108 Fraud Profiles

Cash changes hands but never reaches the register. It's the most common restaurant fraud on earth — and the hardest to see, because nothing is ever missing from a system that never knew the money existed.

Product walks out the back door faster than it's sold at the front. It's the most normalized fraud in the industry — many kitchens quietly treat it as an unofficial benefit rather than theft.

Inflated invoices and phantom line items move through accounts payable one signature at a time, protected by the sheer volume of routine, trusted supplier billing.

A fictitious name on the roster, a real bank account collecting the wages — repeating every pay period until someone finally reconciles headcount against payroll.

Orders are accepted, quietly diverted or never fulfilled, then refunded for platform credit. It's the fastest-growing fraud category in the industry since 2020.

The sale is rung, the cash is collected, then the transaction is voided as if it never happened — using the system's own correction tool as the cover.

A trusted purchasing manager, a quiet cash payment, and a vendor contract that never goes out to competitive bid. These schemes often run for years because the manager's judgment is rarely questioned.

Smaller portions and cheaper substitutes at full menu price — theft disguised as cost discipline that compounds across every single plate.

Stored value drained through unauthorized transactions before a customer ever redeems it. Balance-scraping attacks can empty thousands of cards before anyone spots the pattern.

Every unauthorized comp for a friend is a small theft, and small thefts compound fast. Cash is often still collected in full — only the recorded price changes.

The incumbent POS or software vendor pays a quiet annual retainer straight to the IT or operations manager — not for services, but to stay unchallenged. That manager then blocks every competing vendor from ever reaching the owner, so the business never discovers what better technology actually costs, or does.

Buddy punching and inflated hours quietly bloat every payroll run — the highest-frequency fraud in the payroll category, occurring at some scale almost everywhere.

Fake accounts farm points that get resold on secondary markets, or employees quietly award themselves status. Programs built to reward customers become a side income stream for insiders.

A vendor that exists only on paper, an invoice that looks routine, and a payment that lands in an employee-controlled account. Shell structures can survive several audit cycles before unraveling.

Heavy pours inflate apparent consumption, justifying extra stock orders — stock that then quietly leaves with the bartender rather than reaching a paying guest.

A manager under bonus pressure overstates inventory counts, quietly protecting a food-cost target while masking whatever real problem is actually driving costs up.

Terminals, kitchen display screens, routers, and tablets get sourced through one reseller at a quietly inflated price, with the margin returned to whoever approved the purchase order. Because IT hardware buys are infrequent and technical, nobody outside the department has the context to question the quote.

Counterfeit and duplicated coupons erode margin on every redemption, often at industrial scale once a code leaks online. A single shared code can cost more than the promotion it supported.

A POS vendor builds invoice deletion directly into the product — and automatically renumbers everything after it, so the sequence never shows a gap. The classic "check for missing invoice numbers" audit finds nothing wrong, because the tool was built specifically to pass it.

The register opens, cash disappears, and no transaction is ever created to explain either. It exploits the one legitimate reason a drawer opens without a sale — making change.

Personal spending gets reclassified as business expense, one inflated receipt at a time. Round-number patterns and duplicate submissions are usually the first thread that unravels the scheme.

Customer and payment data get harvested from underprotected systems, then sold to the highest bidder on the dark web. A single unpatched POS vulnerability can expose every card swiped for months.

A manager skims a share of credit card tips during the handoff between POS and payroll, before staff ever see what guests actually charged for them.

A full case is invoiced, a few units short arrive — repeated across thousands of deliveries a year, it adds up fast. Driver-receiver collusion turns an occasional shortfall into a systematic one.

Product is diverted for personal use, then logged as ordinary spoilage — the perfect alibi, since nobody questions food already marked as thrown away.

Hired for independent advice, quietly paid a commission by every vendor on the shortlist — so the "recommendation" was financially indifferent to its own outcome from day one. There's no internal trail to catch it; the money never touches the client's own systems.

A vendor or contractor invoices for custom integrations, requirement-gathering, or POS customization that was never actually built. Because the work is technical and invisible to finance and operations, a recurring "enhancement" line item can survive years of invoices with nothing to show for it.

Orders get quietly redirected to cash to dodge platform commission, or padded after confirmation to pocket the difference. The platform's own order record becomes the evidence once someone looks.

Two versions of the same day's sales exist — one for the register, one for the tax authority. Illicit "zapper" software deletes a chosen share of transactions after the fact, leaving a clean Z-report.

A franchisee suppresses reported sales — sometimes with illicit software — to shrink the royalty owed to the franchisor.

Fake bills get accepted at the register — sometimes by accident during a rush, sometimes by arrangement with whoever hands them over.

A software vulnerability in a self-order kiosk lets a customer manipulate price or stack coupons illegitimately.

Bots or organized groups hoard prime reservation slots and resell them, or simply no-show at scale.

No kickback, no invoice — just an underpaid gatekeeper who's grown comfortable with the incumbent and blocks every technology review that might disturb it. The tell: propose inviting five competing vendors to present, and watch how hard they resist.

A legitimate supplier ships a lower grade than invoiced — farmed fish for wild-caught, Choice beef for Prime.

A bartender rings a premium drink at a well-drink price, or serves a friend for free in exchange for a cash tip the register never sees.

A spoofed email requests a vendor's banking details be updated — no callback verification, and the next legitimate payment vanishes into an attacker's account.

