Within half an hour, we’d uncovered the scheme. We attempted to match the refunds on the cash-register tape to the source documentation. We found nothing—no documentation whatsoever. The thief hadn’t even bothered to phony up refund slips. Then we examined more tapes. By the time we’d looked at a few dozen, it was obvious what had happened: Each evening, just before closing all eight registers, someone would ring up a several-hundred-dollar refund on one, remove an equal amount of cash and close out the register for the day. The amounts ranged from $200 to $700.