Bookkeeper embezzlement is theft by the person who keeps the books, usually through extra pay to themselves, personal bills paid from the business account, or checks and transfers recoded to look like expenses. It lasts because the same person records, pays and reconciles. An owner can check quietly using the bank's own statements and payroll records.
Why bookkeeper embezzlement runs for years before anyone notices
Bookkeeper embezzlement runs for years because the bookkeeper controls the records the owner would use to find it. They enter the transactions, prepare the reports and reconcile the bank account. If the owner reads only the reports the bookkeeper hands over, every number has already passed through the hands of the person taking the money.
Three conditions show up again and again in these cases:
- Trust built over time. The bookkeeper has been there for years, knows the business better than anyone, and has never given a reason for doubt. Owners stop checking people they trust.
- Access that grew without a decision. Signing authority, online banking with payment rights, the payroll login and the company card were each added for a good reason, one at a time. Nobody looked at the total.
- No outside review. The owner signs checks or approves payroll without reading the support, and the bank statement goes straight to the bookkeeper.
The amounts usually start small. A first theft may be a one-off "loan" the bookkeeper means to repay. When nothing happens, it repeats, and the amounts grow. That pattern is why the losses found in these cases are often far larger than anyone in the business would have guessed.
The same mix of trust and thin review is common in volunteer-run organisations. Church embezzlement and embezzlement in nonprofits cover how it plays out when the bookkeeper is a long-serving treasurer or the only paid staff member.
Extra pay a bookkeeper sends to their own account
Extra pay is the most direct form of bookkeeper embezzlement. A bookkeeper who runs payroll can raise their own rate, add hours or bonuses, process an extra pay run, or keep paying someone who left and point the deposit at their own account. The payroll report may look normal while the bank shows more money going out.
Look for these in payroll and bank records:
- Off-cycle pay runs. A payroll debit on the bank statement between regular pay dates, with no approved reason.
- Pay above the approved rate. The bookkeeper's gross pay in the register does not match the salary the owner agreed.
- Bonuses and advances nobody approved, or an "advance" that is never deducted from later pay.
- Two direct deposits to one account. A former employee's net pay landing in the bookkeeper's account.
- Payroll totals that disagree. The payroll provider's total for a pay date differs from the debit on the bank statement.
Pay to people who no longer work for the business, or who never did, is its own scheme. Ghost employee fraud explains how to compare the payroll file with the people actually working.
Personal bills a bookkeeper pays from the business account
Personal bills paid from the business account are the second common scheme. The bookkeeper pays their own credit card, mortgage, car loan, utilities or phone from the business, then records the payment as an expense such as supplies or repairs. On the bank statement the payee is often visible, even when the ledger shows something else.
The payment usually takes one of three forms:
- Online bill payment to a personal creditor. The bank statement shows the card issuer or lender's name, which a business would not normally pay.
- A business check to a personal payee, entered in the ledger under a vendor name the business does use.
- A transfer to an account the business does not own, described in the books as a transfer to savings.
Personal card payments are the most frequent of these, because a card issuer's name looks like an ordinary business expense to someone skimming the statement. Ask a simple question for every card issuer on the bank statement: which business card is this paying, and whose name is on it?
How does a bookkeeper alter the records to hide the theft?
A bookkeeper hides theft by changing the books so they still look right. The usual methods are changing the payee name in the ledger, recording a check as voided after it cleared, posting journal entries that move the loss into an expense account, and carrying invented reconciling items so the bank reconciliation still balances.
Each method leaves a trace you can look for:
| Concealment method | What the bookkeeper changes | Where it shows |
|---|---|---|
| Recoded payee | Ledger payee replaced with a real vendor's name | Cleared check image or bank payment detail shows a different payee |
| False void | Check marked void in the ledger | Same check number cleared the bank |
| Manual journal entry | Cash credited, expense debited, no source document | Journal entries to cash posted by the bookkeeper, often at month end |
| Padded reconciliation | Deposit in transit or outstanding check that never clears | Old reconciling items rolling forward month after month |
| Deleted transactions | Payment removed from the ledger entirely | Bank statement line with no ledger entry at all |
The table is an example of common methods, not a complete list. The common thread is that the bank's own record does not change. The bank statement, the check images and the payment detail come from the bank, and they are the evidence the bookkeeper cannot edit.
