Organized Retail Crime vs. Shoplifting

Retail theft is not always the same type of security problem.

A person concealing merchandise and attempting to leave a store without paying may be committing shoplifting. A coordinated operation involving multiple people, repeated thefts, targeted merchandise, transportation, storage, and resale can present a very different security challenge.

This distinction matters because organized retail crime (ORC) is generally broader and more structured than an individual shoplifting incident. The National Retail Federation describes ORC as large-scale theft of retail merchandise or digital goods intended for resale or distribution for financial gain, often involving coordinated groups and channels for moving stolen merchandise back into commerce.

For retailers, understanding the difference can help determine how incidents should be documented, investigated, escalated, and prevented.

What Is Shoplifting?

Shoplifting generally refers to the theft of merchandise from a retail establishment.

A typical shoplifting incident may involve one person or a small number of individuals taking merchandise without paying.

Examples can include:

• Concealing merchandise
• Removing security packaging
• Passing merchandise beyond a point of sale
• Leaving the store without paying
• Switching or manipulating price labels
• Taking merchandise from a display
• Using deceptive methods to obtain merchandise

Not every shoplifting incident is part of an organized operation.

The circumstances surrounding the incident matter when determining whether it may be connected to a broader pattern.

What Is Organized Retail Crime?

Organized retail crime generally involves coordination, repeated activity, larger-scale theft, and an intent to generate financial gain through resale or redistribution.

The National Retail Federation describes ORC as systematic large-scale theft and subsequent resale of stolen goods for financial gain. Its research notes that ORC can involve shoplifting, fraud, burglary, robbery, insider participation, cargo theft, and other methods used to obtain merchandise.

An ORC operation may involve different people performing different functions.

For example, one person may obtain merchandise while another person transports it, stores it, or facilitates its resale.

Potential channels for stolen merchandise can include:

• Online marketplaces
• Flea markets
• Informal resale networks
• Physical retail locations
• Wholesale channels
• Other distribution networks

The important distinction is that the retail theft may be only one component of a larger operation.

Organized Retail Crime vs. Shoplifting: Quick Comparison

Factor	Shoplifting	Organized Retail Crime
Typical scale	Individual or limited incident	Potentially repeated and larger-scale activity
Organization	May involve one person	Often involves coordinated participants
Objective	Theft of merchandise	Theft and resale/distribution for financial gain
Frequency	May be isolated	May involve repeated incidents
Merchandise	May involve individual items	May target specific, resalable merchandise
Locations	Often one store	May involve multiple stores or jurisdictions
Resale	May not be established	Resale or redistribution is commonly central
Investigation	Often incident-focused	May require pattern and network analysis
Security response	Store-level response	May require asset-protection and law-enforcement coordination

These are general distinctions rather than a legal test. Definitions and legal thresholds can vary by jurisdiction.

Why the Distinction Matters

A single theft incident may appear relatively straightforward when viewed in isolation.

However, several incidents involving the same merchandise, similar behavior, recurring individuals, multiple locations, or suspicious resale activity may indicate a broader pattern.

For a retailer, identifying those patterns can change the appropriate response.

Instead of treating each event as an unrelated incident, the security or loss-prevention team may need to ask:

• Has this happened before?
• Is similar merchandise repeatedly targeted?
• Are the same individuals appearing at multiple locations?
• Are incidents occurring across different stores?
• Is stolen merchandise appearing for resale?
• Are there related return or gift-card fraud incidents?
• Is there evidence of coordinated transportation or storage?
• Are internal processes being exploited?

This is one reason accurate incident documentation is so important.

Common Characteristics of Organized Retail Crime

There is no single pattern that identifies every ORC operation.

However, retailers may encounter several characteristics.

Repeated Theft

Repeated theft of particular products or from multiple locations can be more significant than an isolated incident.

Security teams should look for recurring patterns rather than assuming every event is independent.

Targeted Merchandise

Organized operations may focus on merchandise that is relatively easy to transport and resell.

