Organized retail crime (ORC) is not shoplifting. It is a coordinated criminal enterprise, with ringleaders, booster crews, fencing networks, and money laundering, that can strip a store of $2,000 to $5,000 or more in merchandise in a single hit. U.S. retailers reported $112.1 billion in losses from shrinkage in 2022, and ORC represents a disproportionate share of that figure. The question for retail operators is not whether ORC is a threat but how to respond to it.
This guide breaks down how ORC operates, what a layered prevention strategy looks like, and where professional security guards fit in.
What is organized retail crime?
Casual shoplifting is one person concealing one item for personal use. Organized retail crime is structurally different: a coordinated network targeting specific merchandise categories for resale through legitimate-looking channels.
The National Retail Federation defines ORC as large-scale theft of retail merchandise for resale or redistribution. What separates it from ordinary theft:
- •Multiple participants operating in coordinated roles across the same incident
- •Targeted merchandise, products easy to resell: cosmetics, over-the-counter medications, infant formula, electronics, apparel, and liquor
- •Repeat targeting of the same store or category across days or weeks
- •Professional execution with distraction tactics, concealment tools, and rehearsed exits
- •Downstream resale through online marketplaces, flea markets, or underground fencing networks
A single ORC crew can hit multiple locations in a region in one day, moving stolen goods up the chain within 24 to 48 hours.
How ORC networks operate
Understanding the structure helps you design a response. Most networks share a common hierarchy:
Ringleaders
Ringleaders identify vulnerable locations, map merchandise value, and coordinate timing. They rarely enter a store. They receive the bulk of the proceeds and carry the lowest arrest risk.
Boosters
Boosters execute the physical theft. They enter the store, conceal merchandise, and exit. Some work solo; many work in groups where one or two distract staff while others load up. ORC crews will travel significant distances to hit high-value stores in jurisdictions with favorable theft statutes.
Fences
Stolen goods move through fences who convert merchandise to cash. Historically this meant pawn shops and flea markets; today it increasingly means third-party listings on major online marketplaces. The NRF reports that online resale has accelerated the speed at which stolen goods are monetized, making inventory harder to trace.
Cleaners and launderers
Some operations include cleaners who remove security tags, alter packaging, or replace labels before resale. Proceeds are laundered through shell businesses, cash-intensive operations, or structured transactions.
The three most common ORC tactics
Flash mob grab-and-run
A coordinated group enters simultaneously, often during peak traffic, overwhelms the floor, grabs high-value merchandise, and exits before staff can respond. These events are designed to be over in under two minutes. Speed and volume, not subtlety.
Booster crew concealment
A smaller, more methodical approach: two or three individuals work the floor, with one or more acting as distraction (asking staff questions, blocking sight lines) while others conceal merchandise in lined bags designed to defeat EAS (electronic article surveillance) systems. This tactic is harder to spot in real time and favored for higher-end merchandise.
Distraction and switch
Common in jewelry, cosmetics, and electronics: a distraction gets a staff member occupied while a second person swaps or pockets merchandise. Often executed by a pair or trio with a pre-established exit route and waiting vehicle.
Prevention strategy: the layered approach
No single countermeasure stops ORC. What works is a layered system where each element covers the gaps in the others.
Layer 1: Visible uniformed guards
Deterrence is the most cost-effective lever in ORC prevention. A uniformed guard at the entrance changes the risk calculus for a booster crew before they ever enter. ORC operations are businesses that minimize risk. A store with visible guard presence is a harder target.
Uniformed guards at Calvis average around $29.60/hr for unarmed posts. For a 12-hour retail shift, that is a fraction of the cost of a single successful ORC hit.
Layer 2: Plainclothes loss prevention
Uniformed guards deter; plainclothes LP detects. Plainclothes officers move through the floor as ordinary shoppers, watching for the behavioral signals of ORC: group coordination, deliberate distraction of staff, bag manipulation, and unusual movement toward exits.
The combination creates an environment where the crew cannot know who is watching.