A "vacation" where the manager still logs in remotely never actually tests anything — whatever scheme they're hiding stays hidden. And revoking only a departed employee's own login misses the shared password they also knew, which is exactly how settings get deleted and operations paralyzed after they're gone.

A staffing agency pays a hiring manager per placement, sometimes for candidates who never actually start.

A staged or exaggerated incident claim — a slip-and-fall, equipment damage — extracts an inflated payout.

A multi-brand kitchen accepts orders it can't fulfill, or shifts costs between virtual brands to hide which one loses money.

A fraudulent QR code sticker replaces the real one on the table, sending payment straight to an attacker.

A manager or cashier manually reduces a price for a friend using the legitimate override function — the drawer stays balanced, only the menu price was ever real.

Coordinated fake orders or reviews game a delivery platform's own ranking algorithm — for or against a rival.

Menu and marketing claims about local sourcing or sustainability outlive the supplier relationship that once supported them.

Between till count and bank deposit, a manager with sole control over both quietly diverts a portion — a gap most operations never independently reconcile.

A beverage manager routes purchasing to an unauthorized or kickback-paying distributor at an inflated price.

Promo codes and referral bonuses get scripted and abused at scale by technically capable customers.

A training vendor bills for sessions that exceed what any real schedule could accommodate — invoices approved on trust, never checked against attendance data.

Customers dispute a legitimate charge with their bank instead of the restaurant, keeping the food and the refund.

A facilities vendor bills for parts and repairs never actually performed on kitchen equipment.

A skimming device or transaction-deletion software is physically or digitally installed on the register itself.

A catering invoice bills for more guests or premium items than the event actually had.

High-speed, low-visibility drive-through service lets an order taker hand out food without ever ringing it up.

A senior executive diverts company funds through self-dealing contracts or falsified expense claims.

Mid-service, a kitchen runs short of a specified ingredient and quietly plates a cheaper substitute under the same name and price — no disclosure, same bill.

Today's genuine cash covers up yesterday's theft in a rolling pattern — no single day ever looks alarming, which is exactly what lets it run for years.

Executives inflate revenue or same-store sales figures specifically to win a favorable funding round or valuation.

Hidden charges buried in fine print, or menu photography that materially misrepresents what's actually served — persuasive design that crosses into deception.

Staff present purchased or fabricated food-handler certificates instead of completing genuine training.

Criminal groups encrypt restaurant systems and threaten to leak customer data unless a ransom is paid.

A customer eats, then leaves without paying — often through an unmonitored exit while staff attention is elsewhere.

A server notices a customer checking their watch or mentioning a flight, and deliberately slow-walks the check. A rushed guest pays without scrutiny, or gives up and leaves cash on the table — a completed meal that can then get quietly logged as an unavoidable walkout.

Rebottled spirits or mislabeled premium ingredients enter the supply chain through an under-the-radar distributor.

A petty cash fund, kept deliberately informal, gets drained through vouchers with no receipt attached.

A hardware skimmer or memory-scraping malware captures card data directly off the payment terminal.

Alcohol or premium items get miscoded to a lower tax rate, or input credit is claimed on ineligible purchases.

Room-charge fraud and unrecorded comps let F&B revenue quietly disappear before it reaches hotel accounting.

A relief-fund or equipment-grant claim overstates headcount or purchases the government never actually verified.

A kitchen manager under cost pressure uses product past its safe-use date rather than writing it off — sometimes re-labeling it to pass a check.

A large check gets split into pieces specifically to hide a void or dodge a manager-review threshold.

Purchased five-star reviews inflate a rating that a platform's own fraud detection may later purge entirely.

A manager temporarily lowers POS prices for friends, then restores them before the next audit ever sees it.

A restaurant sells alcohol outside licensed hours, to minors, or without a valid license at all.

A bill split between cash and card gets the card half rung honestly and the cash half quietly shorted — the sale still exists in the system, just under-totaled, which is what makes it harder to spot than simple skimming.

A volume rebate the business genuinely earned from a supplier gets quietly redirected to the relationship manager's own account instead of company books.

High-volume, low-supervision concession stands see concentrated cash skimming and side-selling during events.

Grease-trap and waste-oil disposal logs get signed off without the servicing actually having occurred.

An employee clocks in early or stays late with no genuine extra work behind it, a supervisor signs off without checking, and the overtime premium quietly compounds over every pay period that follows.

A shared POS login across an entire shift erases individual accountability — quietly defeating the anomaly detection that would otherwise catch the fraud living underneath it.

A franchisor inflates earnings claims or hides litigation history to sell more units to prospective franchisees.

A kitchen lists a fake local or specialty brand identity on a delivery platform to win orders it hasn't earned.

A remote, captive supply chain makes port provisioning shortfalls and crew-account manipulation hard to audit.

A small ring of employees cross-refers each other's contacts in a closed loop, collecting bonuses for a shared talent pool rather than genuinely new hires.

A captive-audience venue exploits travelers who can't price-shop or walk away before their flight.

An attacker impersonates an executive or vendor by email or phone to redirect a legitimate payment.

A facility is deep-cleaned only for a predictable inspection date, then reverts to substandard practice immediately after.

A tip amount gets altered on a signed slip after the customer leaves, or a receipt is reprinted specifically to support a fraudulent return.

An order that came through a high-commission platform gets internally logged as a lower-commission channel, quietly understating what's actually owed.