How P300 EEG Identified an Employee Theft Ring That CCTV, Audits and HR All Missed

The Situation: Fourteen Months of Unexplained Losses

The client — a multi-site retail distribution business operating across four UK locations — first noticed the discrepancies in their quarterly stock audit in early 2024. High-value consumer electronics, typically held in a secure warehouse bay, were consistently showing negative variance. Initially the losses were attributed to administrative error. By the second quarter, the pattern was too consistent to dismiss.

By the time they contacted us in late 2025, the cumulative stock loss figure had reached £180,000. The items being taken — small, high-value units including audio equipment, smart home devices and portable electronics — were the kind of product that disappeared cleanly. No broken packaging. No forced entry. No obvious signs of a single large-scale theft event. This was systematic, careful and almost certainly internal.

The warehouse team at the primary site comprised seventeen staff. Of these, eleven had regular access to the affected bay during the periods of greatest loss. The client had already spent three months trying to identify the source through conventional means before approaching us for a corporate P300 EEG investigation.

What They'd Already Tried — And Why It Failed

Before contacting us, the client had pursued four separate investigation approaches over a three-month period. Each produced partial information but failed to identify the individual or individuals responsible.

The traditional polygraph attempt on three of the highest-suspicion employees is particularly notable. All three returned inconclusive results — not because the technology failed, but because the stress of the investigative environment had elevated their baseline physiological responses to the point where meaningful discrimination was impossible. This is one of the most common failure modes for polygraph in workplace settings.

The P300 EEG approach does not rely on stress or physiological arousal. It measures direct neural recognition — and it is entirely unaffected by whether the subject is anxious about the investigation. A nervous innocent person produces the same result as a calm innocent person. The brain either recognises the probe stimuli or it doesn't.

Designing the Investigation: What We Actually Tested For

Before a single electrode was placed, our corporate investigation team spent ninety minutes with the client's Operations Director and their legal counsel building the stimulus set — the specific information that would form the probe questions in the test.

The key principle

A P300 EEG test for internal theft doesn't ask "did you steal?" That question is useless — anyone can deny it, and denial produces no measurable neural response. Instead, we identify specific pieces of information that only someone involved in the theft would know: the exact location goods were moved to, the specific timing patterns, the method used to avoid CCTV, the destination the items were taken to, and in this case, the specific model numbers of items that had been taken.

Some of this information came from the client's audit data. Some came from intelligence we asked them to gather during the lead-up to our visit — including information about where items had been resold, obtained discreetly through a marketplace investigation. The client had traced several of the stolen units to online resale listings. The seller detail — a username and a broad location — was known to us but not publicly associated with the investigation.

We embedded that seller username, alongside the specific resale location, within a blind sequence of neutral alternatives. Only someone who had handled stolen goods through that channel would produce a recognition response to those stimuli. This kind of precise stimulus design is what separates an effective corporate P300 investigation from a generic lie detector test.

The consent process

All eleven employees who were to be tested were informed in advance — by the client's HR team — that a voluntary P300 EEG investigation was being conducted as part of an internal review. Participation was voluntary. Six of the eleven agreed immediately. Three requested time to speak with their union representative before agreeing. Two declined initially but agreed after being informed that their decision to decline would be noted in the investigation file alongside those who had agreed.

All eleven ultimately consented and were tested. This is not always the outcome — but in this case, the offer of a voluntary route to clear their name was compelling enough for every employee to participate. Notably, of the three who eventually showed deception-indicated results, two had initially hesitated.

The Investigation Day: What Actually Happened

We arrived on-site at 7:30am, before the morning shift began. A private room had been arranged — away from the main warehouse floor, with no visibility to other staff. Our equipment was set up and calibrated before the first subject arrived.

1. 1
   Individual briefing (10 minutes per subject). Each employee was briefed individually on how the BrainBit 8-channel EEG headset works, what the test involves, and what the results will be used for. They were reminded of their right to withdraw consent at any point. Questions were answered. No pressure was applied.
2. 2
   Headset fitting and signal calibration (5 minutes). The EEG headset was fitted and signal quality verified across all 8 channels. We waited for stable baseline readings before proceeding. Any subject with persistently poor signal quality — due to hair product, electrode placement or movement — would have been retested later. In this case, all eleven produced clean signals within the calibration window.
3. 3
   The test sequence (15–20 minutes per subject). Stimuli were presented on a screen in front of the subject. Each appeared for 300 milliseconds, with a fixed inter-stimulus interval. The subject was asked to press a button when they saw a specific category of target — a neutral task that ensures they are attending to each stimulus. The EEG was recorded continuously throughout. The probe stimuli were embedded within the sequence in a pseudorandom order.
4. 4
   Data processing (30 minutes per batch). Raw EEG data was processed in batches. P300 amplitudes and latencies were extracted for each stimulus type. Deception probability scores were calculated using our validated statistical model. The examiner reviewed the output and flagged any technical anomalies requiring reanalysis.
5. 5
   Preliminary findings briefing (end of day). At 5:45pm, our examiner presented preliminary findings to the Operations Director and HR lead in a closed meeting. Written reports followed within 24 hours.

