You can only shoot unprotected people in NCR and VC innercity and Junktown if you're really quick or if you are at a spot where the guards can't see you.
When a thief fails, there are 2 options:
1. A guard notices it and says the thief failed. Thereby mentioning a thief's name
2. You get a line in your log stating that <player name> failed stealing from you
In both cases a thief is unprotected.
thank you for good answer
but why you do say "be real quick"?
on the topic: personally i think unprotected theif should be marked only for those who did really see he failed.
same for another "crimes" like standing in a doors of brahmin pen or picking up items from the ground in stealth (the last one is absoluttely rediculous, at first i couldn't understand for the very long tine why i'm unprotected in JT and my reputation there dropping)
Guard who eyewitnessed failed theft should shoot, not talk.
i agree when someone shouting theif on someone noone really believe this.