LAS VEGAS - "Why is security so important to the vending industry? There are several reasons," said Fred Miller, president of Security Resources. "First, it's a cash-intensive business, and cash is an attractive thing to steal. Vending machines are ripe targets for thieves, who know there's money in them. There's no 'conversion' involved; when you steal money, you have money , unlike, say, stealing a television set, which you have to 'fence.'"
Miller, a vending industry veteran who serves as the National Automatic Merchandising Association's "Knowledge Resource" on loss prevention, moderated a Security Forum at NAMA's Spring Expo here. Panelists were members of NAMA's Security Committee, and included Mike Barnhill, Icon Enclosures; David Hillstrom, Security Lock Co.; Billy Irvin, Validata Computer & Research; Tom Janeway, BRW Controls; George Langdon, G&S Vending (Arvada, CO); and Bob Snoddy, Abloy Security, Inc. The session was introduced by Spring Expo chairman Tina L. Elliott, Tomdra, Inc. (Tucson, AZ).
Miller emphasized that, as vending necessarily entails a prominent risk of loss, operators must take precautions. Not only is the cost of losses high, because vending companies work on low profit margins; there also is the important issue of employee safety , "Your people are targets" , and possible liability for injury suffered in performing a job that involves carrying substantial sums of money. "So you have to train your employees well, and equip them," the moderator said.
When a vending machine is assaulted, there are losses beyond the theft of the collection, Miller continued. The operator also will lose sales until the machine is repaired, and incurs the expense of the parts and labor to repair it. In the worst case, the machine may need to be replaced.
If product is taken, its loss must be valued at retail cost; there is the restocking and merchandising cost of replacing it; and there is a loss of goodwill during the period when the machine is out of service. "Customers can find alternate sources of products they're unable to buy from your machine," Miller pointed out. "Downtime strains your customer relations, because you can't provide the service you've contracted to provide."
Finally, there is the risk of "copycat" assaults. Some people who see a vending machine that has been broken into may think the idea is an easy way to pick up some cash , or, worse, assaults may be made by vending company employees, who then will blame the unknown thief who broke into the first machine.
A calculation of the total cost of a theft, finally, must take into account the volume of sales needed to recoup the loss, Miller explained. He demonstrated that a loss of $100 from the coinbox requires $2500 in sales to make up, assuming a four percent margin; $2,000 at a five percent margin; and $1,666 at six percent. That is in addition to the other costs attendant upon damage to the machine and customer confidence.
"Think about that when you're calculating what you can afford to spend on deterrent and defensive hardware and software," the security expert urged. It also is worth thinking about in preparation for implementing practices that will minimize exposure.
Things to keep in mind include the actual siting of a machine in the location , if it is an out-of-the-way area, a prospective robber can attack it at his leisure , and the collection and service cycle, which should be adjusted to make sure that collections do not accumulate for too long a time. And equipment should be well-maintained, for a variety of reasons; one of them is that out-of-service equipment is more likely to be vandalized.
Personnel also need equipment and training, Miller explained. Everyone who works on vending machines should be identifiable as an employee of the operating company. At a minimum, they should wear ID badges; uniforms are better. Particularly brazen thieves can enter a location, claim they have come for the vending machine, and simply carry it off, relying on sheer effrontery and the average citizen's understandable lack of interest. It thus is very important that location personnel know how to recognize legitimate vending company employees; a uniform and identification badge is the easiest recognition feature.
Machines themselves should be evaluated and equipped with protective devices appropriate to their vulnerability, Miller continued. Physical security can range from a good-quality lock, in a relatively secure location, to external hasps, bars and padlocks, or entire security enclosures in very vulnerable sites. Again, the expense must be gauged against the impact of a break-in on the bottom line.
Nor does it stop there. Purely physical defenses can deter attacks by casual vandals, but good route accountability and other procedures that create an atmosphere of control are essential to guarding collections from dishonest, or merely opportunistic, vending company employees. "The occurrence of outside theft often is used as an excuse for shortages on a route," Miller reiterated. "You need methods of validating the machine's yield; you must determine whether the loss is real. It's critical to control access to the machine, the money room, and the warehouse."
A slovenly refund policy also can lead to serious shortages, the security expert added. A good starting-point is the realization that, if refunds ever exceed about one percent of sales, they almost certainly are being used to cover shortages. "Every time a refund is made, it should be followed up by a service call, and the results should be logged," Miller urged. "And never allow drivers to make refunds out of the coinbox. You must insist on the sanctity of the coinbox: no refunds and no test vends." Drivers should be issued change funds instead, and must be accountable for them.
Close and intelligent supervision also is essential to reassure honest employees and thwart potentially dishonest ones. This supervision must include frequent "field audits," conducted in advance of scheduled services; these involve precounting the collection and checking for slack practices that drivers may engage in to save time , storing the key to the bill changer in the coffee machine, for example, or even stashing collections somewhere on site. "This is lethal! Don't let them do it," Miller insisted. "If there's an attendant on location, he or she should have a safe. And if you must leave a collection in that safe, it should be in a tamper-evident bag or a locked box.
