Texas fast-food worker allegedly stole $80,000 in refund scheme

A terminated Chick-fil-A worker in Grapevine, Texas, allegedly turned the restaurant’s refund system into a drain on the business, creating about 800 fake macaroni-and-cheese tray orders and sending the money back to his own credit cards. Police say the scheme cost the fast-food operator just over $80,000, a reminder that a sloppy point-of-sale setup can become a major internal theft problem fast.

The suspect, identified by police as 23-year-old Keyshun Jones, was caught on surveillance video behind the counter without authorization, according to investigators. Officers say he used the register to ring up the fake mac and cheese tray sales and then immediately refunded each transaction to personal credit cards. The unusual menu item made the case stand out, but the fraud itself was straightforward: create bogus sales, process refunds, and exploit access that should have been locked down.

Police say Jones had already been let go from the restaurant in October 2025, and the alleged theft began the following month after the owner reported suspicious activity. That timeline is what makes the case especially troubling for operators. If a former worker can still get close enough to the register to process hundreds of refunds, the failure is not just one person’s dishonesty. It points to weak permission controls, poor offboarding, and a lack of real-time review of refund patterns that should have stood out almost immediately.

Jones was arrested on April 17, 2026, after evading arrest multiple times, with help from the Texas Attorney General’s Fugitive Task Force and the Fort Worth Police Department. He is being held in the Tarrant County jail and faces charges including property theft, money laundering and evading arrest. For restaurant managers, the warning signs in this case are hard to miss in hindsight: a surge of refunds tied to one item, a worker operating behind the counter after termination, and money flowing back to personal cards. Those are the kinds of anomalies that should trigger a same-day audit of register access, refund permissions, camera footage and employee status across every shift.