When an Investigator Says “I’ve Seen This Person Before,” How Long Does It Take to Prove It?

An investigator may recognize someone in store footage before they can recall the earlier incident. Checking that impression can require comparing footage, dates, and reports from several stores. That gap creates two risks at once. Real connections go unproven because checking them costs too much, and weak resemblances get treated as matches because nobody tested them properly. The goal is not faster certainty. It is a fast, disciplined way to confirm or rule out a suspected link.

This article looks at how loss prevention teams can test a suspected connection and what the evidence in recent cases shows.

What makes a familiar face worth a second look?

Picture a familiar situation. An investigator reviewing footage of an afternoon theft stops on a frame of a man filling a bag at the fragrance counter. Something about the way he checks the aisle mirror before working the shelf is familiar. Not from this store, maybe from a different location or a different banner in the same company, maybe from a case that closed without an identification. The investigator cannot say where.

What follows is not a database query. It is hours of pulling old case folders, checking dates against memory, calling a colleague at another store, and scrolling through incident reports that were never built to be searched this way. The hunch may be right. It may also be two different people who look alike. Settling that question quickly enough to matter, on a case that may not yet look serious, is a core part of loss prevention work.

Why memory is the only index

Incident reports are typically filed by store, case number, or region. They rarely treat “this person” as a lasting record that carries across filings. Someone who gives one false name at one location and another elsewhere produces two records with nothing in common. Physical descriptions are free text, written differently by each reporter. Photos, when kept, sit in a folder attached to a single incident.

The problem is growing in importance. In its 2026 report on retail theft and violence, the National Retail Federation found that half of the retailers it surveyed reported an increase in repeat offender activity.¹ That is exactly the pattern that rewards cross-case recognition.

Criminology has a name for what the investigator is trying to do: crime linkage, the practice of deciding whether separate offenses were likely committed by the same person by comparing behavior and method. A 2007 review of the evidence by Jessica Woodhams, Clive Hollin, and Ray Bull explains that linkage rests on two assumptions: offenders behave with some consistency across their crimes, and the differences between offenders are large enough for one person’s offenses to be distinguished from another’s.²

How store footage and photos connected retail thefts to online listings

In 2021 and 2022, surveillance cameras at several Southwest Florida retailers recorded Richard and Gail Murtaugh stealing merchandise. When postal inspectors searched the couple’s home in April 2022, they found goods that resembled items the couple had been seen taking. They also found photos on the couple’s iPads that matched listing photos from their eBay store. Each source answered a different question: store footage documented the thefts, while the photo matches connected the couple’s devices to the resale listings. In October 2024, both pleaded guilty to conspiracy to commit mail fraud.³

When a facial recognition match leads to a mistaken identification

On the other hand, the Murphy and Williams cases illustrate the risk of relying on a proposed identification without checking it against independent evidence.

Harvey Murphy Jr. sued Macy’s and EssilorLuxottica, the parent company of Sunglass Hut, in January 2024. His lawsuit alleges that facial recognition was used to identify him as the suspect in a 2022 armed robbery at a Houston Sunglass Hut, that a store employee then picked him from a police photo lineup, and that he was held in jail for nearly two weeks even though he was in Sacramento, California, at the time. Prosecutors dropped the criminal charges after his alibi was confirmed. The cited report describes Murphy’s allegations and does not report a final ruling in the civil case.⁴

In April 2026, the American Civil Liberties Union described how Kimberlee Williams, an Oklahoma grandmother, spent a total of six months in jail after Maryland police mistakenly identified her as a suspect in a series of fraudulent bank withdrawals. According to the ACLU, a bank’s financial crimes investigator circulated surveillance images to an email list of police and private investigators; someone on the list ran them through facial recognition and sent back her name as a purported match. The ACLU called her “the fourteenth person known to be wrongfully arrested due to the technology’s failures.”⁵

The lesson is not that recognition, by a person or by software, is worthless. It is that a resemblance is a lead to be tested, not a conclusion to act on.

Confirm or rule out, quickly

Before linking two incidents to the same person, document what supports the connection and what could rule it out. Check a suspected connection across stores, cases, and aliases against the structured details investigators already collect: names and known aliases, vehicles, associates, timing, merchandise targeted, locations, and the behavioral details in incident narratives. Making that comparison fast does not remove the human decision at the end. It means the hunch is tested against the record instead of disappearing into a stack of folders, or being accepted on the strength of a match nobody can explain to a prosecutor.

That is the work Hubstream’s theft and asset loss recovery solution is designed to support. It lets investigators link people, vehicles, and incidents across cases and locations, and surfaces possible connections for a person to evaluate. It does not decide who someone is. It puts the relevant earlier cases in front of the investigator who has to make that call, along with the evidence for and against.

Practical takeaway

Measure how long it takes your team to confirm or rule out an “I’ve seen this before,” and set a standard for what counts as confirmation before a link shapes a detention, referral, or charging recommendation. Then make sure the details that make linkage possible, such as aliases, vehicle plates, associates, and method, are captured in fields that persist across cases rather than only in free-text narratives.