Skimming fraud is theft of incoming cash before the sale or receipt is recorded in the books. Because the money never enters the accounting records, the books and the bank still agree, and the bank reconciliation balances. You find skimming by comparing deposits with an independent measure of what should have come in, such as unit counts or customer records.
What is skimming fraud and where does the cash go?
Skimming fraud is the removal of cash at the point it enters a business, before anyone writes it down. The thief keeps the money and the sale simply never exists on paper. That timing is what separates skimming from cash larceny, where cash is stolen after it has been recorded and the books then show a shortage.
The cash usually goes straight into a pocket or a personal account. Cash is the easy target, but skimming also covers customer checks taken from the mail, deposited elsewhere or cashed. A stolen check is harder to use than cash because it names a payee, which is why skimmed checks often end up altered. The tests for that are in check tampering and how altered checks pass through a bank, and the chemical version is covered in check washing, where the ink on a stolen check is removed.
Skimming tends to run for a long time at small amounts. A cashier who keeps one sale in twenty causes no visible loss on any single day. The damage builds over months, and the first sign is often a margin that looks worse than it should.
Why does the bank reconciliation still balance after skimming?
A bank reconciliation compares the cash recorded in the books with the cash the bank reports. Skimmed money never reaches either one, so both sides are short by the same amount and the reconciliation agrees. The reconciliation proves that recorded transactions reached the bank. It cannot prove that every transaction was recorded.
That limit matters because a clean reconciliation is often taken as proof that cash is under control. It is proof of something narrower. If a sale of 40.00 is never rung up, the register total, the sales journal, the deposit slip and the bank statement all agree with each other, at 40.00 less than reality.
A proof of cash extends the reconciliation across receipts and disbursements for each month, and it catches problems that a single balance comparison misses, such as a deposit recorded twice. The method is explained in proof of cash, the four-column reconciliation. It still cannot find skimming on its own, since the missing sale is absent from every column. For that you need a record the skimmer did not control.
Skimming fraud at the register, in the mailroom and on receivables
Skimming fraud takes a few common forms, each tied to a job that handles money before it is recorded. Register staff can leave sales unrung or ring them for less. Mailroom staff can remove checks before the receipts list is made. Staff who post receivables can steal a customer's payment and hide it with a write-off or a credit.
Unrecorded sales
The cashier takes the customer's money and does not ring the sale, or rings it as a "no sale" to open the drawer. This works best where customers do not need a receipt, such as a bar, a car wash or a market stall.
Understated sales
The sale is rung, but for less than the customer paid. The cashier pockets the difference. A variation is a false void or refund after the customer leaves, which reduces the recorded sale back down. Unusual voids by one person are the trace.
Receivables skimming
A customer pays an invoice and the payment disappears. The thief then has to explain why the invoice still looks unpaid. The usual covers are a write-off as uncollectible, a false credit memo, or applying a later customer's payment to the first account. That last cover is a separate scheme with its own tests, and every one of these leaves a trace on the customer side: a customer who says they paid, holding a cancelled check.
Who is placed to do it
Look at who receives money and also records it. A person who opens the mail, prepares the deposit and posts the receipts can skim with little risk. A person who only opens the mail, while someone else posts and a third person reconciles, cannot hide a theft for long.
Sales-to-deposit tests for skimming
A sales-to-deposit test compares an independent measure of expected sales with the sales recorded and the cash deposited. Recorded sales and deposits will usually agree, because the skimmer controls both. The independent measure is what breaks the agreement: a machine counter, numbered tickets, inventory used or a customer count the cashier cannot edit.
