If you suspect embezzlement at work, act quietly and in order. Secure copies of the bank statements and books, take back control of bank access and signing authority, and do not confront the person yet. Then review the statements yourself, call a lawyer and your insurer, and decide on police involvement with their advice.
What to do first if you suspect embezzlement: the first 48 hours
The first 48 hours after you suspect embezzlement are for protecting evidence and money, not for answers. Write down what made you suspicious, get bank statements straight from the bank, copy the accounting files, and keep the circle to one or two people. Do nothing yet that changes the suspect's day.
Suspicion usually starts with something small: a vendor you have never heard of, a statement that arrives late, a supplier asking why they have not been paid, or cash that feels tighter than sales suggest. Note the trigger, the date and anything you saw. Memory fades fast, and an early note made before anyone else was involved carries weight later.
An example first-week checklist
The checklist below is an example for an owner of a small business. Adjust the timing and the people to fit your situation.
| Day | Action | Who does it | Done |
|---|---|---|---|
| Day 1 | Write a dated note of what raised the suspicion | Owner | |
| Day 1 | Download 24 months of statements from online banking | Owner | |
| Day 1 | Copy the accounting file and export the vendor list | Owner, at a routine moment | |
| Day 2 | Ask the bank for check images and signature cards | Owner, by phone to the branch manager | |
| Day 2 | Find the crime or fidelity insurance policy and read its notice terms | Owner | |
| Day 3 | Speak to a business lawyer | Owner | |
| Day 3 to 5 | Run first tests on the statements | Owner or outside accountant | |
| Day 5 to 7 | Plan access changes and the conversation with the employee, with counsel | Owner and lawyer |
The order matters more than the exact days. Evidence first, advice second, action third.
Securing bank access and signing authority when embezzlement is suspected
Securing bank access means making sure that only people you trust can move money or change records, and that the person you suspect cannot destroy evidence. In practice you list every login, card and signatory, confirm you have your own administrator access, and plan the changes so they happen together, at a moment counsel agrees.
Start with an inventory, because most owners do not know every route money can leave:
- Online banking users and their permissions, including who can approve payments and add payees.
- Signatories on each account, from the bank's signature card rather than memory.
- Business cards in each person's name, with their limits.
- Payment platforms, payroll services and accounting software users with admin rights.
- Remote deposit apps on staff phones, which let checks be deposited without visiting a branch.
Remote deposit deserves a specific look. A check photographed and deposited by phone into a personal account never touches the business's own deposit records, a scheme the post on mobile deposit fraud explains.
Timing the changes
Removing someone's access tells them they are suspected. If the loss is ongoing and large, stop it now and accept that the person will know. If it is small and slow, it is often better to keep watching, copy everything, and make all the changes on the day you speak to them. Ask your lawyer which applies. Either way, set up your own direct access to the bank first, so you are never relying on the suspect for information.
Why confronting a suspected embezzler too early backfires
Confronting a suspected embezzler before the records are secured gives them time to delete files, alter books, move money and prepare a story that fits whatever you revealed. It also gives up your best tool: hearing their explanation before they know what the records show. Most owners regret confronting early far more than waiting.
The urge to ask directly is natural, especially with a long-serving employee. You may hope for an innocent answer. Consider what an early conversation costs:
- Evidence. The person may still have access to the accounting system, email and the files in the office.
- Your leverage. An explanation given without knowing what you hold is far more useful than one fitted to what you have shown.
- The legal position. A conversation handled badly can lead to employment claims or make a later prosecution harder.
- Recovery. Money that is still in an account can be moved once the person knows.
When the conversation does happen, it should be planned with your lawyer, have a second person present and follow a short written plan. Do not threaten police action in exchange for repayment. That can create legal problems of its own.
Reviewing bank statements yourself after suspecting embezzlement
You can review the bank statements yourself to see whether the suspicion has substance. Get the statements directly from the bank, not from the person under suspicion, for at least the past two years. Confirm each one is complete, then look at who was paid, what came in and whether the books agree with the bank.
Begin with statements that cannot have been edited: downloads from your own online banking login, or copies sent by the bank. Then run a few first tests:
- Check the statements are complete. Each one's opening balance should equal the previous closing balance, and each should foot.
- List every payee that received money in the period, sorted by total paid.
- Mark any payee you do not recognize, or any person's name where you expected a business.
- Compare deposits with sales. Months where recorded sales rise but deposits do not are worth a closer look.
- Read check images for payee names and endorsements that do not fit.
- Compare the books with the bank for a few months. A difference that someone explained away each month is a lead.
Unknown vendors are the most common finding. A business that receives regular payments but supplies nothing is the core of accounts payable fraud, where fake invoices are paid to a company the insider controls.
On the receipts side, checking which customer payments actually arrived after a period end tells you whether recorded receivables are real. The method is the same one auditors use, described in the post on subsequent receipts testing.
When the statements are PDFs, PreciseBankFlow reads every line, confirms each statement foots from opening to closing balance, and flags gaps in check numbers and possible duplicate payments. That turns two years of PDFs into a list you can sort by payee, which is the slow part of this review.
When should you call counsel, insurers and police about suspected embezzlement?
Call counsel as soon as your first review suggests the suspicion is real, and before you speak to the employee. Call your insurer early, because crime and fidelity policies usually set notice deadlines and conditions. Police involvement is a decision to make with your lawyer, after the records are secured and the loss is roughly measured.
Counsel
A lawyer helps in several ways at this stage. They can advise on employment law before you suspend or dismiss anyone. They can engage a forensic accountant on your behalf. They can also advise on how to word anything you say to staff, the bank or the suspect.
Insurers
Many businesses have some cover for employee theft without realizing it, inside a business owner's policy or a separate crime policy. Find the policy, read the sections on notice and proof of loss, and follow them. Missing a notice requirement can weaken a claim even when the theft is clear. Ask the insurer what records they will need, because they may want the same evidence you are already collecting.
Police and the bank
Reporting to police is your choice, informed by advice. A report may help with recovery and may be required by an insurer. Tell your bank once you have changed access, so they can watch for unusual activity and preserve records on their side.
Is it embezzlement or a bookkeeping mess?
Sometimes what looks like embezzlement is disorder: missed entries, a reconciliation never done, receipts in a drawer and an overwhelmed bookkeeper. The difference is direction. Mistakes tend to go both ways and leave no one better off. Theft consistently benefits one person and is concealed, often with changed records or missing documents.
Signs that point to a mess rather than theft:
- Errors that favor the business as often as they cost it.
- Payments that are odd but went to real suppliers for real goods.
- A bookkeeper who readily shares files and explains gaps.
- Problems that started when the workload grew or a system changed.
Signs that point the other way:
- Money moving to the bookkeeper, their relatives or a business they control.
- Statements that do not match the bank's own copy.
- Resistance to anyone else seeing the bank statements or covering their work.
When not to treat it as a crime
If the first review finds only disorder, treat it as a process problem. Bring in help to rebuild the books, add a second person to review the bank statements each month, and keep your notes of what you checked. Accusing someone of theft on the strength of messy books can damage a working relationship, and it can expose the business to a claim, when the real problem was a job that had outgrown one person.