The use of closed circuit television (CCTV) has many applications ranging from commercial and civil security, surveillance and safety. CCTV is often used to monitor suspicious behaviour, however footage from the 7th July ‘London bombings’ illustrated that the suspects did not behave suspiciously and it was not apparent that they were about to carry out such acts. This paper investigates different methods of cueing observers monitoring ‘normal’ behaviour. Three different cueing methods were employed (video still image, ‘mug-shot’, and text description). Six ‘suspects’ were used in the experiment with each one appearing in different CCTV scenarios. 24 participants took part in the experiment and viewed each scenario as a single screen CCTV workstation. Data were collected for performance (correct/incorrect identification) and workload (NASA-TLX). Subjective preference data were also collected using a post-experiment questionnaire. The findings indicated that 74% of participants successfully identified suspects. The ‘mug-shot’ method provided better recognition than either the video still image or the text description however workload was lower using the video still image than the ‘mug-shot’ or text description. With little published research in this area of CCTV, this study represents a move forward in developing an understanding of cueing methods for CCTV users and the effects of these different methods on user workload and detection rates.