Depending on the retailer, this could include:

• Consumer electronics
• Health and beauty products
• Over-the-counter products
• Apparel
• Tools
• Small appliances
• Household products
• Other high-demand merchandise

Product risk varies considerably by retailer and market.

Multiple Participants

Some organized operations involve several people performing different roles.

The presence of multiple people alone does not establish that an incident is organized retail crime. However, coordinated behavior can be an important investigative indicator when combined with other evidence.

Multiple Locations

Repeated theft across several stores can provide information that would not be apparent from a single store’s incident report.

This is particularly important for retailers operating regional or national store networks.

Resale Activity

A key feature of ORC is the conversion of stolen merchandise into financial value through resale or redistribution.

Retailers may therefore monitor appropriate intelligence sources for evidence that stolen merchandise is entering resale channels.

ORC Does Not Always Look Like a “Smash-and-Grab”

Public attention often focuses on highly visible incidents involving groups entering a store and rapidly removing merchandise.

Those incidents can occur, but they are not the only form of organized retail crime.

ORC can also involve:

• Repeated shoplifting
• Return fraud
• Gift-card fraud
• Ecommerce fraud
• Cargo theft
• Supply-chain theft
• Counterfeit activity
• Insider involvement
• Theft followed by online resale

The NRF notes that organized retail crime can extend across physical stores, supply chains, warehouses, transportation networks, and online channels.

For this reason, retailers should avoid defining ORC solely by what appears on surveillance video inside a store.

The Role of Loss Prevention

Loss-prevention and asset-protection teams are often central to identifying patterns.

Their responsibilities may include:

• Reviewing incident reports
• Analyzing recurring theft patterns
• Reviewing CCTV footage
• Identifying repeat incidents
• Monitoring high-risk merchandise
• Coordinating with store management
• Preserving relevant evidence
• Supporting investigations
• Communicating with law enforcement when appropriate

The objective is not simply to catch individual shoplifters.

It is also to understand whether individual incidents may be connected.

How Security Guards Can Support Retailers

Private security officers can provide an important layer of retail security, particularly when their responsibilities are clearly defined.

Depending on the assignment, security personnel may assist with:

• Visible deterrence
• Entrance and exit monitoring
• Patrols
• Access control
• Customer and employee safety
• Observation and reporting
• CCTV monitoring
• Incident documentation
• Property protection
• Emergency response
• Coordination with management

Security officers should not be expected to independently conduct complex criminal investigations.

Their role should be integrated into the retailer’s overall loss-prevention and incident-response program.

Incident Reporting Is Critical

Retailers should document suspected theft consistently.

A useful report can include:

• Date and time
• Store location
• Exact area involved
• Merchandise involved
• Description of observed behavior
• Number of individuals involved
• Direction of travel
• Vehicle information when lawfully and safely available
• Relevant CCTV footage
• Witness information
• Security response
• Police notification, if applicable
• Estimated merchandise loss
• Related incidents or reference numbers

Reports should focus on observable facts rather than assumptions.

For example, a report should describe what a person did rather than speculate about their motive or personal circumstances.

Preserve Evidence Properly

When a retailer believes an incident may be connected to a larger investigation, preserving relevant information can become especially important.

Potential evidence may include:

• CCTV footage
• Photographs
• Transaction records
• Inventory records
• Incident reports
• Point-of-sale information
• Return records
• Gift-card transaction information
• Access-control records
• Vehicle information
• Witness statements
• Relevant communications

Evidence-handling procedures should follow the retailer’s policies and applicable legal requirements.

Security personnel should also understand when evidence should be transferred to management, loss prevention, investigators, or law enforcement.

Look for Patterns Across Stores

A retailer with multiple locations has an important advantage: access to information from more than one store.

A theft that appears isolated at one location may become more significant when compared with similar incidents elsewhere.

Retailers can analyze:

Pattern	What it may help identify
Same merchandise repeatedly targeted	Product vulnerability
Similar behavior across stores	Possible recurring activity
Same individuals across locations	Potential connection between incidents
Similar time periods	Staffing or operational vulnerability
Repeated resale activity	Possible downstream distribution
Return anomalies	Potential return-fraud pattern
Gift-card anomalies	Potential financial-fraud pattern
Repeated vehicle observations	Possible transportation pattern

These indicators should be treated as investigative leads, not automatic proof of organized crime.

