Badge and PIN Approval: A Practical Guide to Till Security

Why a till login alone isn't enough

Every cashier at your shop should have their own login. That much is standard practice by now. But a day-to-day sales login was never designed to police the handful of actions that actually create risk: pulling cash out of the drawer, recording an expense on the spot, granting a steep discount, or redeeming a customer's loyalty points for value. If the same cashier who processes the sale can also wave through the exception, the "control" is really just a log entry after the fact: useful for looking back, but not for stopping the loss in the first place.

Badge and PIN approval closes that gap. It puts a second, independent person between the cashier and the sensitive action, without slowing down a normal sale or forcing managers to carry around yet another password.

How badge and PIN approval works

The flow is deliberately short. Two steps, each doing a different job.

Step one: the badge identifies who

When a till action needs sign-off, the manager on duty scans or enters their badge code. This records exactly which manager is approving the action, so the audit trail always shows a named person rather than a generic "manager override."

Step two: the PIN confirms it's really them

After the badge, the manager enters a separate PIN. This PIN is not their account login password. It exists only to confirm the approval at the till. That distinction matters on a shared checkout screen: a manager's real password never gets typed where a cashier, a customer in the queue, or a phone camera could catch it. Without the correct PIN, a badge code alone cannot approve anything.

What actually triggers a request

Four categories of till action prompt for badge and PIN approval:

• Cash drops and top-ups: moving cash out of or into the drawer mid-shift
• Expenses: recording a spend directly at the till
• Discounts above a configured cap: anything beyond the threshold your shop sets
• Loyalty point redemptions. Customers converting points to value against a sale

In every case, the action simply cannot complete until a valid badge-and-PIN pair from someone other than the cashier is entered.

Setting thresholds that fit your shop

Approval is switched on by default for cash-sensitive actions, because most shops want that protection from day one. Discounts are the one area where a blanket rule rarely fits every business: a boutique that regularly rounds down a bill by a few shillings does not want a manager paged for every small courtesy discount, while a shop selling higher-value stock wants tighter control.

That's why the discount trigger is configurable: you set a percentage threshold, and only discounts above it require badge and PIN approval. Discounts under the threshold go through as a normal part of the sale.

What this looks like day to day

Picture a regular walk-in customer asking for a discount larger than your shop's threshold. The cashier applies it at the till, and the sale pauses with a request for badge and PIN. The manager on the floor walks over, scans their badge, enters their PIN, and the sale continues: the whole interruption takes seconds, not minutes, and it never required the manager to hand over a password or log the cashier out of their own session.

Later, a cashier needs to drop excess cash from the drawer into the safe. Same pattern: the drop is recorded, a manager approves with badge and PIN, and the movement is logged against that manager's name: not just "manager," but a specific, accountable person. If a variance ever shows up at end-of-day reconciliation, you know exactly whose approval to ask about.

None of this changes how a normal sale works. Cashiers still ring up items, take cash or M-Pesa, and print receipts without any interruption. The approval step only appears for the specific actions your shop has flagged as sensitive. Everything else moves at full speed.