A worked example
The example below uses made-up figures for a car wash that charges 12.00 per wash. The wash tunnel has a cycle counter that the attendants cannot reset. Recorded sales come from the register, and deposits from the bank statement.
| Day | Wash counter | Expected at 12.00 | Recorded sales | Deposited | Gap |
|---|---|---|---|---|---|
| Mon | 112 | 1,344.00 | 1,344.00 | 1,344.00 | 0.00 |
| Tue | 96 | 1,152.00 | 1,152.00 | 1,152.00 | 0.00 |
| Wed | 130 | 1,560.00 | 1,320.00 | 1,320.00 | 240.00 |
| Thu | 104 | 1,248.00 | 1,248.00 | 1,248.00 | 0.00 |
| Fri | 158 | 1,896.00 | 1,560.00 | 1,560.00 | 336.00 |
| Sat | 210 | 2,520.00 | 2,160.00 | 2,160.00 | 360.00 |
| Week | 810 | 9,720.00 | 8,784.00 | 8,784.00 | 936.00 |
Reading the result
Recorded sales and deposits match every day, so the bank reconciliation would pass. The counter says otherwise. On Wednesday, Friday and Saturday, 20, 28 and 30 washes ran without a matching sale. The next step is the staff rota. If one attendant ran the register on all three days and on none of the clean days, the test has turned a margin problem into a named lead.
Choosing the independent measure
Every business has some record that tracks volume without passing through the cashier. A restaurant has food purchases and recipe yields. A parking lot has gate counts. A clinic has appointment logs. A service business has job tickets or timesheets. Pick the one the suspected person cannot change, and test a period long enough to cover their shifts and someone else's.
Indirect signs of skimming in margins, voids and customer complaints
Indirect signs of skimming are patterns outside the bank statement that suggest sales went unrecorded. Gross margin falling while purchases stay steady, a high rate of voids or no-sale openings for one employee, and customers who complain that a payment was not credited are the common ones. None proves skimming. Each tells you where to test.
- Margin drift. If cost of goods sold is steady but sales fall, either prices dropped or some sales are missing. Compare by location or shift if you can.
- Cash share falling. In a business where customers pay by card and cash, a falling share of cash sales with no change in customers deserves a look. Card sales are hard to skim because the processor records them.
- Voids and refunds by person. Rank staff by voids, refunds and no-sale openings per shift. Outliers are not guilty, but they are where to start.
- Customer statements. A customer who receives a statement showing an unpaid invoice they settled is your best witness. Make sure statements go out from someone other than the person who posts receipts.
- Lifestyle and refusal of leave. An employee who never takes time off may be protecting a scheme that needs daily attention.
Deposit shortfalls that are not skimming fraud
A deposit shortfall is not always skimming fraud. Card processors deposit net of fees and hold back chargebacks. Cash taken on Saturday may be deposited Monday. Free services, staff discounts and test cycles all create volume without revenue. Rule out these honest explanations before you treat a gap as theft.
Work through them in this order:
- Timing. Line up deposits with the business day they belong to, not the day the bank posted them. A weekend often spills into Monday's deposit.
- Processor fees and holds. If card sales are deposited net, add the fees back from the processor statement before you compare.
- Comps and rework. In the car wash example, a rewash for a dissatisfied customer runs the counter with no charge. Ask for the log of free services and subtract it.
- Counter faults. A machine count can be wrong. Check the counter against a second source for a sample day.
- Recorded but undeposited cash. If recorded sales exceed deposits, that is not skimming. The cash was recorded and then went missing, which points to larceny or a lost deposit.
What remains after these adjustments is the unexplained gap. Its pattern by day and by person matters more than its size.
Cash receipt controls that make skimming harder to hide
Cash receipt controls work against skimming by putting an independent record between the customer and the cashier. Prenumbered receipts, visible registers, card-first payment options and separating the person who receives cash from the person who records it all make an unrecorded sale harder to hide. Review the independent record regularly, or it deters nobody.
A short list that fits a small business:
- Have two people open the mail and list every check before it goes to the person who posts receipts.
- Make the deposit match the receipts list, and have a third person compare the two with the bank statement.
- Post a sign that the purchase is free if no receipt is offered. Customers then police the register for you.
- Send customer statements from someone who does not handle receipts.
- Compare an independent volume measure with recorded sales each month, by location and by shift.
Once those records exist, testing them is mostly matching. PreciseBankFlow reads each bank statement, confirms it foots and matches the deposit lines to the ledger, which leaves your time for the comparison against the counter, the tickets or the customer log.