Get Our Email Newsletter

Solving Multiple-Suspect Thefts

Early in my career, I investigated many multiple-suspect thefts with a less than satisfactory case resolution. Not being able to identify the primary culprit from the honest associate made this a frustrating task. A case in point: I investigated a deposit totaling well over $10,000 that was discovered missing during bank reconciliation. After an extensive investigation at the local bank, I was able to confirm that the funds were never deposited. Knowing that this store was not on armored car service, I knew I had an internal problem.

This particular store had six members of management, all of whom had normal access to the funds. Deciphering which one person among all six possible subjects proved to be futile. In an attempt to identify the offender, I conducted interviews of all parties involved, trying to make a determination based on their verbal and nonverbal responses. Unfortunately, the case was not resolved successfully.

Had I had the skill sets necessary to eliminate uninvolved associates, I could have saved myself valuable time and closed more cases successfully. Fortunately, I have since found such a skill—the SCAN Statement Analysis Technique.

- Digital Partner -

The Problem for Investigators

Every day, investigators are faced with the difficult task of solving multiple-suspect thefts. Examples of multiple-suspect thefts are robberies, burglaries, bank losses, petty cash shortages, drug diversion, and high-shrink investigations, just to name a few.

The difficulty in closing multiple-suspect thefts is due to the sheer volume of associates who must be interviewed. Trying to identify the guilty party from the many potential suspects is a trying and arduous task. More often than not, the thefts go unresolved and are presented to law enforcement with similar results.

Most investigators today rely on more traditional methods of separating truthful associates from deceptive ones. These methods might include conducting fact-finding interviews, reviewing video, and behavioral analysis interviews (BAIs). However, a more effective approach would be to first eliminate truthful suspects, thereby narrowing your focus prior to the interview stage of your investigation. That precisely is the purpose of the SCAN technique of statement analysis.

According to the National Retail Security Survey conducted by Dr. Richard Hollinger and the University of Florida, roughly 48 percent of retail shrink comes from internal associates. This is a staggering and certainly disturbing number. If associates account for nearly half of the losses in inventory shrinkage, then presumably, this same trend would apply when measuring other types of losses, such as robberies or burglaries.

The Federal Bureau of Investigation’s Uniform Crime Report suggests that the retail industry is still a leading target for robberies. However, not all robberies areas random as one might think. According to the FBI and other robbery experts, the majority of all retail robberies have some kind of internal involvement. Thus,retail loss prevention departments must do a better job of investigating this internal involvement, whether it is direct or indirect.

LP Solutions

According to a study conducted by the convenience store industry, most robbers target stores with easy access to cash ($200 or more) with their main concern being how to escape without getting caught or shot. An associate who has knowledge of the store’s security countermeasures, availability to keys, passwords, and knowledge of available funds would be of great value to such a potential robber.

Process of Elimination

What is the best way to resolve more multiple-suspect thefts? In order to close a case successfully, we must first eliminate from suspicion the innocent associates who had nothing to do with the crime. The technique we utilize is called Scientific Content Analysis. SCAN was developed and facilitated by Avinoam Sapir, who runs the Laboratory for Scientific Interrogation (, and who has helped hundreds of retail and law enforcement investigators resolve difficult and complex investigations.

The SCAN technique is not used in the traditional sense to find known suspects, but rather to eliminate those who are not involved in the deviant act. The end result is a very time-efficient and proven approach to establish which suspects are truthful and which are deceptive.

- Digital Partner -

How SCAN Works

SCAN focuses on several components tied to language, in this case, the written language. This article will not attempt to teach you the SCAN technique, which is ordinarily taught in an intensive three-day course, but to give you a flavor for the principles associated with analyzing statements.

SCAN focuses on the subject’s own words and the subconscious thoughts reflected in the usage, context, and even the verbiage of the written language. SCAN teaches that in an “open” statement, the subject’s written words are to be taken literally. An open statement is defined as the subject  writing what happened in his or her own words in reference to an event. The SCAN method advocates that what the subject writes, or in some cases, doesn’t write, is very telling.

Sapir suggests that we should believe exactly what the subject wrote and not assume that a grammatical error was made or the wrong word was chosen. He further teaches that we should not take anything into account except the written words in a statement–not the personality, tenure, title, or any other prejudices that may cloud the judgment of investigators.

Other principles of the SCAN technique include, but are not limited to, the following:

Balance. SCAN teaches us to look at written statements and divide them into three main categories: before, during, and after the act of deviance.

Checking the balance of a statement is done by counting the total number of lines in the open statement, then dividing it into the three different sections (prior, during, and after). A general rule to follow when analyzing statements is to look for an even distribution of time in the statement. Many statements will have approximately three lines per hour of time throughout the subject’s day. When this balance is severely skewed, it is an important signal.

For example, if a subject averages three lines per hour for most of the day described, but writes 15 lines for about one hour of time just prior to a description of a robbery, this may be extremely critical given its close proximity in time to the criminal act.

Tense. Another principle of SCAN is that when an open statement describes facts that have occurred in the past, the writer should speak and write in the first-person singular, past tense. In other words, for a robbery that took place yesterday, one would refer to his or her activities in the past tense, not the present.

For example, the subject would say something like the following: “I was counting the petty cash when I saw a man pointing a gun at me. I gave him all of the money.” A truthful subject would not say, “I am counting the petty cash. I see the man. I give him all of the money.”


SCAN focuses strongly on the usage–or in some cases, the nonusage–of pronouns. In an open statement, a subject would normally refer to himself or herself in the first person singular by using pronouns such as “I” or “me.” If more than one person was present, the subject would use plural pronouns such as “we” or “us.” An object that belongs to the subject, such as a car or a house, would be identified by a possessive pronoun such as “my,” “mine,” or “our.” It is extremely critical that the pronouns throughout a statement are consistent with the facts of the case.

