Morning Coffee with Tracer
Awareness Disclaimer: This article explains a cash-register theft for prevention and training. Do not accuse, chase, or confront anyone based only on suspicion. Follow your business procedures and contact a manager or law enforcement when appropriate.
The vending machine at FindASpy headquarters has started returning change in nickels only.
Every purchase, no matter the price, produces a small tower of nickels. Tracer now keeps a jar of them on his desk and has stopped pretending this is temporary.
This morning, he poured a plain dark roast with one sugar, bought a snack, and counted the exact change onto the counter himself. Out loud.
“One, two, three…”
The nickels had put him in a counting mood.
That mattered later, because Tracer has seen how quickly a simple count can collapse. In Florida, he once stood in line behind a young cashier while a man ran a quick-change scam on her. Within seconds, Tracer recognized the rhythm: money changing hands, requests changing, and the numbers becoming larger and less clear.
He did not confront the man aggressively. He stepped closer and calmly told the cashier what was happening.
“Stop. Look at what is on the ledge. He has handed you the ten you already gave him and asked for the twenty back. Count the ledge before you move anything.”
The pattern broke. The man dropped the act and left.
The cashier’s biggest reaction was relief. She was not imagining the confusion, and she was not bad at her job. Someone had deliberately created a situation where normal counting became difficult.
For the moment, the nickel jar remained innocent. Probably.
The quick-change scam, also called change raising, is a theft in which a customer keeps changing a cash request until the cashier loses track of the money.
A person who uses this method is often called a short-change artist. The name is old because the technique is old. It has been used for at least a century, and it still works because it does not depend on malware, a stolen password, or complicated mathematics.
It uses attention.
The thief chooses a busy register, a small purchase, or a cashier working alone. The customer gives a large bill, receives change, and then starts asking for different bills:
Each request sounds possible by itself. Together, they create confusion.
This happens to trained employees, experienced managers, food-truck owners, bartenders, farmers-market vendors, and family businesses. It can happen to anyone, including someone who has heard of the scam before.
Recent 2026 reporting has included quick-change cases targeting small businesses on Long Island. The Royal Canadian Mounted Police has also warned businesses about the same pattern: a small purchase, a large bill, repeated exchanges, and a cashier who is pressured to move quickly.
Here is the entire method using real numbers.
A customer buys a coffee for $7.40 and hands over $20.00.
Correct change:
$20.00 − $7.40 = $12.60
The cashier counts out:
The $12.60 sits on the ledge outside the drawer.
Running total: The customer has handed over $20.00 and is holding $12.60 of the shop’s money. The drawer is correct. Nothing is wrong yet.
The customer says:
“Do you have two fives for this ten?”
The customer hands the $10 bill back. The cashier gives two $5 bills.
The customer still holds:
That is still $12.60.
Running total: Correct. The customer has merely exchanged one ten for two fives.
The customer changes the request:
“Actually, just give me the ten back and keep the fives.”
The customer hands back the two $5 bills and takes the $10 again.
The customer still holds $12.60.
Running total: Still correct.
But the cashier has now counted the same money three times. The thief has not stolen anything yet. The pressure is building.
The customer now says:
“Wait, I gave you a twenty and you gave me change for a ten. Let’s just square up. Take this back and give me my twenty.”
The customer hands the cashier the $10 bill that was already part of the change. The cashier, now confused, hands over the $20 bill.
The customer’s claim is false. The cashier already made change for a $20.
The customer walks away with:
Cash in hand equals $22.60.
The customer arrived with $20.00 and leaves with $22.60 in cash, so the customer’s cash gain is $2.60.
But that is not the shop’s full loss.
The customer also leaves with the $7.40 coffee without really paying for it.
So the shop loses:
$2.60 + $7.40 = $10.00 total loss
The drawer’s actual net movement is:
That leaves the drawer down $2.60 in cash.
Another way to check it:
So a reader with a calculator should reach the same result every time: the customer’s personal cash gain is $2.60, but the shop’s total loss is $10.00 because the coffee is gone too.
The arithmetic is simple. The crime is making the cashier lose track of which step is finished.
The customer says:
“I gave you a twenty, not a ten.”
After several swaps, the cashier genuinely may not know which bill arrived first. The cashier hands over the difference to avoid an argument.
This version requires no sleight of hand. It uses confusion and politeness.
The customer asks the cashier to count bills directly into the customer’s hand. The customer fans the money, palms bills from the back, or moves bills between hands.
