Most money that leaves a small shop does not leave in a dramatic way. It goes out ₱30 at a time: a voided item that was actually served, a discount for a friend, a shortage nobody can pin to a shift. Add it up over a month and it is real money, but it is spread so thin that no single moment looks wrong. Here is how those leaks happen on a shared register, and how PINs, per-sale attribution and manager approvals close them — without turning your team into suspects.
The quiet ways a counter leaks
- The unlogged void. An item is rung up, served, then voided "by mistake". The food is gone, the sale is not.
- The friend price. A discount applied at the cashier's own discretion. Sometimes generous, sometimes habitual.
- The refund nobody saw. Cash out of the drawer against an order that may or may not have come back.
- The shared login. Everyone works on the owner's account, so every sale, void and discount says the same name. When the drawer is short, there is nothing to look at.
- The drawer gap with no owner. Three cashiers across one day, one count at close. Who was on when it went short?
None of these require a dishonest employee. A tired cashier at 9 p.m. makes the same voids as a careless one. The point is not catching people. It is making each action belong to someone, and making the sensitive ones need a second pair of eyes.
Fix one: a PIN for every person
With Staff Operations, each staff member gets a numeric PIN of four to six digits. It is personal — it identifies who is working and who authorized what.
A few rules keep it honest:
- No repeated single digits, so "1111" is rejected.
- Every active staff member's PIN must be different, so two people can never share one.
- Five wrong attempts in a row lock the PIN for about five minutes, which stops guessing.
Staff set and change their own PIN from their profile, and need their current PIN to change it. An owner or manager can reset anyone's PIN without knowing the old one, so a forgotten PIN is a thirty-second fix.
Fix two: every sale belongs to whoever was signed in
On a shared register, Switch Staff hands the till from one person to the next without anyone logging out of the account. Pick your name, enter your PIN, and you are the active operator. Switching opens a session for you and closes the previous person's session on that terminal. From then on, every order is attributed to your session.
This is the fix for the shared login. The device can stay signed in to the owner's account all day, but the operator's own role decides what they can do — a cashier on the owner's phone has a cashier's permissions, not the owner's.
At the end of a shift, you hand over from Active Sessions with an optional note and your declared cash. If someone leaves without handing over, a manager can force-close the session, and the activity log records that the manager did it. The drawer gap now has a shift and a name attached, which is usually all it takes for the gap to shrink on its own.
Fix three: sensitive actions need a manager's PIN
This is the part that closes the void and the friend price. Some actions need a manager's OK:
- Voiding order items.
- Authorizing a refund.
- A register discount applied by a cashier who does not have approve permission.
- With Advanced Inventory, placing purchase orders and large stock adjustments.
When a cashier without approve permission tries one, the app does not complete it. It raises an approval request. A manager enters their PIN in place, on the same screen, and the action goes through. The cashier stays signed in the whole time — the manager only authorizes that one action, then control returns to the cashier. A manager who is elsewhere in the shop can also clear requests from a Pending Approvals queue on their own device.
Three details make this hold up:
- Approvals expire after a couple of minutes if nobody acts. The cashier can simply request again.
- A discount approval covers that one discount at that rate. A different rate needs a new approval.
- Separation of duties. For refunds and purchase order placement, the approver must be a different person from the requester. A cashier cannot approve their own refund.
You decide which actions need approval and the amounts that trigger them, per store. Under a threshold, the action goes through on its own; above it, it waits for a manager. With no threshold set, every request waits.
What this is not
It is not surveillance, and it is not an accusation. A good cashier benefits more than anyone: when the drawer is short on a day they were not on, the record says so. When a void was legitimate, a manager approved it and the reason is logged. The honest majority stops carrying the suspicion for the rare exception.
It is also not a reason to slow the line. A PIN takes a second. An in-place approval takes a manager walking over, which is exactly the cost you want on a void — enough friction that it is not casual, not so much that nobody bothers.
Two things to set up first
- Roles. For cashier and manager access to actually differ, the Roles & Permissions add-on should be on. Without it, every staff member has full access, and approvals have nothing to gate.
- The thresholds. Decide what a cashier may do alone. A small discount with no approval is fine; a void after the kitchen has fired the item is not. Write it down so the team knows the rule is the rule, not a judgment of them.
A simple routine for the owner
- Weekly: open the activity log and skim voids, discounts and refunds by operator. You are looking for patterns, not single events.
- Weekly: compare drawer variance per session, now that each session has a name.
- Monthly: review the approval thresholds. If managers are approving the same small thing fifty times, raise it. If something slipped through, lower it.
The full setup — PINs, pairing terminals, switching staff, approvals and the activity log — is in the Staff Operations overview. Fuze Store is free to start, and you can add Staff Operations when the second cashier joins.