Thinking Like the Criminal: How LP Teams Outsmart Organized Retail Crime

It doesn’t always start inside the store.

A SUV idles in the far corner of a mall parking lot. Two people inside track staff movements, camera blind spots, and security sweeps. Across the lot, two “shoppers” wander electronics, counting smartphones and quietly tugging on the display cables that hold them in place. They’re not buying — they’re building a playbook.

This is organized retail crime (ORC). It’s not random or impulsive. It’s systematic, role-driven, and increasingly violent.

ORC Is Run Like a Business

Step inside one of these crews and you’ll see structure below:

They may swap jackets, use aliases, or change vehicles, but the playbook doesn’t change. The routes, the timing, and the resale model repeat like clockwork.

The National Retail Federation’s 2024 report confirms what LP teams experience daily: the average number of shoplifting incidents rose 93% between 2019 and 2023, while average dollar losses jumped 90%. Even more troubling, 73% of retailers said offenders have become more violent or aggressive.

Why Retailers Struggle to Keep Up

Behind the glass, LP managers at nearby stores spot the same suspect five times in two weeks. But on paper? It looks like five separate incidents—scattered across spreadsheets and trapped in siloed systems.

Across town, another retailer catches the same crew. But with no shared system, no one makes the connection.

By the time evidence is pulled together, the crew has already struck three more stores. Prosecutors glance at one file and see a misdemeanor — not the felony-level pattern.

The Seattle Office of City Auditor’s 2023 report flagged the same issue: fragmented data, weak coordination, and siloed systems leave investigators one step behind. When crews are planning days or weeks ahead, every gap in visibility is an open invitation.

A Real-World Example

In August 2025, California prosecutors dismantled a retail theft ring that allegedly stole $10 million in merchandise from Home Depot stores. The ring reportedly hit 71 locations across five counties, using hired boosters to steal goods and fencing networks to resell them. Authorities arrested 14 suspects and recovered more than $3.7 million in stolen property.

That’s exactly the gap most LP teams face: isolated reports that don’t get connected until it’s too late.

Walking Through a Fictional Case

Let’s walk a typical chain.

Day 1, City A:
An SUV idles outside a big-box store. Cameras record it. The footage is filed away, unlinked.

Day 3, City B:
The same SUV appears. A crew cuts display cables, grabs electronics, and leaves in under two minutes. Another “isolated” report.

Day 5, City C:
A marketplace listing appears — identical SKUs, shrink-wrap intact.

Without connected intelligence, these are three different stories. Together, they form a supply chain of theft.

Now flip the script. If the vehicle plate is matched to earlier cases or to stolen vehicle databases, if the method of disabling display locks is flagged across incidents, and if the online listing links to a known fence, the case shifts quickly. Stores nearby are alerted. Prosecutors see a felony-level pattern. Law enforcement can stage a sting before the crew arrives.

From Reactive to Proactive

To beat ORC, LP has to think the way organized criminals do:

Track behaviors, not just faces. Crews change outfits and cars, but their methods — similar timing, similar products, similar resale cadence — are consistent.
Connect every data point. Vehicles, tools, online listings, aliases — together they paint the picture of an organized ring.
Map movements. ORC crews rarely strike at random; they move in bursts. A hit in City A on Tuesday and City B on Thursday often points to City C on Saturday.
Close the prosecutorial gap. Linked evidence turns “petty theft” charges into organized crime cases that stick.

Real-world Example: Beyond Petty Theft

ORC has become one of retail’s most pressing challenges, costing chains billions each year. Unlike casual shoplifting, boosters — professional thieves — steal in volume and feed stolen goods into a distribution network that includes liquidation warehouses, pawnshops, and online marketplaces.

The New Yorker published a striking piece on organized theft in Los Angeles. In one case, police searching a bungalow found $13,000 in stolen merchandise along with weapons and drugs. In another, a cosmetics distributor secretly acted as a fence, moving millions of dollars in stolen goods.

Then there was the so-called “Karen Bandit,” who repeatedly hit jewelry counters—stealing roughly $40,000 from Macy’s and $80,000 from JCPenney—while cycling through disguises, fake IDs, and the getaway car. Investigators later discovered he had a twin brother with nearly identical features who had taken part in the crimes, making the investigation even more complex.

Obstacles for Investigators

Loss prevention teams and law enforcement agencies face a patchwork of state laws, fragmented reporting systems, and constantly evolving tactics. A theft treated as a felony in one jurisdiction may be a misdemeanor in another. Crews adapt quickly, using aluminum-lined bags, skeleton keys, and encrypted apps to coordinate hits.

Critics question whether retailers overstate ORC to push for tougher laws, but investigators argue that the bigger problem is under-reporting and disconnected data.

Building the LP Playbook

Thinking like the criminal means building your own version of their playbook:

They log security sweeps — LP should also log all security activities, inspections, and incidents to ensure accountability, track trends, and protect assets.
They test cables and alarms — LP should flag repeated tampering attempts across stores.
They change cars, IDs and outfits — Loss prevention teams should look for consistent behaviors—such as timing, travel routes, and resale patterns—that go beyond what traditional methods reveal.

Technology helps, but only if it mirrors the way ORC works: organized, connected, and proactive. Platforms like Hubstream give LP teams the ability to consolidate incidents, surface patterns, and hand over felony-ready evidence instead of scattered notes.

Flipping the Script

It still starts in a parking lot.

A criminal ring thinks they’re in control, swapping outfits, switching cars, and casing another store. What they don’t see is LP running their own playbook: every incident, vehicle, and marketplace listing already connected, mapped, and forecasted.

That’s how retailers move from reactive firefighting to proactive disruption — outthinking ORC by treating it like what it really is: a business. And the only way to stop a business is to dismantle the supply chain that keeps it running.