By Dan Cosgrove

If you are a restaurant business owner or manager, be assured of one thing: employees are stealing from you.

The National Restaurant Association estimates that internal theft from employees is responsible for 75% of inventory shortages, about four percent of total restaurant sales. Three quarters of employees steal from the workplace at least once and half steal repeatedly. Why? Because no one catches them.

Many owners and managers ignore the signs because they want to believe all their employees are honest. But the longer you let dishonest employees get away with it, the more widespread the employee theft problem will become.

Here are Six Signs of Employee Theft:

1. Have Pour and Food Costs suddenly gone up? These are determined by comparing how much you’re purchasing with how much you’re selling. (They’re a valuable tool to identify employee theft; but only as good as your recordkeeping. You must log all food and drinks, purchased or not, to make your calculations valid.) If costs suddenly go up, detailed records may point to a specific event such as a new bartender, kitchen worker or server’s arrival. (If they go down, check to see who might be on vacation!)
2. Is the cash register over or under on a regular basis? This is a sign that an employee has put money in the till without ringing up the order and has forgotten or miscalculated exactly what to skim from the register at the end of the shift.
3. Do employee tips add up? When employees give away food or drinks, they often get generous tips based on the value. Revive the old tradition of making random “Till and Tip” checks. Without warning, ask servers to count their tip money in your presence. Compare their totals to the register readings. If tips are 5%, 10%, 15 %, terrific. But 30%, 40% and 50% tips should set off alarm bells.
4. Are customers or employees telling you someone is stealing? They may notice things you can’t. Take their comments to heart. Investigate fully. Maybe they’re mistaken, but don’t count on it.
5. Do regular customers complain that prices are too expensive or inconsistent? Dishonest employees may overcharge customers and pocket the difference. You won’t see costs rise but customers will see an increase in prices. Regular customers may notice if they are being charged different prices.
6. Is there something about an employee that just doesn’t feel right? Maybe it’s a lifestyle that seems well beyond their means. Maybe they are just too eager to work the shifts that no one else wants to take. Whatever it is, trust your instincts.

If you know you have a problem, hire a Private Investigator who specializes in mystery shopping and/or surveillance. Flying under the radar, trained agents can visit your restaurant or bar to observe and record how servers are handling and recording cash transactions. They also can position themselves to observe what employees are taking out the back door. If employee theft is observed, a trained investigator can confront those involved, and nine out of ten times, get a confession.

By David F. Carr

The easiest way for small businesses to address the information security requirements imposed by credit card companies is the wrong way. I’m talking about lying and praying.

In 2004 the major credit card companies got together to define a common Payment Card Industry Data Security Standard (PCI DSS, often referred to as just PCI). They are gradually ratcheting up the pressure on merchants of all sizes to comply. Large companies, and some smaller ones that process a large volume of transactions (particularly if they’re doing it on the Web), are required to have an independent review of their processes and systems by a security professional credentialed as a qualified security assessor (QSA). Most small businesses can instead complete a self-assessment questionnaire, where they essentially grade themselves. That’s where the lying comes in. It’s not so hard to check off all the right answers (“Sure, I review my e-commerce server logs on a daily basis.”) without actually making them true.

If you’re lying, you had better also be praying. If caught, you could be fined for non-compliance, to the tune of tens or hundreds of thousands of dollars–enough to put many a small organization out of business. Expect even harsher treatment if someone hacks your systems and downloads card data you claimed you weren’t even storing.

Most of the requirements are basic security, like making sure there is a firewall between your Internet connection and any system that stores credit card numbers. Factory default passwords on your network equipment must be changed, so that no one can log on as user “admin,” password “admin.” And so on. More specifically, you’re responsible for protecting card holder data, and there’s some data you’re never supposed to store–like the full contents of a card’s magnetic strip.

Many small businesses are still under the impression that the rules don’t apply to them because they’re too small, or because they don’t conduct e-commerce. Actually, the rules apply to any business–and even any nonprofit–that takes credit card payments. You can look for ways to lighten the compliance burden, but you can’t get yourself off the hook entirely. Even if no one has yet compelled you to complete a questionnaire or conduct an automated scan of your networks, you’re still supposed to be locking down your systems.

Some businesses complain this all sounds too complicated and expensive. But they are missing the point, says Anton Chuvakin, author of PCI Compliance: Understand and Implement Effective PCI Data Security Standard Compliance. The PCI rules really represent the minimum security standards businesses must meet to be fair to their customers, who, after all, are trusting the merchant every time they hand over a credit card number. In the wake of a card security breach, a larger business might suffer from the fines, damages and adverse publicity resulting from a card security breach. By contrast, “a small business is more likely to be GONE,” Chuvakin said. “Businesses that endanger their customers really do deserve to die.”

If your organization is not equipped to handle credit card data securely, maybe you should not be handling it at all. Look for ways to shift as much of the burden as possible onto a service provider that specializes in secure payment processing. Services such as PayPal and Authorize.net let you forward customers to their websites for payment processing; credit card numbers never pass through your hands at all.

Small businesses such as restaurants that use an older generation of countertop credit card terminals may be breaking the rules inadvertently because the device stores magnetic stripe data or otherwise violates the PCI requirements. So consider upgrading to a payment device that is certified PCI compliant. Basic terminals capable of encrypting Personal Identification Number (PIN) codes and protecting other sensitive information are available for as little as $100 and might even be offered free by merchant account services trying to win your business. The PCI Security Standards Council publishes a list of approved devices. Just remember that using a compliant device is only one element of making your business compliant.

Even if you’re not storing anything explicitly prohibited, you may be storing more credit card data than you need to. Small merchants typically store a day’s worth of credit card numbers on a card swipe terminal, then process all the transactions in a batch at the end of the day. Bigger retailers may record the card numbers in a centralized database so they can track all a customer’s purchases, and so they can retrieve the number if they need to issue a refund. But do you need to retain those numbers at all?

Read the rest of this entry »