And, when a loss is reported, response must be immediate. "The timing between occurrence and follow-ups should be zero; do it now!"
Simple bad arithmetic is responsible for a surprising amount of apparent loss, the moderator explained; errors in inventory count and machine price settings should be investigated at the outset.
Lock and key control also are vital, and should be addressed by sound operating procedures. "You have to take an accurate inventory of your keys , who has them? , and keep it up to date," Miller emphasized. "Find all the 'maintenance' keys; look at each key ring and make sure that the keys on it are current, for that one route only."
Another sound practice is to remove the "shipping" locks supplied by default on new vending machines, the speaker pointed out. "These are cheap devices installed simply to hold the door shut; they're not for field use," he emphasized. "It's a bad idea to assume that it's a 'free' lock and to hold onto it. Get rid of it; destroy it, or someone's going to use it for a quick fix in an emergency."
There are a number of sound strategies that can be followed in controlling vending machine keys and locks; the important thing is to adopt one of them and stick rigorously to it.
"What will you do when it's necessary to replace a lock after an incident? Will you replace only the one that's been compromised, or replace all your locks, or replace all your locks of that particular kind? There are costs associated with each approach," Miller pointed out. "Do you want to add the protection of a padlock auxiliary to the OEM lock? And what quality of lock do you need? Some are better than others."
Everyone who has keys, including attendants and "route jumpers," must be accountable for them within the overall key control program, the security expert emphasized. And there are many issues associated with key plans that management must consider and address: are specific groups of locks to be keyed alike, or all keyed differently? Should a separate series of keys be used for the locks on bill changers? There are arguments in favor of different approaches, and those arguments should be understood in order to make a decision appropriate to each operation.
Truck theft is another major source of loss for vending companies. "Outsiders do break into route trucks; they know that vending vehicles carry cash," Miller said. "And leaving the company name off the side of the truck doesn't help; thieves will know what it is."
To make matters worse, careless or harried drivers neglect to lock the door of the truck before entering the location; and dishonest drivers steal, the industry veteran pointed out.
Good truck locks and other protective devices are well worth the cost, and their control is just as important as the control of vending machine locks. "If nobody seems to know where a lock went, be suspicious," the moderator advised. "And don't use a $1.98 lock to protect $1,000!"
Training and supervision, again, are essential to insure that drivers are following correct procedures. "They won't turn on the alarm, and then they'll report that it malfunctioned," Miller warned. "They won't look for witnesses after a theft has occurred, and they won't call the police; they say they have no time for that. You may be at fault here," the speaker emphasized. "You must have a policy. What is the duration of each stop, and exactly where is the stop? Do drivers leave the engine running? Remember, if someone steals your truck, they'll get the money too."
Miller reported that the NAMA Security Committee has held forums with operators, and one topic always comes up: how should an incident be reported to the police? What policy should the operating company adopt? "Vendors complain that it takes time, and the police may not follow up; and even if they do, someone will have to appear at a hearing, and that will take more time," Miller noted.
He asked Langdon, who is president of the Colorado Vending Council, to explain the program adopted by that organization in response to an upswing in vending thefts.
"In Colorado, we have agreed that we'll report every incident," Langdon stated. "The CVC has retained an ex-FBI agent who works for a fee. When an incident occurs, he goes to the location, takes fingerprints and looks for other evidence, writes a report , and then physically takes it to the police. He then sends us a file. Each of us therefore can say, 'Our company does its investigations through an outside source.'"
An operator in the audience wanted to know how many arrests have resulted from this program.
"We've had 26 arrests in 10 months," Langdon replied.
"Has there been a noticeable drop in thefts?" another participant inquired.
"Yes; in some cases, we've chased the thieves out of town," the CVC president said. "But remember: they're now somewhere else! So be ready. And they will come back, so we're ready."
If an investigator is available to take fingerprints, it is necessary for the operators in the program to fingerprint everyone in their companies, Langdon explained, in response to another question. "Remember: you must do everyone in your organization , you can't discriminate at all," he warned. "After you've done that, set up a file."
In Colorado, it is a felony to break into a vending machine, Langdon noted. Thus, a thief faces a minimum jail sentence of one to four years, and a fine of $1,000 to $10,000, if convicted. These penalties may be lessened for a first offense. They are a valuable deterrent.
"We say, let's change the laws in every state so vending machine theft is a felony everywhere," he emphasized.
An audience member reported that the soft drink association in Arizona also has hired an investigator to work with police departments when a theft occurs. "They just don't like to fill out forms," the seminar participant said. "We have a standard form, and all the police departments have agreed to its use."
