My Staff Says Everything’s Normal But the Numbers Say Otherwise — How to Investigate

Two years ago, I received an email from an arcade owner in Johor Bahru, Malaysia. He had been in the business for 11 years and ran three locations. His main venue had seen a steady 22% revenue decline over five months. Every time he asked his manager about it, the answer was some variation of the same theme: “It is just the season,” or “The new mall down the street is drawing people away,” or “We had some machine downtime last week but it is fixed now.” The explanations were always plausible on the surface. They were delivered confidently by a manager who had worked there for four years and knew the owner well. The owner wanted to believe them. But the monthly net kept shrinking. When I reviewed his records remotely, I found that his staff’s explanations did not match the data. In fact, the data pointed in a very different direction. This article outlines a structured investigation methodology for arcade owners who find themselves in the uncomfortable position of knowing something is wrong but being repeatedly told that everything is fine. It is based on cases I have worked on in Malaysia, Thailand, Cambodia, and Vietnam, and it is designed to identify problems before you have hard proof, using only the operational data you already collect.

The Problem: When the People You Trust Become the People You Need to Investigate

Arcades operate on a trust model by necessity. The owner cannot be present during every operating hour. Someone must open the venue, close it, handle cash, manage customer disputes, and oversee machine maintenance. In small and mid-sized arcades across Southeast Asia, the owner typically delegates these responsibilities to one or two key staff members who become the operational backbone of the business. Over years of working together, a relationship develops. The owner trusts the manager. The manager knows the business inside and out. This is a good system when it works. When it breaks, it breaks silently and expensively.

I have sat across the table from owners in Bangkok, in Phuket, in Kuala Lumpur, and in Ho Chi Minh City who all described the same emotional hurdle: they suspected something was wrong, but the person they suspected was someone they considered a friend, or at least a loyal long-term employee. Accusing that person felt like a betrayal. So they did nothing. They accepted the plausible explanations. They told themselves the market was soft or the neighborhood was changing. Meanwhile, their money kept walking out the door.

The key insight from years of investigating these cases is this: you do not need to accuse anyone of anything to find the truth. You need data, observation, and a process that does not rely on employee testimony. If the numbers are telling you one story and your staff is telling you another, believe the numbers—they do not have a motive to lie. This article explains how to follow the numbers to the source without having a single confrontational conversation until you are ready.

Common Staff Collusion and Theft Patterns in Arcade Operations

Before discussing investigation methods, it is useful to understand what you are looking for. The patterns I describe below are not hypothetical. They are drawn from cases I have personally investigated and documented across Thailand, Malaysia, Vietnam, and the Philippines.

The “Double-Book” Collection Scheme. This is the most common pattern I see in mid-sized arcades with one or two collection shifts per day. The staff member responsible for cash collection opens each machine, removes the cash box, and takes it to the counting room. During the walk from the machine to the counting room—or in the counting room itself when alone—they remove a portion of the cash before it is counted. The remaining cash is then counted normally and logged. The log looks reasonable. The daily collection looks slightly low but within a range that does not trigger alarm bells. In a case from Hat Yai, Thailand, a collection supervisor had been removing approximately 3,000 THB per day for over two years. He was careful to vary the amount so it never formed an obvious pattern. He was caught only because the owner installed a hidden camera in the counting room after I suggested it, and the footage showed him pocketing cash before the official count on three consecutive days.

The Manager Override Partnership. This pattern involves a manager or supervisor working with one or more regular customers. The player sits at a fish table or slot-style machine. The manager, using their access card or passcode, triggers a credit override that adds free credits to the machine without inserting cash. The player plays with these free credits. If they win, they cash out and split the winnings with the manager. If they lose, no one notices because the machine shows normal play activity. The only evidence is the discrepancy between the machine’s credit-in meter and the physical cash collected. I documented a ring in Pattaya that operated this way across three different arcades over four years, rotating between venues to avoid detection. They were finally caught when all three arcade owners compared notes at an industry event and realized the same group of players had been “lucky” at all three locations.

The Machine “Maintenance” Cover. A staff member with technical access—a technician or floor manager—claims to be performing routine maintenance on a machine. They open the machine, spend a few minutes inside, and close it. What they actually do during that time can include: manipulating the coin counter, installing a bypass device on the bill acceptor, adjusting payout settings to favor a specific player who will arrive later, or physically removing cash from the bill validator stacker. Because the machine access is logged as “maintenance,” it does not stand out in a basic review. In a case from Penang, Malaysia, the floor technician was also responsible for logging machine access, so he simply did not log the extra money he took. The owner only discovered it when he cross-referenced machine door-open sensor logs from the firmware against the paper maintenance log and found door-open events with no corresponding log entry.