Moving money out to an outside account can take several hops before it reaches the bookkeeper. Following those transfers between accounts is the subject of fraudulent transfer analysis. Reconciliations that are made to balance with an invented figure are covered in plugging a bank reconciliation.
Payroll tax deposits a bookkeeper reported but never made
Some bookkeepers steal the payroll taxes themselves. The payroll is run, tax is withheld from employees' pay, and the bookkeeper reports a deposit in the books but sends the money elsewhere. The business usually finds out only when the tax agency sends a notice, and the unpaid tax, penalties and interest stay with the business.
This version is easy to check, because the record of what was actually paid sits outside the bookkeeper's reach. Federal tax deposits in the US are made through the Treasury's Electronic Federal Tax Payment System (EFTPS), whose payments menu lets an enrolled business view its payment history. An owner with their own login can compare that history with the tax deposits recorded in the ledger.
The usual signs are tax deposits in the ledger with no matching debit to the tax agency on the bank statement, and agency notices that only the bookkeeper sees. The test that matches each payroll's tax liability to a bank debit is laid out in matching federal tax deposit debits to payroll runs, and the same check applies to state payroll and sales taxes.
How can an owner check for bookkeeper embezzlement quietly?
An owner can check for bookkeeper embezzlement quietly by going to the sources the bookkeeper does not control: the bank's own statements and check images, the payroll provider's reports and the tax agency's payment history. Get them directly, review them away from the office, and compare them with the books before asking any questions.
The quiet check, step by step
- Get bank statements directly. Log in to online banking yourself, or ask the bank for statements and check images for the last 12 months. Do not ask the bookkeeper to print them.
- Read every payee on the statements. Mark any personal creditor, any individual, and any business you do not recognise.
- Look at the check images for checks above a level you choose, and compare each payee with the ledger.
- Total the payroll debits on the bank statements for each pay date and compare them with the payroll provider's totals.
- Compare the bookkeeper's own pay with what you approved.
- Check tax deposits at the tax agency's site against the ledger.
- Read the last few bank reconciliations and list any reconciling item older than two months.
- Write down what you find, with dates and amounts, and keep it outside the business's systems.
A quicker way to do steps 2 to 4 for a full year is to load the statements into a tool that lists every line. PreciseBankFlow reads each statement, checks it foots to the printed closing balance, and flags gaps in check numbers and possible duplicates, so the owner reviews a short exception list instead of twelve PDFs.
When to do it
Pick a quiet time, not the week the bookkeeper is away if they will know you were in the systems. A planned absence is still the best chance to see the work in someone else's hands; a mandatory vacation policy explains why. If nothing turns up, the check costs a few evenings. Repeating it each month is the habit described in an owner review of bank statements.
Confronting the bookkeeper too early: the owner's costliest mistake
Confronting the bookkeeper before the evidence is copied is the costliest mistake an owner makes. A bookkeeper who knows they are suspected can delete files, change passwords, take paper records home or quit with the only knowledge of how the books work. Copy the evidence, secure access and take advice first.
Before any conversation, copy the accounting file, save the bank and payroll records you obtained yourself, make sure you are an administrator on every system, and plan to remove the bookkeeper's logins on the day you speak to them. The full order of steps, including when to call counsel and your insurer, is in what to do first if you suspect embezzlement.
An owner's instinct is often to ask directly, because the bookkeeper is a long-standing colleague and there may be an innocent answer. There may be. But asking first gives a guilty bookkeeper time to clean up and gives an innocent one no advantage over asking later. Insurance claims and police reports also depend on evidence that was preserved, so the order matters even if the amounts turn out to be small.