Good record-keeping is the responsibility of every operator in a program of this sort, Langdon told the audience. It also is essential that the company has published procedures, and can demonstrate that they are being followed. "If you ever go to trial, the defense attorney will ask who has access to keys, and will try to show that everyone has access to them, so anyone could be the thief," he instanced. The only successful response is to show that a good key control program was and is in place, and that the whereabouts of each key was and is known.
"What's more, if you do hire a private investigator, remember that he is acting for you; he's your agent, and you're responsible for his conduct," the CVC president added. "So be sure to consult an attorney when planning a program like this."
A question that NAMA members often ask Miller in his capacity as a "Knowledge Source" consultant for the association is, "How do we harden the target?" the moderator explained. He asked the panelists for suggestions.
"A lock is not just a lock; it's a number of things," Snoddy replied. "It's one of a number of investments you can make to 'harden' your equipment. Half of all the calls we get from operators take the form, 'I wish I'd listened,'" he said. "Remember that an $8 lock isn't a bargain if it costs you $500!"
And lock design is not the entire story. "Who has key blanks, and where can they be obtained?" Snoddy asked. "Many operators can't account for all their keys." He pointed out that law enforcement, by its nature, is "reactive," able to act only after an incident takes place. "You can be proactive, by careful key control and good rekeying procedures," he emphasized.
Icon Enclosures' Barnhill reported that he is an operator as well as a manufacturer of vending machine enclosures. "How do you 'harden' an account? In stages," he advised. "Thieves are lazy; your objective is to make matters as difficult as possible for them. Look at each location, and try to set up layers of security as needed: first locks, then alarms, and finally enclosures. Never make a target easy."
"And remember, without good key control, the finest lock in the world won't help you," Snoddy added.
Miller pointed out that every coin-operated industry has a theft problem: laundromats, payphone operators, even the municipal authorities responsible for parking meters. "So if you have a problem, it can be worthwhile to ask these others whether they have one too," he suggested. "Can you share information?"
gauging the threat
An audience member asked Miller which theft is greatest: internal pilferage, surreptitious entry (as by "key gangs") or outright assault.
"I say, internal theft," Miller replied. "And I say, you must know what your losses are before you can stop them."
Another participant wanted to know whether there is an industry average for shrinkage.
"No," Miller replied. "But I can tell you what your goal should be: zero. There is no 'acceptable' level of loss. If your people know that you'll 'accept' one percent, or whatever, they will meet your expectations!"
Security Lock's Hillstrom reported that his company once investigated a machine that had been attacked with a cutting-torch. "What we found was that there were no melted plastic bottles inside the cabinet," he recalled. "And there was no sign of charred currency. Was it an inside job , or was the machine placed somewhere and never refilled, so someone got angry and just torched it?" Vandalism may not always entail theft, he pointed out; and sometimes the operator contributes to provoking it.
"Are electronic locks worthwhile?" a seminar participant asked.
"Sure they are," Abloy's Snoddy said. "If it works, and if you can afford it. Like everything else, you have to look at the return on your investment. It isn't a universal solution; you still need controls, and you still need good management."
Speaking from the audience, Medeco Security Lock's Al Ritchey explained that Medeco developed an electronic lock for payphones more than a decade ago , "When they were where you are now," he said. "At present, these locks are being applied to parking meters, and they are beginning to enter the vending industry.
"The payphone operators wanted payback on the locks in three years," the Medeco executive recalled. This goal was met, with average payback in two to three years.
Another audience member asked the panelists what approach should be taken with the route driver after a shortage has occurred.
Validata's Irvin pointed out that this is the area in which security overlaps with overall tight management of accountability. Equipping drivers with handheld computers and making sure vending equipment is able to upload transaction data to those route computers over a DEX connection provides precise information on the money inserted and the products vended. Accountability is greatly enhanced, so honest drivers are vindicated and potentially dishonest ones are deterred. Thus, the driver and the supervisor can work together to determine what actually happened.
Langdon noted that, for operators without automatic data collection and retrieval, the problem is very real. "We've come up with a lot of ideas, and our lawyer doesn't want us to implement many of them," he said. "But you can do this: make up a 'standard discharge form' stating that you will agree not to prosecute a driver who's caught stealing, if he in turn agrees to certain things."
Another possibility, he suggested, is setting aside a small percentage (perhaps half of one percent) of revenue in a sort of profit-sharing savings account to benefit the employees. The proceeds would be reported periodically; and if a driver came up short, he would be informed that the shortage would have to be made up, and that would affect his savings account.
"Most of us are on computers," an audience member said. "When someone comes up short, I pull up the computer record, and I've found that many of those shortages are entry errors, which very well may be my fault. So I call them in, and we find out."
"Right," Miller agreed. "When you see a shortage, don't immediately think, 'He's stealing!' He may be; but maybe not. Look for other explanations as well. Call him in; explain that you have a problem; and invite him to work through it with you.
"And always keep records," he urged. "Whatever you wind up doing with him, you're going to have to document it."