Retail Crime's Evolution
Shoplifting Is Down. The Retail Crime Problem Isn't.
One of the most notable findings in the National Retail Federation's latest study on retail crime initially sounds like very good news: Shoplifting incidents declined.

Retailers responding to NRF and the Loss Prevention Research Council's Impact of Retail Theft & Violence 2026 study reported an average 12.4% decrease in shoplifting incidents between 2024 and 2025. Merchandise theft incidents declined 8.1%.

But those numbers tell only part of the story.

The same research found retailers confronting increases in other forms of external theft, fraud and scams, illustrating how quickly the retail crime environment can shift when stores strengthen defenses against a particular threat.

Half of retailers reported an increase in repeat-offender activity, while 40% reported increases in ORC-related incidents and 37% saw increases in walkout or pushout theft. Phone scams, loyalty fraud and gift card theft or fraud also increased among responding retailers.

That's an important distinction for loss prevention teams.

A decline in conventional shoplifting does not necessarily translate into an equivalent reduction in overall loss exposure. Instead, it requires retailers to look at whether criminal activity is migrating somewhere else.

NRF attributes at least part of the improvement in store theft to retailers' investments in technology, employee training and other measures designed to protect merchandise, workers and customers. That suggests some of the measures implemented during the industry's surge in theft are having an impact.

But success creates its own challenge.

As controls improve at store entrances, exits, displays and points of sale, sophisticated offenders can look for weaker points elsewhere in the organization, including digital channels and the supply chain.

For modern AP teams, that makes measuring retail crime more complicated than counting apprehensions or shoplifting events.

The better question may increasingly be: Where did the loss go?  nrf.com

Retail Cyber Threats
Retail Cyberattacks Are Moving Beyond Payment Cards
For years, discussions of retail cybersecurity frequently centered on one particularly valuable target: payment card information. The threat environment has changed.

Retail findings in Verizon's 2026 Data Breach Investigations Report show attackers increasingly pursuing something much broader — retailers' internal corporate data.

Verizon analyzed 997 retail security incidents, including 806 confirmed breaches. The number of retail breaches nearly doubled from the previous dataset, while internal data was compromised in 84% of breaches. Credentials were compromised in 26% and secrets in 20%.

The findings reflect how much the digital footprint of a modern retailer has expanded.

Retail organizations now operate interconnected networks touching inventory, customer accounts, e-commerce, supply chains, workforce systems, loyalty programs, fulfillment and physical stores. Valuable information and critical systems exist far beyond the payment terminal.

Attackers have adapted accordingly.

System intrusion was the leading retail breach pattern in Verizon's findings, while ransomware remained the top malware action. Exploitation of vulnerabilities accounted for 42% of initial access in retail breaches, compared with 14% for credential abuse and 9% for phishing.

That makes cybersecurity increasingly relevant outside the IT department.

For loss prevention and asset protection executives, the trend mirrors a broader evolution already occurring across the profession: Risks that once existed in separate organizational silos are increasingly interconnected.

A cyber incident can become an operational incident. An operational disruption can become a financial loss. And an outage affecting stores or fulfillment can quickly become a customer-service and reputational problem.

None of that makes payment security less important. Retailers still hold payment information and other customer data that remains attractive to criminals.

But the modern retail cyber threat is much larger than the card reader. Increasingly, attackers are targeting the infrastructure and information that allow the entire retail organization to function. verizon.com