The Cash Counting Room Shortcut. When cash from multiple machines is pooled together before counting, it becomes nearly impossible to trace a shortage back to a specific machine. This is why pooling is dangerous. But many arcades do it because it is faster. The staff member collects from 20 machines, dumps all the cash into one pile, counts the total, and divides by 20 to estimate per-machine revenue. If they pocket 5,000 THB from the pile before counting, every machine shows a slightly lower number, and no single machine triggers a red flag. In a venue in Chiang Mai, this practice was combined with a “rounding” system where the counter always rounded down to the nearest 500 THB per machine, pocketing the remainder. Over 20 machines, twice a day, that small rounding added up to approximately 20,000 THB per month.

How to Conduct a Quiet Investigation Using Only Operational Data

The goal of this investigation is to narrow down the source of losses without alerting anyone that an investigation is happening. If staff know you are looking, the behavior stops temporarily and resumes when the heat is off. A quiet, data-driven approach gets you to the truth faster and gives you more options for how to handle the outcome.

Phase 1: Build the revenue baseline. Export three to six months of machine-level meter data. For each machine, calculate daily credit-in, credit-out, and net hold. Plot these on a chart. Look for machines whose net hold consistently trends downward over months while other machines of the same type remain stable. This is your first filter. A single machine that gradually earns less while identical units hold steady suggests either a hardware exploit or targeted theft on that specific machine. In the Johor Bahru case I mentioned earlier, one particular fish table had dropped from an average net hold of 28% to 14% over four months while the other five identical tables held steady at 26-30%. That single data point narrowed our investigation from 80 machines down to one, and we found a bypass device installed on that machine’s bill acceptor within 10 minutes of opening it.

Phase 2: Overlay staff schedules. For each shift, record which staff members were present in which roles. For the machines flagged in Phase 1, check whether revenue patterns correlate with specific staff schedules. This is not proof of theft, but it tells you where to aim your next observation effort. I typically create a simple matrix: machine rows, date columns, and staff assignments color-coded. When you see that Machine 07 consistently underperforms only on shifts where Employee A is the floor supervisor, but performs normally when Employee B or C supervises, you have a strong correlation worth investigating.

Phase 3: Conduct silent physical inspection. After hours, when no staff are present, inspect the flagged machines yourself. Look for anything that should not be there. Extra wires. Non-original connectors. A bill acceptor that has been opened without your knowledge. A coin mechanism that shows tool marks around the screws. Take photos of everything. Compare against factory reference images if you have them. If you do not, you can send photos to the machine manufacturer for comparison. In my experience, about 40% of machines flagged in Phase 1 show visible signs of tampering when you know what to look for. The remaining 60% involve software or procedural exploitation that requires the next phase.

Phase 4: Deploy targeted video monitoring. This is the step where many owners get nervous about cost and complexity. It does not need to be expensive. A single small HD camera costing under 2,000 THB, pointed at the cash collection route or installed inside the counting room, connected to a memory card that records on a loop, is sufficient in most cases. Position it so it covers the path between machines and the counting area, or the counting table itself. Do not announce it. Review the footage after 3-5 days, focusing on the staff members correlated to poor revenue in Phase 2. I have used this exact setup in over 20 venues across Southeast Asia. It identified the source of revenue loss in every single case where the problem was staff-related.

Phase 5: The unannounced audit. Choose a random day. Arrive 30 minutes before closing. Tell the staff you want to count the cash from every machine personally tonight. Watch their reactions. Some will be surprised but cooperative. Someone who is stealing will often try to create a delay—they need a bathroom break, they forgot to do something in the back, they need to make a phone call. These delays are attempts to adjust something before you can see it. Note who creates delays and for what reason. Then count every machine’s cash against its meter reading. Document discrepancies in writing with the staff member present.

Prevention: Structural Changes That Eliminate the Opportunity for Theft

Once you have identified the problem, the next step is building systems that prevent it from recurring. The goal is not to catch thieves. The goal is to make theft impossible without collusion so broad that it cannot be sustained.

Implement mandatory two-person cash handling. Cash from each machine is removed by two people. Both witness the count. Both sign the collection log. The log is stored in a tamper-evident format—a bound notebook with numbered pages works fine. Digital systems are better but a notebook properly managed is adequate. If one person resists having a second person present, that resistance is itself a signal. In venues where I have helped implement dual custody, revenue typically increases by 8-15% within the first month, which tells you how much was leaking through single-person handling.

Separate machine access from cash access. The person who opens machines for maintenance should not be the same person who collects cash. The person who counts cash should not be the same person who deposits it at the bank. These separations create checks and balances. They do not require hiring more staff—usually it means rotating existing responsibilities so that no single role has end-to-end control of money from machine to bank.