Total on-site time: eleven hours. All eleven subjects were tested within the single working day, using a structured rotation that kept waiting times short and ensured subjects had no opportunity to discuss the test content with each other between sessions.

The Results

Of the eleven employees tested, the P300 EEG analysis returned the following findings:

The Outcome

What happened to the eight cleared employees

This is an aspect of corporate investigations that is often overlooked — and it matters enormously. Eight employees were under suspicion for months. They were aware they were being investigated. The uncertainty, the atmosphere of distrust and the personal stress of working under suspicion had measurably affected morale and, in two cases, led to sick leave.

The clear P300 results gave these employees something concrete: a professional, documented finding that their brains showed no recognition of the theft-related stimuli. The client's HR team communicated the results individually, with written confirmation that each cleared employee was no longer considered a suspect and that the investigation files relating to them would be closed.

We consider this communication as important as the deception-indicated findings. Prolonged suspicion causes real damage — as our mental health impact article covers in detail. Clearing innocent people clearly and formally is part of what a responsible corporate investigation does.

What This Case Demonstrates About P300 for Corporate Investigations

Precision over assumption

One of the most significant risks in any internal theft investigation is acting on suspicion rather than evidence — dismissing the wrong person, damaging innocent careers and exposing the business to costly employment tribunal claims. The P300 EEG approach removes this risk by producing objective, individual-level data rather than relying on subjective interpretation of behaviour or manner.

Resistance to countermeasures

The employees who were ultimately found to have been involved were not naive. They had successfully passed an HR interview process and an inconclusive polygraph. They were careful, experienced and motivated to avoid detection. None of this mattered to the P300. The stimulus design targeted information so specific that recognition was inevitable if knowledge was present — and the 300-millisecond involuntary response window gave them no opportunity to suppress it.

Speed and cost efficiency

The client had spent approximately £12,800 on investigation methods that produced no actionable outcome before approaching us. Our corporate P300 investigation package for eleven subjects cost £6,039 and produced a definitive result within a single working day. In financial terms, a total investigation cost of less than 11% of the losses was reasonable. With the insurance recovery, the net position was significantly positive.

Legal robustness

Our written P300 reports include raw EEG waveform data, P300 amplitude and latency measurements, deception probability scores with confidence intervals, and the examiner's professional conclusion. This level of documentation — combined with the peer-reviewed scientific basis of P300 event-related potential methodology — provides a substantially stronger evidentiary foundation than interview notes or polygraph summaries. See our court admissibility article for a full breakdown of how P300 evidence is treated in UK employment and civil proceedings.

• Objective individual-level results — no room for subjective interpretation
• Unaffected by anxiety, stress or deliberate countermeasure attempts
• Specific stimulus design targets knowledge that only an insider would have
• Full written reports suitable for HR, legal and insurance submission
• Clears innocent employees formally and documentably
• Can be conducted on-site at your premises across the UK
• Results delivered the same day — no weeks-long waiting period

How to Engage Our Corporate Investigation Team

If you are dealing with suspected internal theft, fraud or data breach and considering P300 EEG corporate testing, here is what the process looks like from initial contact.

1. 1
   Initial consultation — confidential and no obligation. Call us on 0161 524 5513 or use our secure contact form. We'll discuss the situation, the number of subjects, your timeline and any legal considerations. This call is completely confidential and costs nothing.
2. 2
   Investigation design. Our examiner works with you and, where relevant, your legal counsel to design the stimulus set. This is the most important preparation step and we take it seriously — the quality of the stimulus design directly determines the quality of the results.
3. 3
   Consent management. We can advise on how to communicate the investigation to employees in a way that maximises voluntary participation and minimises legal exposure. We provide a template consent process that has been reviewed by employment law specialists.
4. 4
   On-site or centre-based testing. We can come to your premises — anywhere in the UK — or subjects can attend one of our regional testing centres in London, Manchester, Birmingham, Leeds, Glasgow and more.
5. 5
   Written reports within 24 hours. Full individual reports for each subject, including raw data, analysis and professional conclusion. Formatted for HR, legal and insurance submission.

Frequently Asked Questions — Corporate Investigations

Related Articles & Pages