New global study finds most retailers still fight crime one incident at a time... and warns they are losing the battle against crime as a result. The few that have built proper risk models are pulling ahead.

Key findings

• More than two-thirds of retailers (68%) don't have an established crime risk model; and more than one in four (27%) have none at all.
• Just one in three models (34%) have been formally tested, leaving retailers exposed when a crime on premises ends up in court.
• Most retailers are “firefighting”: reacting to crime incident by incident, when the data to get ahead of it already exists.
• Retailers with established models are nearly four times more likely to use threat intelligence, and five times more likely to factor in population density.
• The report delivers a self-assessment tool, outlining five red flags to spot a crime risk model that isn’t working hard enough.

Retail crime is more organised, aggressive and complex than ever. Yet a new study from ECR Retail Loss finds most retailers still tackle it by reacting to each incident as it lands, with no reliable way to see the next one coming.

Retail Crime Risk Models, authored by Professor Emmeline Taylor, a global expert on retail crime, draws on responses from more than 70 retailers, representing more than 10% of the global retail market, with a combined turnover above £2.5 trillion and around 230,000 stores.

It shows the sector in transition. Nearly three-quarters of retailers (73%) run some form of crime risk model, but only 44% of those describe their approach as established.

Factor in the one in five with no model at all, and more than two-thirds of the sector (68%) is working without a crime risk model they can have total confidence in.

What a good crime risk model looks like

A crime risk model is simple to describe and hard to do well. It pulls together data on where, when and why crime happens across a retailer's stores, then turns it into a ranking of risk that tells the business where to act first.

The new report identifies five markers that separate mature models from immature ones. They also offer five warning signs that a model isn't fit for purpose.

1. You're blind to the outside world. Risk is judged on internal incident logs alone, with no external feeds such as police data, threat intelligence, or population density.
2. Your internal data is thin. You track theft and violence but miss the richer, location-specific signals: operational data on staffing, trading hours, physical surveys, robbery, vandalism and burglary patterns.
3. The model sits in a silo. It lives inside loss prevention and never reaches the decisions that matter: resourcing, store planning, property and investment.
4. You've never tested it. There's no check on whether predicted risk matches what happened, and nothing that would stand up as a legal defence.
5. It's frozen in time. Data is refreshed rarely, if ever, so you're always looking backwards instead of spotting risk as it builds.

The difference between those with an established model and those without is stark. The former draw on more than four external data sources on average; developing models manage fewer than three.

Established models are nearly four times more likely to use threat intelligence platforms and five times more likely to factor in population density.

They're also far more likely to shape frontline decisions, from where to deploy guards to which sites to keep open.

The legal reckoning ahead

Only 34% of retailers with a model have ever formally tested it, whether in-house or through litigation. That matters because a robust, tested model is exactly what a retailer needs when a crime on its premises leads to a negligence claim.

The legal principle is foreseeability: could the retailer reasonably have anticipated the risk, and did it act?

A model that systematically tracks risk and drives proportionate action is a defence, while a hunch or “years in the business” is not.

In the US, negligent-security litigation involving retail premises is already common. In the UK, one loss prevention leader interviewed for the study expects a case to reach the front pages within the year.

From firefighting to intelligence-led control

“The Retail Risk Models research report provides a timely overview of the current state of play across the sector, offering useful insights throughout,” says Richie Iwanoff, Corporate Investigations, BT Group

“We’ll be using the assessment tool in the business to see where we are and how we could do more. Many reports just tell us what we already know – this report aims to move the dial with actionable insights”

The report makes the case for a shift to Intelligence-led Retail Crime Control: a structured, data-driven approach that identifies risk, prioritises resources and targets action where it will do the most good.

It borrows from intelligence-led policing, which uses crime analysis to focus finite resources on the places and people that drive the most harm.

To help retailers find their starting point, the report comes with a free self-assessment tool.

It scores a business against the same five areas that separate mature models from immature ones, and returns one of four personas: the Firefighter, the Reactive Investigator, the Analyst, or the Intelligence-led Strategist. The tool is available online now.

The future of retail crime control is intelligence-led. The question the report leaves with every retailer is a simple one: which of the four are you?

Retail Crime Risk Models: The Foundation of Intelligence-led Retail Crime Control, is authored by Professor Emmeline Taylor, published by ECR Retail Loss, and available at https://ecrloss.com/research-paper/retail-crime-risk-models/.

The research is based on an online survey of retailers (72 valid responses after screening), 16 semi-structured interviews with senior loss prevention and asset protection professionals across multiple verticals, and an industry focus group of 35+ practitioners held in September 2025.

On the tested-model figure: The 34% refers to the 44 respondents who gave a clear yes or no on whether their model had been formally tested, rather than the full sample.

The self-assessment tool is free to use, available as an interactive online questionnaire or a paper-based exercise at ecrloss.com.

This report was made possible by a special additional research grant from Cap Index.

About the author. Professor Emmeline Taylor is Director of Aptus Business Crime Research Centre and Professor of Criminology at City St George's, University of London. She is a leading global authority on retail crime. She has written extensively for the sector, including the ECR Retail Loss reports Fortress Stores, Most At-Risk Stores, and The 98% and hosts the hit podcast Retail Crime Uncovered. 

About ECR Retail Loss. ECR Retail Loss is an independent, industry-led think tank that has spent more than 25 years helping retailers and manufacturers reduce loss and improve on-shelf availability. It is open to any retailer or manufacturer to join. ecrloss.com.

• For further information, interviews or picture requests, contact Gareth Morgan This email address is being protected from spambots. You need JavaScript enabled to view it.

Whatsapp