Theft 12: Large Package Sold to Friend, Then Redeemed Against Regular Clients’ Visit

How this theft works

This is a hybrid scam that combines underpriced packages with cross‑account redemptions. A manager creates a package with a large number of service credits at a very low system price, sells it cheaply (or effectively to themselves or a friend), and then uses those credits to “pay” for services taken by regular clients who actually pay cash.

The steps:

• Manager creates a high‑credit package—say, 20 facials worth 1,000 INR each, total value 20,000 INR.

• They sell it in the system for a nominal 100 INR to a friend or a fake account, often with a phone number they control.

• Regular clients come in and pay 1,000 INR cash for each facial.

• The manager or staff bill those visits against the fake package, redeeming one credit each time, and pocket the full cash.

• Even with OTP‑based protection, if OTP goes to the fake number owned by the manager, they can confirm redemptions themselves.

The salon will eventually see a package heavily redeemed, but revenue numbers appear “normal” because each redeemed service corresponds to an actual visit; the missing piece is the cash, which never hits the system.

Real‑world illustration:

A spa offering facial packages migrated to MioSalon to gain better reporting. During the initial data review, we noticed one package code with:

• Very low recorded sale price per package (near free).

• Extremely high number of included services (15–20 facials).

• Redemption activity tied predominantly to one or two staff members.

• OTP logs where all codes were sent to the same obscure phone number.

Investigating further, the owner discovered that the branch manager had created an ultra‑cheap “staff trial” package, sold it to a friend, and then repeatedly used its credits to cover paying clients’ facials. The manager would accept cash from those clients, redeem a session from the package, and keep the money.

Potential monthly loss estimate:

Consider:

• A single large package with 20 sessions of a 1,000 INR facial (service value 20,000 INR).

• Package sold in system for 100 INR to a fake account.

• Each redeemed session covers a real client’s cash visit.

If the manager runs one such package to full redemption each month:

• Direct cash theft: roughly 20,000 INR (minus the nominal 100 INR recorded).

• Additional margin distortion: the business believes it honored a loyalty or staff‑only deal but has no matching strategic reason.

If multiple such packages or higher‑value services (for example, advanced skin treatments at 3,000–5,000 INR per session) are abused similarly, monthly leakage can quickly exceed 50,000–100,000 INR.

Table of Contents: 24 Theft Patterns Covered

Theft 1: Downloading Customer Details Before Resigning

Theft 2: Editing Bills to Reduce Value After Cash Collection

Theft 3: Cancelling Bills After Cash Collection

Theft 4: Diverting High-Value Bridal and Home Appointments

Theft 5: No-Bill or Paper-Only Billing (Cash Pocketing)

Theft 6: Stealing Prepaid Value by Redeeming Other Customers' Balances

Theft 7: Stealing Package Credits by Redeeming from Other Customers' Packages

Theft 8: Abusing Membership Discounts via Fake or Edited Memberships

Theft 9: Downloading Financial Data from Home and Using It for Planning Theft

Theft 10: Creating Custom Packages at Unrealistic Prices and Deleting the Master

Theft 11: Custom Prepaid with High Bonus, Low Sale Price, Sold to Friends

Theft 12: Large Package Sold to Friend, Then Redeemed Against Regular Clients' Visit

Theft 13: Billing a Low-Value Service Instead of the High-Value Service Actually Taken

Theft 14: Selling Products to Clients but Marking Them as Internal Consumption

Theft 15: Redeeming Unused Gift Vouchers Against Other Customers

Theft 16: Redeeming Reward Points Against Other Customers

Theft 17: Deep Discounts on Cash Bills and Pocketing the Difference

Theft 18: Under-Valuing Duration-Based Services (Recording Less Time Than Delivered)

Theft 19: Turning Off Notifications, Then Editing or Cancelling Bills

Theft 20: Printing Duplicate Copies of Existing Bills and Handing Them to Other Clients

Theft 21: Adding Fake Expenses to Past (Already Audited) Dates

Theft 22: Creating Backdated Bills to Look Genuine, Then Cancelling Them Later

Theft 23: Viewing and Extracting Customer Phone Numbers for Future Poaching

Theft 24: Online Appointment Spam to Block Staff Calendars

Want to know how each theft works in real life? 👉 Read the full article to uncover all 24 theft patterns with real-world examples and monthly loss estimates.