Employee Embezzlement: Warning Signs and What to Do

Employee embezzlement rarely looks like a dramatic theft. It looks like a trusted bookkeeper who never takes a holiday, a vendor nobody quite remembers hiring, or a customer insisting they paid an invoice your books say is still open. The warning signs are usually there long before the loss is discovered; the trick is knowing what to look for and acting carefully once you see it. This guide covers the behavioral and accounting red flags, the schemes most common in small businesses, and the steps to take if you suspect someone.

The scale is real. In its 2026 Report to the Nations, the Association of Certified Fraud Examiners studied 2,402 occupational fraud cases. The median loss was $104,000, organizations lost an estimated 5% of revenue to fraud, and schemes typically ran around a year before discovery. Organizations with fewer than 100 employees had a median loss of $126,000, and only about a quarter of small businesses had a formal way for staff to report wrongdoing. Asset misappropriation, which includes embezzlement, appeared in roughly 90% of cases.

What is employee embezzlement?

Embezzlement is theft by someone who was lawfully trusted with the money or property in the first place. That is the difference from ordinary theft: the bookkeeper legitimately has access to the bank account, the office manager legitimately receives customer checks. The crime is converting that access to personal use. In fraud-examination terms, it falls under asset misappropriation, the most frequent but usually smallest-per-case category, as opposed to corruption or financial statement fraud.

Behavioral embezzlement signs

Fraud examiners consistently find that most perpetrators show at least one behavioral red flag. None of these prove anything alone, but a cluster deserves attention:

• Living beyond their means: new cars, expensive holidays or spending that does not match a known salary.
• Refusing vacations or help: someone who will not let anyone else touch "their" books. The ACFE's 2026 data puts the median loss where this flag appeared at $250,000.
• Unusually close relationship with a vendor or customer: associated with a $300,000 median loss in the 2026 report.
• Financial pressure: known debts, divorce, gambling or addiction problems.
• Control issues and defensiveness: irritation at simple questions, unwillingness to share passwords or explain entries.
• Odd hours: working alone early or late, especially around month end.

Accounting red flags in your books

Behavior is subjective; records are not. These are the signs that usually show up in invoices, bank statements and reports:

Red flag	What it may indicate	Where to check
Customers say they paid invoices shown as open	Skimming or lapping of receipts	Customer statements, aged receivables
Rising credit notes, discounts or write-offs	Hiding stolen customer payments	Credit note list by user
Gaps or duplicates in invoice or check numbers	Destroyed or altered documents	Invoice and check registers
New vendors with PO boxes, home addresses or personal bank accounts	Shell vendor billing scheme	Vendor master file, change logs
Payments just below approval thresholds	Splitting to avoid review	Payment report sorted by amount
Payroll for people you do not recognize, or overtime spikes	Ghost employees, inflated hours	Payroll register
Late or unreconciled bank accounts	Concealment of unauthorized transfers	Bank reconciliation reports
Personal-looking purchases on business cards	Card misuse	Card statements

External invoice fraud has its own pattern; our guide to invoice scam warning signs covers fake supplier invoices sent from outside.

Common embezzlement schemes in small businesses

Billing schemes

An employee sets up a fake vendor, or colludes with a real one, and sends invoices for goods or services never received. Billing schemes are among the costliest for small organizations because one person often both enters and approves bills. A proper vendor onboarding checklist makes shell companies far harder to slip in.

Check tampering

Forging signatures, altering payees or amounts, or writing checks to themselves and coding them to a legitimate expense. Positive pay stops most altered and counterfeit checks at the bank.

Skimming and lapping

Taking a customer's payment before it is recorded, then covering the hole with the next customer's payment, and so on. It requires constant maintenance, which is why the perpetrator never takes leave.

Expense and card misuse

Personal purchases claimed as business expenses, duplicate receipts, or inflated mileage claims.

Payroll fraud

Ghost employees, unapproved raises, or hours padded on timesheets.

Duplicate payments

Paying the same invoice twice and diverting the refund. See our guide to duplicate invoice payments for detection queries.

What to do if you suspect embezzlement

This is general information, not legal or tax advice; your attorney and accountant should guide the specifics. The order of steps matters, because a premature confrontation can lead to deleted records.

