I have seen customers who sometimes try to steal toners but not so obvious,maybe 1 bottle on 5 bootles and that is hard to trace, but 18 bottles on 5k clicks,that is so cheeky.
In my surrounding people who doing this would be beaten for sure for making somebody stupid and steal from him.
Anyway you should double check this situation.
Why did you not react sooner before they allegedly "deplete" 18 bottles?
Bookmarks