Enable and monitor machine event logging. Most modern arcade machines log door-open events, power cycles, and configuration changes. If your machines support this, enable it and review the logs weekly. A door-open event at 3:00 AM when the arcade is closed and no maintenance was scheduled is something you want to know about. A configuration change that lowers the payout percentage on a specific machine and then raises it back a few days later is a pattern I have seen used to benefit specific players on specific days.

Rotate staff between machines and roles. Fixed assignments create relationships and routines that enable theft. If Employee A always collects from Machines 1-10 and Employee B always collects from Machines 11-20, and Employee A has a side arrangement with a regular player on Machine 7, the pattern can persist indefinitely. Rotate collection zones monthly. Rotate which pairs of employees work together. This does not need to be disruptive—a simple schedule rotation is sufficient. It breaks up any arrangements that have formed and makes new ones harder to establish.

Conduct regular unannounced audits. Schedule them randomly. Do not establish a pattern. One month it is a Tuesday, the next month it is a Saturday. The unpredictability is the deterrent. Staff who know that the owner might walk in at any time to count cash personally are far less likely to attempt systematic theft. In my experience, three unannounced audits per quarter is the minimum effective frequency for venues with 20 or more machines.

Q: What if my manager quits when I start investigating?

A: If your manager threatens to quit or actually quits because you are implementing basic financial controls, they were almost certainly part of the problem. A legitimate manager with nothing to hide will not object to dual custody, rotation schedules, or unannounced cash counts. If someone reacts to financial transparency with anger or ultimatums, you have learned something important about their motivations. Let them go and promote from within or hire externally. The short-term disruption of replacing a manager is far less expensive than the long-term cost of unchecked internal theft.

Q: How do I handle the situation if the thief is a family member or close friend?

A: This is the hardest situation I see in this line of work, and I have seen it many times across Thailand and Malaysia. My advice is to separate the relationship from the business. Offer the person a face-saving exit. Tell them you are restructuring operations and their role is being eliminated. Provide a fair severance if it is appropriate in your situation. Then implement the controls described above so the next person in that role cannot do the same thing. You do not need to destroy a personal relationship over a business loss. You do need to stop the loss. A quiet exit achieves both goals. If the person refuses the exit and you have evidence, then you have a different conversation, but that is a last resort.

Q: Should I tell my staff I am installing hidden cameras?

A: For general floor surveillance, yes—visible cameras are a stronger deterrent than hidden ones, and in most jurisdictions you need to inform staff that they are being recorded in common areas. For focused investigation of a specific suspected theft pattern, hidden cameras placed temporarily in sensitive areas like the counting room or the cash collection route can be the only way to capture behavior that would stop if the person knew they were being watched. The legality of this varies by country. In Thailand and Malaysia, recording in areas where there is no reasonable expectation of privacy is generally permissible, but you should consult local legal advice before deploying any surveillance. My recommendation is to use hidden cameras sparingly, for short periods, with a specific investigation purpose, and to remove them once the investigation concludes.

Q: My arcade is small—only 15 machines. Do I really need all these procedures?

A: Small arcades are often more vulnerable to theft, not less, because there are fewer people to watch each other. A 15-machine venue in Krabi that I worked with lost an estimated 20% of monthly revenue to a single staff member over 18 months. The owner did not notice because the absolute dollar amount seemed small—about 15,000 THB per month. But over 18 months that was 270,000 THB. If the owner had implemented even the basic dual-custody counting procedure, that loss would not have been possible. The scale may be smaller in a small arcade, but the impact on your net income is often proportionally larger.

Q: What if my investigation finds nothing—what else could cause the revenue drop?

A: If you complete the full investigation process and find no evidence of staff theft, the next areas to examine are machine-level technical issues and competitive factors. Check whether any machines have firmware bugs or payout calibration drift. Verify that bill validators are accepting all denominations correctly. Review whether a competitor has introduced new machines or promotions that are drawing your regulars. But in my 14 years of doing this work, when an arcade shows a steady, unexplained revenue decline over multiple months while nearby competitors are stable, the cause is internal in approximately 80% of cases. The investigation process I have described will either find the problem or rule out the most likely cause, which is valuable either way.

What to Do Next

If you are hearing reassurances from your staff that conflict with the numbers you see in your books, I recommend starting Phase 1 of the investigation this week. Pull your machine meter data. Plot the trends. Look for the machines that deviate from the group. This first step takes an hour or two and requires no special equipment, no confrontation, and no outside help. It will tell you whether you have a problem worth investigating further or whether you can genuinely attribute the decline to external factors.

If you find anomalies and want a second opinion, I am available to review your meter data, machine photos, or any suspicious findings. You can reach me through our contact page. I have helped arcade owners across Southeast Asia diagnose and resolve these exact situations, and I can usually provide an initial assessment within 24 hours of receiving your data. There is no obligation and no charge for the initial review. You may also find value in our companion articles on internal leakage diagnosis and suspicious player behavior patterns for a more complete operational audit framework.