1. Do not confront or accuse yet. Keep normal behavior while you gather facts.
2. Preserve evidence. Download bank and card statements straight from the bank. Export the accounting file, vendor list and audit logs. Back up email accounts. Store copies outside systems the employee can reach.
3. Quietly limit access. Add dual approval on payments, remove the ability to change vendor bank details, and route mail to someone else, without tipping off the person if possible.
4. Call an attorney. Employment law, defamation risk and evidence handling all matter before any interview or termination.
5. Bring in a forensic accountant or certified fraud examiner to quantify the loss. You will need that number for insurance, tax and any recovery claim.
6. Notify your insurer promptly if you have crime or fidelity coverage. Policies often have strict notice deadlines.
7. Interview and decide. With counsel, interview the employee, then decide on termination, a police report and civil recovery.
8. Fix the control gap. Rework duties so the same scheme cannot happen again; our guide to segregation of duties in a small team shows how.

Worked example: a lapping scheme

This example is illustrative. A plumbing company with $1.2 million in annual sales has one office administrator who opens the mail, deposits checks and posts payments. Over 14 months she takes about $1,500 a week from incoming checks:

• Week 1: Customer A's $1,500 check is deposited into her personal account. Invoice A stays open.
• Week 2: Customer B pays $1,800. She posts $1,500 of it to Invoice A and leaves Invoice B partly open.
• Over time, older invoices are covered by newer payments, and stubborn gaps are closed with "discount" credit notes.

After 14 months the loss is around $90,000. The scheme is found only because she is hospitalized for two weeks and a temporary worker sees a customer's payment confirmation for an invoice already marked as paid. The clues were there all along: receivables aging was getting older, credit notes had tripled, and she had not taken a week off in three years.

Mistakes owners make after discovering theft

• Firing on the spot. An immediate dismissal before evidence is secured can mean wiped laptops, deleted emails and a weaker case. Remove access and preserve data first, with legal advice.
• Accepting a quick repayment deal without advice. A promise to repay "what I took" is usually far less than the real loss, and some agreements not to report a crime can create legal problems of their own.
• Letting the suspect "help" with the investigation. They know where the gaps are and can quietly fix entries.
• Underestimating the period. Losses found in one year often started years earlier. Ask the forensic accountant to test back as far as records allow.
• Talking too widely. Accusations shared with staff or customers before the facts are established can expose you to defamation claims. Keep the circle small: owner, attorney, accountant and insurer.
• Forgetting customers. If skimming was involved, some customer balances will be wrong. Send corrected statements once you know the real position, and apologize for any confusion.

Tax treatment and insurance recovery

In the US, a business theft loss, including embezzlement, is generally deductible in the year the theft is discovered, not the year it happened. If you have a claim for reimbursement with a reasonable prospect of recovery, such as an insurance claim, the deduction usually waits until that is settled, and any recovery reduces it. You will need to prove that a theft occurred under local law, the amount, and when you discovered it, which is where a forensic report and a police report help. The IRS covers theft losses in Publication 547 (Casualties, Disasters, and Thefts), and the discovery-year rule comes from Internal Revenue Code section 165(e); ask your tax professional how it applies to your return.

Standard liability policies do not cover employee theft. Commercial crime insurance or an employee dishonesty bond does. Our overview of business insurance types and costs explains where crime cover fits.

How to prevent embezzlement

• Split authorization, custody, recording and reconciliation, using our sibling guide to internal controls as a checklist.
• Owner reviews bank statements monthly, pulled directly from the bank.
• Independent bank reconciliations every month.
• Mandatory vacations and cross-training.
• Approval required for every credit note, write-off and vendor change.
• A simple, anonymous way for staff, customers and vendors to report concerns. Tips are the single most common way occupational fraud is detected.
• Background and reference checks for anyone with access to money.

Keep your invoicing records clean

Many embezzlement schemes depend on messy receivables. Sequential invoice numbers, consistent formats and customer statements that show every invoice and payment make skimming and lapping hard to hide, because customers will spot a balance that should not be there. Create numbered invoices and credit notes in seconds with our free invoice generator: no sign-up, download as PDF, and keep a complete copy for every review.