Get Our Email Newsletter

Making Judgments Only on Behavioral Cues Or Actions

Retailers in the late 1970s started to realize they needed more-focused people and property protection, and chains started changing security departments to loss prevention. As time went on, practitioners began moving from a “catch more thieves to win” attrition model to a more proactive stance. I’ve written before that deterrence doesn’t often work, and we’re all working away to improve ways to convince offenders not to launch an attack. But many more determined or distracted thieves refuse to be dissuaded from initiating damaging and dangerous crime attempts.

So many retailers continue to reluctantly apprehend undeterred offenders to try and establish some negative consequences, discourage future theft, and recover property. LP practitioners need to be morally and legally balanced and be more efficient by focusing detention efforts (starting with the requisite observation) on those exhibiting the most theft-action behaviors and most likely to cause the most harm to others or their possessions.

Behavior and Crime

Human beings often signal their intentions and next moves through utterances, social media postings, people interactions, and spatial movements. Actions can provide clues and cues that a person is considering, preparing to, or currently victimizing someone or their possessions. Human actions can also generate legal evidence of an intentional criminal act.

LP Solutions

So we focus on actual behaviors or activities, not thoughts or biological, genetic, or cultural characteristics. Professional LP practitioners never profile appearance; we use evidence-informed observation to detect a possible crime in progress, including clusters of contextual cues appearing to articulate a narrative, a logical hypothesis. The clustered cues appear linked, related, progressive, and indicate that an individual or individuals may be preparing to remove another’s property without permission, to defraud or intimidate someone, and/or to attack another person.

Whom Do We Watch, and How Do We Respond?

I’ve discussed this important topic before and was asked to revisit it now. We detect possible deviant behavior by noting clusters of behavioral and other cues in a distinct context. Humans assess places and other people to avoid bad relationships, bad meals, and bad encounters. Violent crime (rape, abuse, and homicide) investigators profile or note crime and crime scene clues that might indicate premeditation or a situational, opportunistic attack. The type of encounter, the attack versus discovery site, and other behavioral indicators might signal offender experience, motive, and level of organization. Similarly, victim exposure and routine or special activities (victimology) can help explain who might have encountered them, including offenders and witnesses.

In a store-theft scenario, quick situational evaluation should also be behaviorally based and, eventually, evidence based. Our team looks for and conducts relevant research to inform this process (science to practice).

- Digital Partner -

In this column, it seemed appropriate to feature a little more thought on enhancing thief detection and surveillance processes since national data show in-store theft continues at very high levels. Humans committing criminal acts not only give off cues as we discussed, but also may be dangerous since criminal offenders don’t normally want to be caught, could have violent histories, could be armed, and may be impaired by drugs, alcohol, or mental illness.

In-Store Theft Behavior

Part of describing problems to solve them involves the “what, why, and how” of theft activity. Theft video footage, interviewed offenders, witnesses, and victims, and field-testing different conditions all guide best practice. The idea is to systematically identify logical human theft behavioral indicators. We want to distinguish deviant action cues from innocuous or simply strange activity. What we’ve learned so far is that no single behavior, such as looking around, signals preparation to steal. It could signal the individual is looking for a companion, sales help, or a restroom, for example.

Rather, we always look for a group of behavioral and enabling cues, like looking around at much more than the merchandise, standing very close to and maybe hunching over a fixture filled with small, known high-loss items with hands down and a shopping bag in hand. These behaviors could prompt an employee to more closely watch that individual since we have a cluster of contextual cues.

- Digital Partner -

Types of Cues

The scientific method means using logic (what, why, and how questions) and rigorous observation to better understand issues and evaluate solutions. When deciding who we might surveil to reduce theft losses and violence, we can categorize pre- and post-theft behavioral cues into theft actions and stress reactions, as well as enabling movements and tools.

Theft actions include head and hand position ratios, travel speed and direction, body distance and angles to displays, signaling, diversions, and tests (to put us off or to see if we’re watching), and reactions to the stress of deviance such as flushing and grooming gestures. Enabling cues include carrying large or foil-lined bags, theft tools like cutters, get-away cars, and false receipts.

