Possible explanations and actions:
1. Test theft right before fuel filling.
If you made a defueling for test purposes and then refueled the vehicle right away, the system may regard this as outlier of data. In real situation, when a theft is not followed by immediate refueling, such theft will be detected.
2. Theft during a prolonged shutdown of the device.
A theft can be detected only if the option 'Time-based fuel level sensors consumption' is off (see the Fuel Consumption tab of unit properties) and if there is a trip after switching on the device again.
3. High filtration level of FLS.
Decrease filtration level of FLS on the 'Fuel Consumption' tab (recommended are values up to 15) or set the option 'Calculate theft volume by raw data'.
4. High value of minimum theft.
Decrease the value of minimum theft volume on the 'Fuel Consumption' tab.