When the Same Suspect or Vehicle Appears Across Stores
In January 2025, an Ulta Beauty store manager in Shelby Township, Michigan, reported that three women had taken about $6,000 in merchandise. Detectives checked license plate camera records and found that the same vehicle had appeared near other Ulta stores. A sighting near Toledo gave them a specific next call to make. Ohio officers located the women and recovered merchandise from the vehicle, according to local reporting on the police investigation.12
For a regional loss prevention team, the important detail is the order of events. Investigators started with one store’s loss. Checking the vehicle against other locations widened the inquiry and brought another jurisdiction into it. Police identified suspected thefts in Shelby Township, Troy, Lapeer and Toledo. The women were charged. A sighting near a store was a lead to check against the store’s records.12
When the retailer already knows the suspect
A California investigation started from a different piece of information. In November 2025, Sephora alerted the California Highway Patrol to one man suspected of thefts across the Bay Area and Central California. Investigators tracked his plate and intercepted him on Interstate 5 in Fresno County, seizing more than 1,000 items valued at $34,827. California’s January 2026 announcement also attributed thefts in San Diego and Palm Springs to the same suspect.3
Sephora had already recognized a multi-location problem when it contacted CHP. The announcement describes how the plate helped officers locate the man. It leaves open how the retailer first linked the incidents. Read together, the cases give investigators two questions worth asking of a new report. Has another store documented this vehicle? Has the retailer already associated this person with a series elsewhere? The answers can lead to different evidence and different people to call.
The scale of the California task force’s work makes it worth being precise about this example. CHP reported 734 organized retail crime investigations and 1,208 arrests in 2025. Those totals describe enforcement activity statewide. The Sephora account tells us something more useful for a store investigator: the retailer could tell officers that this person had been associated with losses in more than one area before the freeway interception took place.3
What another district needs from a store report
In the Ulta investigation, a plate observation gave officers a location to check. The merchandise found when Ohio officers located the women was a separate piece of evidence. In the Sephora case, the retailer’s report about a suspect gave CHP a reason to follow a particular vehicle. A regional analyst reviewing either account would want to preserve that order. Otherwise a later summary could make a sighting sound like proof of a theft, or credit a camera with a connection the retailer had already made.123
That distinction carries over to the incident form. A field for the plate is valuable, but so is a short account of how it became relevant. Did a witness see someone leave the store and enter the vehicle? Was the plate recorded at the time or read later from footage? Was only part of it legible? A colleague in another district needs those details to decide whether a match warrants a call to the store, a closer look at the footage or no further action.
Who learns about the next sighting
Link analysis lets an organized retail crime (ORC) investigator build a record of which people and vehicles appeared at which stores, when they appeared and which reports support each connection. The harder question comes after the investigator has mapped the series. If a store in another district records the same plate six weeks later, who learns about it? A useful alert would identify the matching plate, name the earlier case and direct the investigator to both reports. A regional dashboard could make the same lead visible to a colleague covering the district. Neither person should need to remember the original plate to know where to look.
A series may be planned across several stops while each store sees only one loss. Investigators need to preserve enough detail for another team to test that possibility. Was the plate read in full? Where and when was the vehicle observed? What connects it to the people in the store? A reviewer who can open both reports can assess a possible link, document a mismatch or ask the other store for footage while it is still available.
For the person receiving the alert, the first useful screen would show why it appeared. A plate recorded at two locations with the same issuing state is a different lead from two similar vehicle descriptions. A correction matters, too. If a reviewer discovers that one character was transcribed incorrectly, the result should be visible to colleagues who might otherwise repeat the same comparison. Keeping the reasoning beside the records preserves the team’s knowledge when the original investigator changes shifts or leaves the district.
Hubstream’s loss prevention solution brings vehicles, incidents and locations into the same investigation. For the regional reviewer, that means starting with the vehicle record, opening the associated incidents and comparing what each store actually observed. If the review establishes a match, the team can preserve the relationship for the next district. If it rules one out, record the reason beside the observation. The next investigator should inherit both the lead and the work already done to check it.
Test the handoff with a closed series
Take the last 90 days of theft reports from two districts and choose a series your team has already investigated. Identify the first report that contained a usable description of the person or vehicle. Then find the next report from another location. At the time that second report arrived, what could its author have known from the first? Check whether the identifying detail was searchable, whether the earlier source was accessible to the reviewer, and whether anyone had responsibility for following up.
Who would receive the lead if the original investigator were off duty? Ask that colleague to open the two reports and explain what warranted the match.