What Can Loss Prevention Teams Learn From Incidents That Never Met the Threshold for Investigation?

The value of stolen merchandise can affect how a theft is charged. For a loss prevention team, whether the incident connects to an earlier theft is a separate question. When a retailer uses loss value to decide which incidents to investigate, a small theft may be filed before anyone compares it with reports from other stores. Several states allow related thefts to be combined for charging, but someone first has to recognize the connection.

This article explains how incident-by-incident triage can obscure evidence of organized activity, how aggregation laws respond to it, and what loss prevention teams can do with the incidents they currently file and forget.

Thresholds filter for charging, not for pattern

In California, theft of property worth $950 or less is generally petty theft and punishable as a misdemeanor, while theft above $950 is grand theft.¹² Federal law also covers knowing transportation of stolen merchandise worth $5,000 or more across state or national borders, and knowing receipt of such goods after they have crossed a border.³⁴ These lines shape what a prosecutor can charge, while retailers set their own thresholds for deciding which incidents receive further review.

Consider a hypothetical crew that takes $600 of merchandise from each of eight stores in a region. At a retailer that reviews each loss separately, all eight thefts might fall below its internal investigation threshold. Taken together, the losses total $4,800. The detail that connects two stores may be easy to miss when their reports are reviewed separately.

The law already treats small thefts as potentially one case

The clearest sign that small incidents can carry a pattern is that legislatures have written statutes to reassemble them.

Washington’s organized retail theft law allows a series of thefts committed by the same person from one or more stores over a period of 180 days to be aggregated into one count, with the combined value determining the degree of the offense. Under that statute, a cumulative value of at least $750 but less than $5,000 is second-degree organized retail theft, a class C felony.⁵ If the same person committed all eight thefts within 180 days, the $4,800 total would fall within the second-degree range.

North Carolina makes it a felony to conspire with another person to steal retail property from retail establishments with the intent to sell, transfer, or possess it for monetary or other gain, among other conduct, when the property’s value exceeds $1,500 aggregated over a 90-day period.⁶

California has moved the same way. A 2024 law, AB 2943, clarified that the value of property taken in distinct but related acts, including acts against multiple victims or in other counties, can be aggregated to charge grand theft when they share a common intent and plan and the total exceeds $950.² Proposition 36, approved by voters in November 2024, added a broader provision allowing the value of property stolen in multiple thefts to be aggregated to determine the degree of theft without having to prove a common plan.⁷⁸

At the federal level, the Combating Organized Retail Crime Act would add an explicit 12-month period for aggregating $5,000 or more in qualifying stolen merchandise under the federal transportation and receipt statutes.⁹ Existing federal law already provides for aggregation in certain circumstances.¹⁰ The House passed the amended bill on May 12, 2026.¹¹ The Senate referred it to its Judiciary Committee on May 13.¹²

The state statutes give prosecutors the authority to combine incidents. They do not identify which incidents belong together. That still depends on an investigator noticing that several scattered thefts share an offender, a vehicle, or a method.

Recognition is the hard part

The recognition problem is long-standing. In a 2011 review of organized retail crime, the Government Accountability Office described how law enforcement and retailers had set up regional information-sharing networks to help identify links between connected retail theft cases. Officials from four law enforcement agencies told GAO that linking thefts across jurisdictions was often essential to getting an organized retail crime case considered for felony prosecution.¹³ The networks exist because individual incident records, kept in separate systems, do not reveal the connections on their own.

This raises a question for programs that triage strictly by incident value. Could some below-threshold incidents be parts of a larger case, recorded one at a time before anyone has assembled them? An early clue might be the same vehicle seen at two stores a week apart. A distinctive method or a shared resale channel could also warrant a closer look.

None of this means every minor incident deserves a full investigation. The issue is what happens to a minor incident after it is logged.

Treat minor incidents as information to compare

A more useful standard leaves the investigation threshold where it is and changes how minor incidents are recorded. Instead of closing as standalone reports, each incident’s key details, such as offender description, vehicle, method, location, and any resale information, are captured as structured data that can be searched across every other incident, whatever its value. Recognizing a pattern then does not depend on one investigator happening to remember a report from another store three months ago.

Hubstream’s theft and asset loss recovery solution supports this approach. It records people, vehicles, locations, and methods as linked entities, so an investigator can ask one question across all incidents regardless of value or classification and see which ones share details. Whether those incidents amount to an organized case, and whether to refer them under an aggregation statute, remains a judgment for the investigator and the prosecutor.

Practical takeaway

Learn the aggregation rules in the states where you operate, including any time and value requirements. As a practical starting point, review 90 to 180 days of below-threshold incidents in one region for shared vehicles, descriptions, methods, or resale channels. If you find a cluster, check what else connects the incidents and which state requirements apply before deciding whether to refer them together. If you cannot run the check easily, you will have found a gap to address.