For example, “The robber made me get into my car and drive him down the freeway. He pointed a gun at me the whole time. He made me pull over and the man got out of the car.”

Notice the change. In this statement, the pronouns changed from “my car” to “the car.” This could prove critical, depending on where in the statement you identify the sudden shift in pronoun usage.

Change of Language

SCAN also focuses on certain choices of words used and where they are located in the statement.

In our previous example, “The robber made me get into my car and drive him down the freeway. He pointed a gun at me the whole time. He made me pull over and the man got out of the car.”

Did you notice the subtle change in the way the robber is described?

The subject’s statement referred to the robber as “the man” later in the statement. “Man” is a much more polite word used to describe someone who just had a gun pointed at you.

This could be significant when combined with the sudden change of possessive pronoun, as mentioned earlier. Clusters of this type of illogical references throughout a statement are extremely significant.

How Retailers Can Use SCAN

Many retailers have found the SCAN technique to be helpful in closing multiple-suspect thefts. The teams I have managed have been using the SCAN method for some time now, and it has proved to be invaluable in both time management and case resolution.

The ability to eliminate suspicious from honest associates and focus our time and effort on those deserving of a more targeted interview, makes this approach an integral part of our department’s standard operating procedure. This approach saves valuable time for the investigators, and also saves hundreds of payroll hours by eliminating the need to interview dozens of employees.

Accompanying the SCAN technique is the usage of the VIEW Questionnaire, also designed by Sapir. VIEW stands for Verbal Inquiry—the Effective Witness. This questionnaire, based on the SCAN technique, enables an easy comparison of subjects’ responses, thus shortening the investigation and quickly removing suspicion from truthful subjects.

Implementing SCAN

Following is the procedure for putting the SCAN technique to work in an investigation.

1. Field investigators use the VIEW Questionnaire to screen individuals who could have potentially been involved in the theft.
2. The questionnaires are then sent to an LSI-SCAN-verified investigator.
3. The questionnaires are analyzed.
4. Subjects are classified as either “cleared” or “not cleared.”
5. For any subjects who are not cleared, the field investigator and SCANcertified investigator discuss the interview strategy and any discrepancies that prevented the subject from being initially cleared.
6. The field investigator conducts a more targeted interview with the subject to either clear up any discrepancy, clear the individual, or to gain an admission.

Note that the SCAN-certified investigator and field investigator may, in fact, be the same individual. For strategic purposes, we decided to have a divisional LP director or LP supervisor perform the analysis, while the field investigator concentrated on the interviews.

While described here in individual steps, this process can actually be carried out very quickly and efficiently. The questionnaires can be faxed or emailed back and forth. The subjects can fill out their questionnaires simultaneously. And the analysis of the questionnaires is quickly and easily done.

Proven Success

By using this procedure, we are closing more cases successfully and more quickly. We are even recovering valuable restitution dollars as a result. The cases that we are successfully resolving include robbery, burglary, missing deposits, high shrink investigations, and drug diversion.

One such case that comes to mind is an investigation conducted by a former associate of mine regarding an armed robbery. The facts of the case were consistent with a typical retail robbery, with the only difference being that the associate was pistol-whipped. Knowing the thin line that investigators must Solving Multiple-Suspect Theftswalk when handling a robbery in terms of compassion and objectivity, this investigator introduced the VIEW Questionnaire to aid him. By analyzing the responses from all parties involved,he was able to ascertain sincerity from deception. He later went back in and interviewed the one person who he could not clear in the preliminary stage out of five potential subjects. The result was a full admission to being involved in a colluded effort to rob the store of its petty cash funds. The full admission led to the eventual arrest of his accomplice. Both were charged and subsequently convicted.

Had this investigator followed his heart instead of his head, everyone in the store would have gone through an employee assistance program instead of the one person rightfully going to jail.

The ramifications of a case like this are actually worse than a “normal” robbery on a store associate’s psyche. Not only did this store get robbed, but the employees also assumed that they were victims of a random act of violence. Little did they know that one of their own had turned against them and had the entire act staged,putting them in harm’s way.

This example is one of many that are successfully being cleared by retail loss prevention investigators every day. Needless to say, as a result of closing cases like these, we have dramatically changed the way we approach armed-robbery investigations.

It should also be emphasized that the VIEW Questionnaire and the usage of the SCAN technique should only be used as an aid for the investigator. These tools are best used for eliminating suspicion from truthful suspects, rather than for identifying “known” suspects. They should not be used as the basis to discipline an employee. As with any investigation, the decision to terminate or prosecute should be based on the totality of the circumstances. However, SCAN and VIEW are extremely useful truth and deception tools in your growing toolbox.

These techniques can save your team valuable time, payroll hours, and, most importantly, help eliminate the need to interview honest associates. We owe our associates and operational partners a more specific, targeted approach to identifying potential known offenders. SCAN Statement Analysis, when used appropriately, does just that for retail investigators.


Loss Prevention Magazine updates delivered to your inbox

Get the free daily newsletter read by thousands of loss prevention professionals, security, and retail management from the store level to the c-suite.

What's New

Digital Partners

Become a Digital Partner

Violence in the Workplace

Download this 34-page special report from Loss Prevention Magazine about types and frequency of violent incidents, impacts on employees and customers, effectiveness of tools and training, and much more.


View All | Sponsor a Webinar


View All | Submit a Whitepaper

LP Solutions

View All | Submit Your Content

Loss Prevention Media Logo

Stay up-to-date with our free email newsletter

The trusted newsletter for loss prevention professionals, security and retail management. Get the latest news, best practices, technology updates, management tips, career opportunities and more.

No, thank you.

View our privacy policy.