Improve Merchandise Security

Retailers should identify merchandise that presents elevated theft risk based on their own data.

Potential measures include:

• Improved product placement
• Electronic article surveillance
• Locked displays where appropriate
• Controlled high-value merchandise areas
• Inventory controls
• Cycle counts
• Point-of-sale monitoring
• Product tagging
• Better shelf visibility
• Targeted CCTV coverage
• Employee awareness

Security measures should be balanced against customer convenience.

Locking every product behind a barrier may reduce some forms of theft while creating operational and customer-service problems.

A risk-based approach is generally more practical.

Strengthen Store Layout and Visibility

Store design can influence both opportunity and detection.

Retailers can evaluate:

• Blind spots
• High-risk displays
• Entrance and exit visibility
• Camera coverage
• Lighting
• Product placement
• Emergency exits
• Staff sightlines
• Customer traffic patterns
• Checkout positioning

High-value or frequently targeted merchandise should be positioned where appropriate monitoring is possible.

Train Employees Without Turning Them Into Security Officers

Employees should understand how to recognize and report suspicious behavior, but they should not be expected to place themselves in unnecessary danger.

Training can cover:

• How to report suspected theft
• When to contact security
• How to preserve information
• How to document incidents
• How to respond to aggressive behavior
• Emergency procedures
• Customer and employee safety
• What employees should not attempt to do

A strong retail security program places safety ahead of merchandise recovery.

Do Not Confuse Theft Prevention With Physical Confrontation

Retail employees and security personnel may encounter situations involving threats or aggression.

The appropriate response depends on the circumstances, facility policy, applicable law, and the authority of the personnel involved.

Security planning should emphasize:

• Early recognition
• Communication
• De-escalation where appropriate
• Calling for assistance
• Maintaining safe positioning
• Protecting customers and employees
• Following established escalation procedures

A merchandise loss should not automatically become a physical confrontation.

When Should Retailers Involve Law Enforcement?

Retailers should establish procedures defining when suspected theft or other criminal activity should be reported to law enforcement.

The appropriate threshold can depend on:

• Severity of the incident
• Threats or violence
• Evidence available
• Value of the merchandise
• Repeated activity
• Property damage
• Applicable state or local law
• Retailer policy

Potentially organized activity may also require coordination beyond a single store.

Retailers should maintain clear contacts and escalation procedures for their loss-prevention and law-enforcement relationships.

California Retailers: Why Documentation Matters

California has adopted legislation addressing retail theft and organized retail theft, including measures designed to improve enforcement and allow aggregation of certain stolen property values across incidents and victims under specified circumstances. California’s 2024 retail-theft legislation also maintained organized-retail-crime statutes and related task forces that otherwise had been scheduled to sunset.

California also enacted measures addressing large-scale resale of stolen property and other forms of retail and property theft.

Because California retail-theft laws can change and specific legal outcomes depend on the facts, retailers should obtain current legal advice when developing formal policies or evaluating a particular case.

A Practical Retail Security Strategy

A retailer trying to address both shoplifting and organized retail crime should build a layered security program.

Layer 1: Prevention

• Store design
• Lighting
• Product placement
• Access controls
• Inventory management
• Employee training

Layer 2: Detection

• CCTV
• Electronic article surveillance
• Point-of-sale monitoring
• Security patrols
• Exception reporting
• Inventory audits

Layer 3: Documentation

• Incident reports
• CCTV preservation
• Inventory records
• Witness information
• Transaction records
• Cross-store incident tracking

Layer 4: Investigation

• Pattern analysis
• Loss-prevention review
• Internal investigation
• Evidence correlation
• Appropriate external coordination

Layer 5: Response

• Security response
• Employee and customer protection
• Emergency procedures
• Management escalation
• Law-enforcement notification when appropriate

Layer 6: Continuous Improvement

• Review incidents
• Identify vulnerabilities
• Adjust staffing
• Improve technology
• Modify procedures
• Reassess high-risk merchandise

Common Mistakes Retailers Should Avoid

Treating every theft as the same

An isolated shoplifting incident and a coordinated theft pattern may require different levels of investigation.