Again, these cues should appear in clusters, seemingly linked, and the context of the situation should add power to the overall prediction. The offender’s motive, such as stealing for self-use versus to convert the items to cash or for nonsensical reasons, may also drive the accuracy of an employee’s forecast of whether someone they’re observing is likely to steal or not since professional thieves often go directly to selected, readily concealed and fenced items and rapidly conceal large numbers, for example.

Behavioral Detection and Prioritization (BDP) and Contextual Cue Clusters

Busy in-store retail people are tasked with so many restocking, clean-up, service, and reporting duties that they need to be trained to safely offer service to and/or report suspected shoplifters. They, like the LP operative, should be using a set of logical, evidence-based cue clusters to possibly distinguish the likely buyer from the stealer. Below is a suggested cue listing that can be used to conduct in-house studies for training. This list is just a start, and individual behavior can vary widely.

Behavioral Cues

Outside the store:

  • Parks their vehicle in the fire lane
  • Backs in their vehicle with one person left in the driver’s seat
  • Picks up store receipts from the ground

Inside the store:

  • Circling the store floor, especially multiple times
  • Searching for items in a quick but focused way
  • Counter-reconnaissance actions, head mostly up, “scoping”
  • Ignoring price, style, brand, and quality
  • Moving with selected items to more remote store areas
  • Avoiding eye contact
  • Holding cash or credit card in hand
  • Possibly working with others
    – Entering with a group of people then quickly spreading out
    – Creating a diversion or confusion
    – Marking items for others
    – Signaling to others
    – Blocking others from cameras or other people
  • Removing packaging, tags, anti-theft devices, hangers
  • Concealing items
  • Displaying situational, reactionary stress, such as pacing, rapid breathing, visible blood vessel pulse, yawning, stretching, grooming, flushing, repeated nervous-sounding coughing, or sniffing

Physical-Enabling Cues

  • Vehicle plates missing or covered
  • Display-theft tools (magnets, cutters, foil, picks)
  • Enabling large or foil-lined bags
  • Baby strollers and other conveyances
  • Baggy clothing (possible special pockets or elastic bands)

Context Cues

  • Proximity to merchandise, especially known high-loss or otherwise craved products
  • Hovering in secluded areas
  • How the potential offender arrived
  • Who the potential offender’s colleagues are

LPRC to Retailing Digital Connections

An abundance of pandemic information is available out there from a variety of sources. The Loss Prevention Research Council (LPRC) is working every day to curate LP-focused, actionable information for you and your teams. The LPRC CrimeScience podcast is uploading two to four new episodes weekly featuring practitioners, scientists, and industry and medical experts providing concise ideas and updates. Find it wherever you listen to podcasts. Our team is also updating the LPRC COVID-19 and Rioting landing pages daily with new resource links and studies. Visit


This year’s LPRC IMPACT conference is a full go for October 4–6, as is the third year of STRATEGY@ for the most senior asset protection and loss prevention leaders. The big difference is that both will be digital using new virtual conference platforms but may still include on- or near-campus components depending on safety and travel conditions near that time. Please reach out to us at with any of your questions or suggestions.

Loss Prevention Magazine updates delivered to your inbox

Get the free daily newsletter read by thousands of loss prevention professionals, security, and retail management from the store level to the c-suite.

What's New

Digital Partners

Become a Digital Partner

Violence in the Workplace

Download this 34-page special report from Loss Prevention Magazine about types and frequency of violent incidents, impacts on employees and customers, effectiveness of tools and training, and much more.


View All | Sponsor a Webinar


View All | Submit a Whitepaper

LP Solutions

View All | Submit Your Content

Download our 34-page special report:  Violence in the Retail Workplace

Loss Prevention Media Logo

Stay up-to-date with our free email newsletter

The trusted newsletter for loss prevention professionals, security and retail management. Get the latest news, best practices, technology updates, management tips, career opportunities and more.

No, thank you.

View our privacy policy.