He came back after they fired him and rang up mac and cheese 800 times

I. The Count

Eight hundred.

That is the number the Grapevine Police Department laid out in the arrest documents. Eight hundred orders of macaroni and cheese. Eight hundred times someone stepped up to a Chick-fil-A register, entered a catering tray into the system, and then pushed the order back out as a refund.

The refund did not go to a customer.

According to the charges filed against Keyshun Jones, it went to his credit cards.

A large macaroni and cheese catering tray at Chick-fil-A runs about $106. Do the math on 800 of them and you land somewhere close to $84,800. The complaint alleges the total exceeded $80,000. The math holds.

Jones was a former employee at the Grapevine, Texas location. Former. He had been terminated in October 2025. The transactions in question allegedly happened after that. After the termination. After the last day. After whatever conversation happened when the apron came off for the last time.

He came back. According to investigators, he came back to the register.

Nobody stopped him at the door.

II. What the Owner Found in November

Picture the moment the franchise owner sat down with the records.

This is a small business. A Chick-fil-A franchise is not a hedge fund. It is a family investment, a licensed operation, a piece of someone's retirement plan built around chicken and waffle fries and the particular promise of a fast-food brand that has spent decades cultivating a reputation for doing things right. The owner took a risk on that license. They built a staff. They ran the books.

In November 2025, the books stopped making sense.

The system showed hundreds of mac and cheese catering trays moving through the register. That is not unusual on its own. Chick-fil-A does catering. People order for offices, for parties, for whatever requires feeding a room. But somewhere in the process of checking the numbers, the owner noticed that the refunds were not going to customer accounts.

The owner reported it.

That report opened a five-month investigation. The Grapevine Police Department worked it. The Texas Attorney General's Fugitive Task Force worked it. The Fort Worth Police Department assisted. Five months of pulling transaction logs, reviewing surveillance footage, following the trail the register left behind every time someone touched it.

What investigators allegedly found, according to the charges, was Keyshun Jones behind the terminal. Not on the days he was employed. On the days after.

The POS system, the point-of-sale terminal where orders are entered and refunds are processed, is designed to serve customers. It is built for speed. A cashier enters an item, the customer pays, the transaction closes. Or, when something goes wrong, the cashier processes a return. The money flows back. That is the refund door. It exists for legitimate reasons. Every register in every restaurant has one.

The allegation is that Jones walked back through the door, found the terminal still accessible, and used the refund function the way a faucet gets used. Open it. Let it run. Close it. Come back tomorrow.

III. Eight Hundred

One.

That is how most refund schemes start. One transaction. One test. Enter the item, issue the refund, see if anything happens. If nothing happens, try again.

According to the complaint, nothing happened for a long time.

Two. Five. Twenty. The pattern allegedly continued. Each transaction was not enormous on its own. A single $106 catering tray refund is noise in a busy restaurant's daily ledger. It is the kind of line item that disappears into the week's numbers, one return among many, unremarkable in isolation.

But the isolation is the point. The alleged scheme did not depend on any single transaction being invisible. It depended on all of them being individually small enough that no one stopped to add them up until there were 800 of them and the total had crossed $80,000.

That is not a flaw in the method. That is the method.

The money landed on Jones's credit cards, according to the charges. Not a bank account that requires paperwork to open. Credit cards. The refund function routes money back to the payment source. If the payment source is your card, the refund is your money.

Money laundering is one of the charges Jones faces. Under Texas law, taking proceeds from theft and moving them through a financial instrument can qualify. That is what the charge alleges. The theft was the fake order. The card was the pipe.

Over $80,000 moved through that pipe, according to investigators.

Jones's bail across all charges is set at $117,500.

IV. The Door That Stayed Open

Here is the part that matters for anyone running a business with employees.

Jones was terminated in October 2025. That is established. He was no longer employed at the Grapevine location. Whatever access he had as an employee, whatever credentials, whatever familiarity with the physical layout, whatever knowledge of when the manager was watching and when the manager was not, all of it should have ended with the termination.

The complaint alleges it did not.

We do not know exactly how Jones allegedly walked back into the restaurant and reached the register. The investigation is active. The case has not gone to trial. The specific mechanics of how a terminated employee accessed a point-of-sale terminal on multiple occasions are part of what will be argued in court.

What we do know is that the investigation found him there, allegedly, on dates after he no longer had any right to be there. And the register let him in.

In the restaurant industry, terminated employee access is a known vulnerability. The industry itself acknowledges that employee theft accounts for a significant share of inventory loss in quick-service restaurants. The refund function, specifically, is one of the more common vectors. It requires no cash to leave the building. It requires no product to walk out the door. It is a digital transfer, authorized by the system, routed to wherever the operator points it.

The control that is supposed to prevent this is access revocation. Terminate the employee, disable the credentials, change the codes, make sure the door into the system closes when the physical relationship ends.

Somewhere between Jones's last day in October and the owner's discovery in November, that did not happen. The door stayed open long enough for, according to the complaint, 800 trips through it.

Read that slowly.

Eight hundred.

V. What Happens Now

Jones was arrested on April 17, 2026. The Grapevine Police Department made the arrest with assistance from the Texas Attorney General's Fugitive Task Force and the Fort Worth Police Department. The involvement of a fugitive task force suggests Jones was not easy to locate once the investigation concluded.

He faces property theft charges, money laundering charges, and an evading arrest charge.

These are allegations. Jones has not been convicted. The case is pending. Allegation is not adjudication.

What is not pending is the owner's loss. Over $80,000, allegedly extracted through a system the owner trusted, by a person the owner had already let go. The franchise license, the staff, the investment, all of it was sitting on one assumption: that when someone stops working for you, they stop having access to your register.

That assumption had a hole in it.

The register is still there. The refund door is still in the system. Somewhere in Grapevine, Texas, a franchise owner is looking at internal controls with the particular attention of someone who has already learned what it costs not to look.

That part may be the saddest. Not the arrest, not the charges, not the bail amount.

The moment in November when the owner looked at the numbers and understood that the door had been open the whole time.

And that the macaroni and cheese was never going anywhere.