This is where actual sleight of hand joins the confusion. It is also the version most likely to be visible on register cameras.
There is an after-the-fact version, too. A customer returns later and claims the cashier shortchanged them. The customer pressures staff to pay immediately because no one wants a public scene. The same tactic appears after the sale instead of during it.
Speed defeats accuracy.
A cashier is trained to be helpful. Every individual request sounds reasonable. Refusing to exchange a ten for two fives can feel rude, especially when a line is waiting.
The thief extends the conversation until the cashier looks uncertain. Then the thief pushes hardest at that exact moment.
This is not a stupidity problem. It is a designed attack on a normal human limit: working memory becomes less reliable when a person is rushed, interrupted, and required to track several changing totals.
Tracer recognized the Florida incident because the man was running a script rather than making an ordinary purchase.
The same money changed hands repeatedly. The first interruption came before the change was fully set down. The requested denominations kept changing. The numbers climbed. Most noticeably, the man watched the cashier’s face more than he watched the money.
He was checking whether confusion had arrived.
Tracer stepped forward and said:
“Stop. Look at what is on the ledge. He has handed you the ten you already gave him and asked for the twenty back. Count the ledge before you move anything.”
That one sentence restored the sequence.
The lesson was not that Tracer had sharper eyes than everyone else. The lesson was that the scam broke when someone stopped the motion and named the pattern.
Train the process out loud and rehearse it. A policy nobody has practiced often disappears during a rush.
Put the one-transaction rule and ledge rule in writing at the register. Give employees permission to slow down without apologizing. Where practical, limit breaking large bills for very small purchases.
If something feels wrong, save the receipt and record the time, register, employee, and amount. Review camera footage promptly because many systems overwrite recordings within days.
Encourage reporting without blame. A cashier who fears punishment may hide the shortage, allowing the same person to target another business. Share alerts with nearby businesses, because a short-change artist often works an entire street in one afternoon.
Do not chase or confront the person.
Write down the time, register, employee, estimated loss, and description. Preserve the receipt, register records, and video. Report the incident to local law enforcement because this is theft, not a harmless mistake.
Tell neighboring businesses what happened. Small losses are often absorbed rather than reported, which is one reason this scam continues.
For broader security concerns, FindASpy’s contact page includes a scam or security-breach reporting option.
Watch for:
Any two together means: stop, put the money down, and restart.
The thief never touched the cashier’s wallet. The thief touched the cashier’s attention.
The defense is not superior intelligence or years of experience. It is a rule and a pause.
Count once, say it out loud, and never keep going from a count you have already lost.
Back at headquarters, Tracer returns to the vending machine. It delivers another tower of nickels.
He decides the machine should be audited.
Before your next shift or cash purchase:
Tracer’s Pick: The iProtect Multi-Channel Wireless Detector helps a home or small business owner know what is transmitting in their space, though no device replaces careful judgment. If the Tracer's Pick giveaway is active on the Community Finds page, you can enter in there.
Next time, Tracer looks at the small signs that a familiar account, device, or payment request is not behaving normally, and why pausing before approval is often the strongest security tool you have.
Community Disclaimer: Please do not share passwords, full card numbers, Social Security numbers, private addresses, or identifying details about another person. Describe incidents safely and remove sensitive information.
What State are you from? Do you work a register, manage a cash business, or have you witnessed a quick-change attempt? What would your one cash-handling rule be?
Tracer reads all posts.
If you have discovered your own hidden gadget, you can upload it for the community by clicking here.
Educational content only, not legal or accounting advice. If you are in immediate danger, if a crime is in progress, or if your safety is at risk, stop reading and call 911. Laws on theft, fraud, and reporting vary by state and jurisdiction, and readers should consult a licensed attorney or local law enforcement for a specific incident. Loss-prevention policies, camera retention, and cash-handling procedures vary by business and should follow company policy and any applicable employment, union, or contractual obligations. Nothing in this article guarantees recovery of funds or a conviction. Report suspected theft to law enforcement and follow your business’s procedures.
Morning Coffee with Tracer
Morning Coffee with Tracer is written for FindASpy.com readers who want practical awareness, knowledge, and protection in everyday situations.
Your vote helps determine FindASpy Insider’s Readers’ Top Picks. One rating is allowed per reader for each article.
Today’s Coffee Conversation
Tracer shares cybersecurity stories, scam alerts, privacy tips, and investigative insights. Pull up a chair, share your experience, and help shape tomorrow’s discussion.