Focusing only on the dollar value of one incident

A series of smaller incidents can become more significant when analyzed collectively.

Ignoring online resale activity

The theft itself may occur inside a store, but the financial objective may involve resale elsewhere.

Failing to share information internally

If each store treats every incident as completely independent, patterns across locations can be difficult to identify.

Relying entirely on cameras

CCTV is valuable, but cameras do not replace trained employees, security personnel, inventory controls, or incident analysis.

Putting employees at unnecessary risk

Merchandise recovery should not take priority over the safety of employees and customers.

Assuming coordinated behavior automatically proves ORC

Multiple people, repeated theft, or unusual behavior can be indicators, but they do not by themselves establish a criminal organization. Investigative conclusions should be based on evidence and appropriate authorities.

Quick Checklist for Retailers

Before finalizing a retail theft-prevention program, ask:

• Are high-risk products identified?
• Are theft patterns analyzed across locations?
• Are incidents documented consistently?
• Is CCTV coverage adequate?
• Are employees trained to report suspicious activity?
• Are security officers properly integrated into the loss-prevention program?
• Are access points monitored?
• Are inventory discrepancies investigated?
• Are return and gift-card transactions monitored for anomalies?
• Is relevant evidence preserved?
• Are escalation procedures documented?
• Does management know when law enforcement should be contacted?
• Are serious incidents reviewed afterward?
• Is the security program updated when new patterns emerge?

Frequently Asked Questions

Is organized retail crime the same as shoplifting?

No. Shoplifting generally describes theft of merchandise from a retail establishment. Organized retail crime generally involves broader coordination and the theft or fraudulent acquisition of merchandise for resale or financial gain. The exact legal definitions vary by jurisdiction.

Can one person commit organized retail crime?

ORC is generally associated with organized or coordinated activity, but legal definitions vary. Retailers should not determine that an incident constitutes ORC solely because one person stole a large amount of merchandise.

Does every group theft qualify as organized retail crime?

No. The presence of several people does not by itself establish ORC. Retailers should document observable facts and allow qualified investigators and authorities to determine whether incidents are connected.

What products are commonly targeted by organized retail crime?

There is no universal product list. Targets vary by retailer and market. Organized theft can involve products that are relatively easy to transport and resell, including consumer goods, health and beauty products, electronics, apparel, tools, and other merchandise.

Can security guards stop organized retail crime?

Security officers can contribute to prevention through visibility, patrols, monitoring, access control, observation, documentation, and appropriate response. Complex ORC investigations generally require coordination with the retailer’s loss-prevention function and, where appropriate, law enforcement.

How can a retailer determine whether shoplifting is part of a larger pattern?

Compare incident reports, merchandise involved, locations, dates, behavior, CCTV footage, transaction data, and other relevant information. Patterns across multiple incidents can provide useful investigative leads.

Should employees physically confront shoplifters?

Retailers should establish clear procedures based on employee safety, company policy, security training, and applicable law. Employees generally should not be placed at unnecessary physical risk to recover merchandise.

Bottom Line

Shoplifting and organized retail crime are related, but they are not the same security problem.

Shoplifting may be an isolated theft involving one person. Organized retail crime can involve repeated and coordinated theft, movement of merchandise, resale activity, fraud, and activity across multiple locations or jurisdictions.

For retailers, the most effective response is not simply to increase security at the front door.

A stronger strategy combines loss prevention, trained security personnel, CCTV, inventory controls, employee training, incident documentation, cross-store intelligence, evidence preservation, and appropriate coordination with management and law enforcement.

The key is to look beyond the individual incident and determine whether the available evidence points to a broader pattern—while keeping employee and customer safety at the center of every security decision.