In June, an assistant manager at an Applebee's in Boardman, Ohio took a call from someone claiming to be corporate.
There was an overdue fee, the caller said. It needed to be paid today. By the time the call ended, roughly $1,400 had left the building: cash from the safe plus the manager's own money, fed into a Bitcoin ATM at a gas station through a QR code the caller supplied.
Nobody broke in. Nobody stole merchandise. An employee followed instructions from a voice that sounded like authority.
This edition is about the threat that tops your industry's own survey, has no reliable number attached to it, and is solved by a control that costs almost nothing.
What the survey actually says
NRF's Impact of Retail Theft & Violence 2026 asked senior LP executives at 66 retailers which threats increased. Phone scams led the list:
Phone scams: 69% of retailers reported an increase.
Loyalty fraud: 51%.
Repeat offenders: 50%.
Gift card theft or fraud: 42%.
ORC incidents: 40%.
The 2025 edition had phone scams at 70%. Two years running, the most widely reported rising threat in the survey is one that never touches a shelf.
Read the number correctly. 69% is the share of retailers that said scams went up. It is not a 69% increase in scams. The same report measures shoplifting a different way, as an average change in incident counts, down 12.4%. At least one outlet headlined it as a "69% increase." Putting the two side by side compares a headcount of opinions with a count of events.
The number that does not exist
Here is what the industry knows about losses from phone scams aimed at its own stores.
At an NRF session in 2021, retailers that pooled their data reported 170 successful attempts and more than $460,000 in losses, about 90% of it through prepaid cards. The presenters said it understated the problem.
That is the most recent pooled figure I could find. Five years old, from a handful of companies.
The federal data does not fill the gap. The FTC recorded nearly $1 billion lost to business impersonators in 2025, but that is consumers being scammed by people pretending to be businesses, not businesses being scammed by people pretending to be their bosses. The FBI's 2025 internet crime report logged $389 million in losses through crypto ATMs, the exit Boardman's caller used, without separating store employees from anyone else.
So the threat most retailers flag has no loss line in most P&Ls. It lands in cash over-and-short, in a safe count variance, or nowhere.
The same attack, scaled up
The store version takes a safe. The corporate version takes the company.
In April 2025, attackers got into Marks & Spencer by impersonation through its IT help desk, according to what its chairman told a parliamentary committee. M&S guided to a profit impact of about £300 million. Co-op, hit in the same wave, reported a £206 million revenue impact.
The CISA and FBI advisory on Scattered Spider, the group widely reported to be behind those attacks, describes the method plainly: posing as employees to convince help desk staff to reset passwords.
It is the same social engineering as the Boardman call. A trusted voice, an urgent instruction, a person with authority to act and no rule requiring them to verify. Only the target changes.
A perspective from the field
We spend millions protecting merchandise and almost nothing protecting the authority of an instruction.
Any store manager can move cash on the strength of a phone call, and in many chains there is no rule that says they must hang up and call back. That is not a training gap. It is a process gap, and process is the one thing LP actually controls.
Why training will not fix it
The default response is awareness training. The evidence is thin.
A University of California San Diego study followed 19,789 employees over ten months. Annual security awareness training produced no significant effect on whether people fell for simulated phishing. Embedded training reduced failures by about 1.7 percentage points. That study was email, not phone. Controlled studies of phone-scam training are smaller still and, in the one I found, not statistically significant.
The cross-sector guidance written after the 2025 retail attacks, including by the Retail and Hospitality ISAC, does not lead with training. It leads with procedure: never rely on a single channel, call back on a pre-registered, known-good number, and use a verbal password known only to employees.
That guidance was written for help desks. It transfers to stores without modification.
Three practical moves for the next 90 days
Write the callback rule before the holidays. No cash, card, safe or credential action on an inbound instruction. The employee hangs up and calls a number from an internal directory, never one supplied on the call. Publish it on one page and put it at every register and in every manager's office.
Create a loss code. Phone-scam losses should not disappear into cash over-and-short. Give them their own code this quarter, so that next year you have the number the industry does not.
Test it once. Run one authorized test call per district before peak season. Measure how many managers verify. That rate, not training completion, is your control effectiveness metric.
Closing note
Shoplifting is falling on NRF's own numbers. The threat its respondents most often report rising arrives by phone, and almost nobody is measuring what it costs.
The control is one sentence long. It does not require a vendor, a budget line or a law. It requires someone in LP to own it.
If your company tracks phone-scam losses as their own category, I would like to know how large they are relative to external theft. Reply with anything you can share, anonymized always.
Forward this to one LP or AP leader who should be reading it.
— Gabriel
One more thing: my book is free this week
From Tuesday, November 3 through Thursday, November 5 (Pacific time), the Kindle edition of my book, The Architecture of Trust: When the Contract Isn't Enough in Service Businesses, is free on Amazon.
It is not about shrink. It is about the part of this work no dashboard measures: why a client relationship survives a failure or doesn't, and what holds it together after something goes wrong. If you manage guard contractors, technology vendors or the executives who fund your program, most of it applies to you.
If you read it, an honest review on Amazon is the one thing I would ask in return.
Sources: NRF, The Impact of Retail Theft & Violence 2026 (July 30, 2026) and 2025 edition · LP Magazine, Could Your Store Managers Fall Victim to This Phone Scam? (July 19, 2021) · WFMJ, Boardman restaurant scam report (June 26, 2026) · FTC, impostor scam data release (June 15, 2026) · FBI IC3, 2025 Internet Crime Report · CISA/FBI advisory AA23-320A, updated July 29, 2025 · Cross-sector ISAC Scattered Spider mitigations (August 1, 2025) · Ho et al., UC San Diego, phishing training study (2025) · M&S and Co-op 2025 results, as reported.
The LP Brief is a weekly intelligence read for senior loss prevention and asset protection leaders. Free. No vendor noise.
Not yet subscribed? thelpbrief.com