Layer 3: Entrance and exit control
Controlling the flow of people in and out is underrated as an ORC countermeasure. Specific practices:
- •Receipt checking at exits for high-value departments (electronics, cosmetics)
- •Staffed service desks near high-shrink sections to create friction
- •Single-entrance floor plans where feasible, reducing exits to monitor
- •Greeter at the entrance, acknowledged customers are harder to steal from than anonymous ones
Layer 4: High-value merchandise protection
ORC crews target specific categories because they are resalable. Protecting those categories reduces the return on a hit:
- •Locked display cases for electronics, cosmetics, and pharmaceuticals
- •Spider wraps and cable locks for items that must stay accessible on the floor
- •Keyed merchandise dispensers for over-the-counter medications and infant formula
- •Shelf-level cameras positioned to capture faces at high-shrink sections
Layer 5: Camera coverage and license plate recognition
Camera systems do two things in ORC response: deter and collect evidence. Visible cameras communicate surveillance. Cameras at eye level, not ceiling-mounted wide shots, capture usable face images.
License plate recognition (LPR) at parking entrances is valuable for multi-store ORC patterns. A crew that hits your location on Monday may hit a competitor on Wednesday. LPR data shared across retailers has contributed to prosecutions of large ORC networks.
Layer 6: Staff training, observe, report, do not engage
Staff training is not optional in ORC response. The instruction is consistent: observe and report, do not intervene or pursue. Attempting to stop an ORC crew physically puts employees at risk, and ORC-related assaults have increased sharply as the crime category has grown.
What staff should do:
- •Acknowledge suspicious groups verbally to signal awareness ("Can I help you find something?")
- •Alert security or management immediately using a pre-established signal or radio
- •Document vehicle descriptions, license plates, and direction of exit
- •Not block exits or make physical contact
The guard handles the physical response. Staff provides intelligence.
Layer 7: Information sharing with other retailers and law enforcement
ORC crews move across stores, districts, and state lines. Intelligence siloed within one retail location has limited value. Pattern recognition across targets is what stops ORC operations.
Practical steps:
- •Participate in local retail crime coalitions, most metro markets have one
- •File police reports for every incident, even small ones; this builds case files
- •Share incident details with neighboring retailers (timestamps, suspect descriptions, vehicle information)
- •Contact your state or local law enforcement ORC task force, most states have one and actively solicit retailer intelligence
The guard's role: deterrence and documentation, not pursuit
This is worth stating clearly because misunderstanding it creates liability. Security guards in retail settings are there to deter, observe, and document, not to pursue or physically engage ORC crews outside the store.
What guards do in ORC response:
- •Visible deterrence, presence alone suppresses attempts before they happen
- •Floor presence, moving through high-shrink areas, making contact with suspicious groups
- •Incident documentation, recording descriptions, plate numbers, timestamps, and details that support law enforcement investigation and prosecution
- •Loss containment, in an active theft, guards communicate with management and law enforcement in real time
- •Witness coordination, preserving the scene and identifying witnesses after an incident
What guards do not do: pursue suspects into parking lots or off-premises, attempt to recover merchandise by force, or physically detain without clear legal authority under your state's merchant privilege statute. Every state has different rules. Brief your security provider on your expectations and confirm they align with local law.
Building an ORC response plan
An ORC response plan does not need to be complex. It needs to be specific enough that any staff member knows exactly what to do when a crew is in the building.
Core elements:
- •Pre-incident signals, a code word or radio signal that alerts security and management without tipping suspects
- •Role assignments, who calls 911, who documents, who coordinates with the guard, who handles other customers
- •Post-incident protocol, who files the police report, where evidence is preserved, how to document for insurance
- •Cross-store coordination contact list, neighboring retailers, mall security, local law enforcement ORC contact
- •Incident report template, consistent documentation useful for prosecution
Calvis-deployed guards file shift incident reports after every event. Those reports become part of your documentation record and can be shared directly with law enforcement on request.
Deploying ORC security coverage on demand
ORC threats are not evenly distributed across time. Crews tend to hit during specific windows: high-traffic periods when staff is overwhelmed, holiday seasons when merchandise value is highest, and after high-theft events at nearby locations.
Calvis lets you scale coverage in response to threat patterns without a permanent staffing contract. If your LP team has identified that your location gets hit on weekend afternoons, you can add uniformed coverage for that window. If you've had three incidents in two weeks, you can add plainclothes LP coverage for the following week while you work with law enforcement.
Coverage options:
- •Uniformed unarmed guards, ~$29.60/hr, standard deterrence post
- •Plainclothes loss prevention officers, available on the Calvis platform
- •Multi-location coordination, deploy consistent coverage across multiple retail sites from a single account
Guards are dispatched from licensed agencies, fully vetted, and arrive uniformed and briefed on your post orders. All incidents are documented.
See our guide to retail loss prevention security guards for a full breakdown of LP vs. uniformed guard coverage models.