Fragrance Counter
Inside the display base
The #1 ORC target across department and beauty retail. When the counter gets cleared, the node has the device cluster of everyone who was standing at it.
ORC target · grab-event log
Retail & Loss Prevention
Three people walk in.
Two distract.
One clears the shelf in 11 seconds.
Your cameras catch the silhouettes. They don't catch the phones in their pockets. Digital Tripwire logs every device on the floor at the moment of the grab. Same crew hits another store next week. Same MAC addresses. Now they're a pattern.
$112B
Annual U.S. retail shrink
$8B+
Organized retail crime losses
28%
Of shrink is employee theft
11s
Avg. flash mob grab duration
The Problem
Cameras catch faces.
They can't catch patterns.
A crew clears your fragrance counter, your electronics endcap, your designer handbag wall. They wear hoods. They wear masks. The camera captures the event but not the identifiers. You file the report, the footage goes into the queue, and a month later the same crew hits the next store in the chain. Then the next. By the time anyone connects the cases, the inventory loss is already six figures.
Cameras were built to record, not identify. Faces can be hidden. Phones cannot. Every member of every crew that walks into your store is broadcasting MAC addresses from their phone, smartwatch, and earbuds. Those identifiers are the actual evidence. Digital Tripwire was built to capture them.
The Solution
Every display logs who was there.
Digital Tripwire nodes hide inside high-value display fixtures: the fragrance counter, the electronics endcap, the locked cabinet, the cash wrap, the back-room stockroom door. Customers see nothing. Staff sees nothing.
When a node detects motion or proximity, it scans every Bluetooth and Wi-Fi device within 10 feet. MAC address, signal strength, timestamp. Uploaded over LTE-M cellular, independent of your store network. When the same crew hits store #2 next week, the system flags the repeat MAC immediately.
- Cross-store MAC pattern matching for organized retail crime
- LTE-M cellular, independent of store Wi-Fi or POS network
- Tamper-evident encrypted log, layers on existing camera and EAS
Placement Guide · Interactive
8 spots that cover
every loss vector.
Strategic node placement covers the high-shrink zones that drive the majority of dollar loss. Nodes hide inside displays, behind nameplates, and on the underside of fixtures. Nothing customer-facing changes. Tap a node to see what it protects — or run the demo and watch an 11-second grab get logged.
nodes sleep until touched · or tap one
SENSOR NODE
Floor event log● LIVE
✓ 5A:C9:E1:44:B2:07 logged at 3 displays · 11 seconds · cross-store match: 2 prior locations · ORC packet exported
Electronics Endcap
Inside the fixture
Phones, accessories, and tech grab targets. High resale value, small form factor, and gone in seconds.
Grab target · resale-driven theft
Locked Cabinet
Behind the back panel
Logs every staff override and customer access. The cabinet is locked, which means every opening is deliberate and attributable.
Override log · staff attribution
Cash Wrap
Under the counter
Register cash, returns, and gift card activity. The shift-change window is where the register and the apron meet.
Register event · gift card fraud
Stockroom Door
Inside the door frame
Every staff and after-hours entry. Roughly a quarter of shrink walks out with a badge, and it usually walks out through here.
After-hours entry · internal shrink
Designer Display
Inside the handbag wall or jewelry case
High-dollar grab target. One armful is a five-figure loss, which is exactly why crews route to it first.
High-dollar target · crew route
Back Door
Inside the receiving frame
Shipping, returns, and after-hours. The door that is supposed to be closed is the one worth logging.
Receiving chain · after-hours
Returns Counter
Under the desk
Refund fraud, return drop-off, and exchange events. The device that returns stolen goods is often the device that took them.
Refund fraud · exchange event
Organized Retail Crime
Same crew. Same phones.
Different store.
Now they're a pattern.
Organized retail crime is not a series of isolated events. It is the same small group of people running the same routine across multiple locations in your chain, then across your competitors, then back to the original store six weeks later. Cameras at each location capture each event in isolation. They have no mechanism to connect them.
Digital Tripwire connects them automatically. When a MAC address logged at your downtown fragrance counter reappears at your suburban location two weeks later, the system flags it. Across multiple stores in the region, you have a documented crew, a documented route, and forensic evidence your LP coordinator can hand to a regional ORC task force or a federal investigator.
- Cross-store, cross-region MAC pattern matching
- Repeat-offender alerts within minutes of re-entry
- Cooperative network: opt-in cross-retailer pattern sharing
- Built for chain-wide and franchise deployments
Cross-store pattern · device cluster 5A:C9:E1:44:B2:07 · 6-week window
MATCHING
Store #114Downtown · Mar 04
Store #207Northgate · Mar 19
Store #061Riverside · Apr 02
Store #114Downtown · return · Apr 16
⚑ Same device cluster · 4 grab events · 3 stores · 43 days · returned to Store #114 — a documented crew and a documented route, exportable to a regional ORC task force.
Internal Shrink
Roughly 1 in 4 dollars lost
walks out with a badge.
Industry surveys put internal theft at roughly a quarter of total retail shrink. Employees with stockroom access, override authority, and backdoor knowledge of the camera blind spots. The grab happens in the receiving area, the locked cabinet, the cash wrap during the shift change. Cameras show them in the room. They cannot show what walked out under the apron.
