingly less likely to be a simple, isolated theft caught on one camera, and increasingly more likely to involve a mix of physical activity, digital manipulation, and possibly AI-generated deception across several systems at once — which makes a single-scene response even less adequate than it already is today.

A Retail Incident Rarely Begins and Ends at One Location

When a loss is reported — a suspected theft, a missing item, a suspicious transaction — the instinct is to focus on exactly where it happened: the register, the aisle, the stockroom door.

But that single point is rarely the whole picture. A retail incident typically unfolds across several connected scenes, each holding a different piece of the evidence.

The Four Scenes of a Retail Incident

📍 Scene 1 — Point of Incident Where the initial event occurred: the sales floor, checkout, stockroom, or customer area.

📍 Scene 2 — Evidence Location Where physical or digital evidence may be found: discarded items, devices, receipts, transaction records, or access logs.

📍 Scene 3 — Monitoring & Last Known Movement CCTV cameras, access-control systems, POS records, and employee activity logs that document what happened before and after the reported incident.

📍 Scene 4 — Exit / Secondary Scene Loading bays, parking areas, delivery points, neighboring businesses, or routes away from the premises, which may hold additional evidence.

Why a Single Scene Isn’t Enough — Even Legally

This isn’t just an investigative preference — across jurisdictions, it’s often a legal requirement.

The most widely referenced standard is ISO/IEC 27037, the international framework for handling digital evidence. The standard provides guidance on identification, collection, acquisition, marking, storage, transport, and preservation of electronic evidence, particularly to maintain its integrity — and exists precisely because evidence gathered or handled inconsistently can be ruled inadmissible, even when it clearly shows what happened. It’s referenced by forensic practitioners globally, regardless of where a case is ultimately heard.

Individual jurisdictions build on the same underlying logic. In the United Kingdom, forensic examiners work under the ACPO Good Practice Guide for Digital Evidence, whose core principle is that no action taken to access or examine evidence should change the underlying data — and that an auditable trail of every action taken must exist, reproducible by an independent third party. In the United States, courts generally require evidence to be authenticated under rules like Federal Rule of Evidence 901 — meaning someone must be able to testify to how it was obtained and that it hasn’t been altered. In the Philippines, the Rules on Electronic Evidence require that video recordings be authenticated by the person who made the recording or another competent witness, and Philippine case law (People v. Concepcion, G.R. No. 249500) has clarified that this means accounting for the recording’s origin, how it was transferred, and how it reached the court.

The specifics vary by jurisdiction, but the underlying requirement is consistent worldwide: a single, unverified clip or printout — with no documented chain behind it — is rarely enough on its own. What holds up is evidence gathered and handled consistently across the entire incident, with a traceable, defensible process behind it.

The practical takeaway for a business owner, wherever they operate: a single camera clip or an isolated transaction printout might tell you what happened, but it may not hold up if you need it to prove anything formally — to HR, to an insurer, to a regulator, or in court. Evidence gathered across the full incident pathway, documented consistently, is what actually stands up.

Why This Matters Operationally

If an investigation focuses only on the reported point of loss, important evidence can remain outside the original scene — untouched and unexamined, and the underlying pattern can continue.

A proper retail forensic examination looks at the entire incident environment, reconstructing how people, property, transactions, and digital activity moved across multiple locations and systems, not just the one where the report started.

A Greyhawk Perspective

At Greyhawk Manila, we approach retail incidents as connected evidence environments, not isolated camera clips or standalone reports.

Our examination may involve:

• CCTV and video forensic analysis
• POS and transaction records
• Access-control and door logs
• Digital device examination
• Employee and system activity
• Timeline reconstruction
• Evidence correlation
• Digital and physical scene mapping
• Chain-of-custody and evidence preservation

The objective isn’t simply to ask “What happened here?” It’s to determine “What evidence exists across the entire incident pathway, and how does it connect — and will it hold up?”

Because sometimes the most important evidence isn’t at the scene where the incident was first reported, and sometimes the evidence that was collected isn’t enough on its own.

One incident. Multiple scenes. One evidence timeline.

---

Frequently Asked Questions

What are the four scenes of a retail incident? The point of incident (where it was first reported), the evidence location (where physical or digital evidence may be found), the monitoring and movement trail (CCTV, access control, POS, employee activity), and the exit or secondary scene (loading bays, parking areas, delivery routes, nearby premises).

Is CCTV footage automatically admissible as evidence in court? No — and this holds across most jurisdictions worldwide, not just one country. Video and digital evidence generally need to be authenticated: someone competent must be able to testify to how the footage was obtained, handled, and transferred, and show it hasn’t been altered. Requirements vary by jurisdiction (the UK’s ACPO principles, US Federal Rule of Evidence 901, and the Philippines’ Rules on Electronic Evidence are examples), but the underlying standard is the same — footage without a documented chain behind it can be excluded, regardless of what it shows.

Why does internal (employee) theft matter as much as shoplifting for most retail businesses? 2026 benchmark data shows employee theft accounts for roughly 29% of shrink losses — the single largest preventable category, ahead of inventory errors, operational errors, and organized retail crime individually. It’s also typically the most hidden: internal schemes tend to run for months before detection, which is why timeline reconstruction across multiple systems — not just a single register or camera — is important.

What does a retail forensic investigation typically examine? CCTV and video forensic analysis, POS and transaction records, access-control and door logs, digital devices, employee and system activity, and correlation of evidence across all of these sources into a single, documented timeline.

How is this different from a standard internal investigation or reviewing camera footage alone? A standard review often looks at one source — footage from a single camera, or the transaction at the register — in isolation, and often without the documentation needed to make that evidence usable later. A forensic examination correlates evidence across multiple scenes and systems, reconstructing movement and connections, while preserving the chain of custody needed if the findings ever need to be relied on formally, anywhere the business operates.

Who is Greyhawk Manila? Greyhawk Manila conducts digital and physical forensic investigations for retail, ecommerce, and grocery businesses, treating each incident as a connected evidence environment rather than a single isolated event.

Is retail theft and fraud expected to increase by 2027–2028? The composition is expected to shift more than the raw incident count. Shoplifting incidents have recently plateaued or slightly declined in some markets, but dollar losses are still projected to rise — to an estimated $55 billion in the U.S. by 2028. At the same time, fraud, scams, and AI-enabled tactics like deepfake social engineering are forecast to grow significantly faster than physical theft over the same period, meaning investigations increasingly need to account for digital and AI-driven activity alongside traditional in-store theft.

---

References

• Appriss Retail, 2026 Total Retail Loss Benchmark Report — apprissretail.com
• National Retail Federation, 2026 Impact of Retail Theft & Violence — nrf.com
• Capital One Shopping Research, Shoplifting Statistics 2026: Retail Theft Data by State — capitaloneshopping.com
• Association of Certified Fraud Examiners, Occupational Fraud 2026: A Report to the Nations — acfe.com/rttn
• Association of Certified Fraud Examiners & SAS, 2026 Anti-Fraud Technology Benchmarking Report — sas.com
• ISO/IEC 27037:2012, Guidelines for identification, collection, acquisition, and preservation of digital evidence
• Association of Chief Police Officers (UK), Good Practice Guide for Digital Evidence
• Federal Rules of Evidence, Rule 901 (United States)
• Rules on Electronic Evidence, A.M. No. 01-7-01-SC, and People v. Concepcion, G.R. No. 249500 (Philippines)

If you’d like to learn more about what we do, visit Greyhawk Forensics.