Digital Tripwire logs every device present at every high-value display, every override, every after-hours entry, every refund event. When the cycle count comes up short, you have a device-level record of who was within proximity at the moment of the loss, cross-referenced against time clock and POS data.
Prosecution & Civil Recovery
From "we saw someone"
to "here's the evidence."
Prosecutors decline retail theft cases when the evidence is a grainy camera still and a missing inventory line. They take cases when the evidence is a hash-signed forensic record showing the suspect's device was within ten feet of the display at the moment of the loss, and the same device was logged at three other stores during the prior month.
Digital Tripwire exports a prosecution-ready evidence package: encrypted log, hash signatures, device list, timestamp range, cross-store correlation, chain-of-custody documentation. The same package supports civil recovery actions, store ban databases, and ORC task force submissions.
EVENT #8545
triggerheartbeat
devices3
time02:14:07Z
sha256: a91f…c27e
→
EVENT #8546
triggermotion
devices7
time02:31:44Z
prev: a91f…c27e
sha256: 4be2…91aa
sha256: 4be2…91aa
→
EVENT #8547
triggertaken
devices2
nearest4 ft · -35 dBm
prev: 4be2…91aa
sha256: f30c…d881
sha256: f30c…d881
→
EXPORT
formatCSV / JSON
custodyverified
integrity✓ intact
chain of custody: complete
AES-256 encrypted before transmission
Hash-chained, tamper-evident logs
Court-ready chain of custody export
Validated by former FBI, prosecutor & judge
Expert Validation
What actually holds up
in court?
We asked former FBI forensics investigators, federal prosecutors, and family court judges. They'd never seen BLE proximity data used as evidence. Until now.
Nizar Balil
Former FBI & Interpol Digital Forensics Investigator. 20+ years in digital evidence analysis and courtroom testimony.
VERIFIED EXPERT
Lisa Pyle
Former NYC Criminal Prosecutor & Federal Ethics Attorney
VERIFIED EXPERT
Marquis Jones
Former Family Court Judge & Deputy Attorney General
VERIFIED EXPERT
The Difference
Cameras & EAS vs.
Digital Tripwire.
Capability
Digital Tripwire
Cameras & EAS
Identifies who, not just what
✓
—
Defeated by hoods, masks, hats
No
Yes
Cross-store pattern matching
✓
—
Works without store Wi-Fi
LTE-M cellular
Requires network
Documents internal shrink
✓
Limited
Tamper-evident from the floor
✓
DVR can be wiped
Court-admissible export
CSV / JSON + hash
Varies
ORC task force ready
✓
—
Retention
Cloud, indefinite
Typically 30–90 days
Retail FAQ
Common questions.
No. Digital Tripwire is a forensic evidence layer that runs on top of existing loss prevention infrastructure. Cameras, EAS pedestals, and POS exception reporting all stay in place and continue to do what they do well. Digital Tripwire fills the gap they cannot fill: device-level identification of who was actually present at the moment of a loss, and cross-store pattern matching for organized retail crime.
The system captures MAC addresses, signal strength, and timestamps. It does not capture identity, content, location history, or any personal information. This is functionally identical to the proximity logging retail Wi-Fi analytics already perform, and to the in-store traffic counting most large retailers already deploy. Standard signage and policy disclosures cover the use case. The data has practical investigative value only when correlated with a loss event, not as general customer surveillance.
Each node logs the MAC addresses of devices in proximity at the time of an event. When the same MAC reappears at another store in your chain, the system surfaces the match in your LP dashboard with the timestamp range, location pair, and event correlation. For franchise networks and cooperative retailer groups, opt-in cross-retailer matching is supported through hashed MAC sharing, so partners can flag known crews without exposing raw data.
Modern phones do randomize the MAC address they broadcast to unknown networks, but in proximity scanning the device still emits identifiable beacons, and most people carry secondary devices — smartwatches, earbuds, fitness trackers — that emit consistent identifiers. Pattern matching is built around the full device cluster a person carries, not a single MAC. The combination of multiple device signatures plus temporal correlation produces a forensic-grade identifier even where a single phone rotates its MAC.
Enterprise deployments are designed for chain-wide rollouts. Each store gets a hub and a standard node kit sized to the format: small format, big box, department, specialty. Hubs auto-provision over LTE-M on first power-up. No store-level IT involvement required. Most pilots are 5-10 stores for a 60-day evaluation, then a phased rollout across the chain.
Yes. The forensic export package is designed specifically for handoff to ORC task forces, federal investigators, and prosecutors. Each entry includes a hash signature, capture timestamp, and chain-of-custody metadata that holds up to evidence standards. Many regional ORC alliances are actively building shared device-pattern databases, and Digital Tripwire is built to feed that ecosystem with the consent of the retailer.
Pilot Digital Tripwire
Your shelves deserve
a witness.
Enterprise pricing scaled to store count. Pilot 5-10 stores in 60 days. Cross-store pattern matching, ORC-ready evidence packages, prosecution-grade chain of custody.
Request a Pilot