How to recognize internal theft, protect evidence, and build a defensible case — without stepping outside the law.

Few problems feel more personal than discovering that the loss on your books is coming from inside the building. Occupational fraud is also stubbornly common and expensive. In its most recent global study, the Association of Certified Fraud Examiners found a median loss of roughly $104,000 per case, with the typical scheme running about 12 months before anyone caught it — and small businesses are disproportionately hit because they run leaner controls. See the ACFE’s Report to the Nations for the full data.

The instinct to march down the hall and confront the person you suspect is understandable. It is also the fastest way to lose the case. This guide walks through what employee theft actually looks like, how to preserve evidence before you tip anyone off, and the lawful investigative steps that hold up for termination, prosecution, and insurance recovery.

Warning Signs of Internal Theft

Rarely does a single red flag prove anything. Patterns matter more than incidents. Watch for:

Inventory shrinkage or cash shortages that cluster around one person’s shifts, register, or department.
An employee who refuses to take vacation, resists cross-training, or insists on personally handling one account or process.
Vendor invoices that never quite reconcile, round-number payments, or a supplier no one but one employee has met.
Lifestyle changes that outpace a known salary, paired with unusual defensiveness about their work.
Missing documentation, altered records, voided transactions, or after-hours system access with no business reason.

Common Types of Employee Theft

Cash schemes: skimming before a sale is recorded, larceny after, and fraudulent refunds or voids.
Inventory and asset theft: product, equipment, tools, or supplies walking out the door, often masked as damage or shrink.
Data theft: client lists, trade secrets, and files copied to personal drives — frequently as an employee prepares to leave for a competitor.
Time and payroll fraud: padded hours, buddy punching, ghost employees, or inflated commissions.
Vendor, billing, and kickback schemes: shell suppliers, inflated invoices, or a purchasing employee taking payments to steer contracts.

Preserve First, Before You Confront

This is the step business owners skip most often, and it is the one that decides whether you recover anything. The moment a suspect senses they are being watched, records get deleted, inventory gets returned, and stories get aligned. Before you say a word:

Quietly secure the originals — ledgers, invoices, schedules, surveillance footage, and access logs — and note who had custody of each.
Do not log into the employee’s workstation, phone, or accounts yourself. Improper access can destroy metadata and expose you to liability. Preserve the device intact.
Avoid mass emails, accusatory meetings, or gossip. Keep the circle of people who know as small as possible.
Write down what you know and when you learned it. A clean timeline is the backbone of every later decision.

A professional digital forensics examiner can image a computer or phone in a way that preserves evidence and keeps it admissible — something an internal “quick look” almost always ruins.

Lawful Investigation Steps

A defensible investigation moves methodically, documenting each step:

Document review. Reconcile financials, match invoices to deliveries, audit voids and refunds, and compare timecards to access logs. Most cases are proven on paper first.
Digital forensics. Company-owned devices and systems can be examined for deleted files, data exfiltration, and email trails when done by a qualified examiner following proper chain-of-custody procedures.
Covert surveillance where legal. Observation of company premises can confirm theft in progress. What is permissible varies by state and setting — audio recording and areas with a reasonable expectation of privacy have strict limits — so this belongs with a licensed professional. Learn more about surveillance services.
Background and asset checks. A lawful review can surface prior undisclosed history or connections to a suspect vendor. See background checks.
Interviews. Structured, non-coercive interviews — typically saved for last, after the evidence is assembled — are where a well-built case often closes.

What NOT to Do

Don’t accuse before you have proof. A premature accusation can trigger defamation or wrongful-termination exposure — and warns the thief.
Don’t search personal property, vehicles, phones, or personal accounts without clear legal authority. Illegal searches taint your evidence and can become your liability.
Don’t use a polygraph as a shortcut. Most private employers are sharply restricted from requiring lie-detector tests under federal law.
Don’t detain, coerce, or threaten. Let evidence and, where appropriate, law enforcement do that work.
Don’t handle evidence casually. Broken chain of custody sinks otherwise strong cases.

Building a Case That Actually Holds Up

The goal is a package that stands on its own for whichever path you choose — and often all three. For termination, you want documented policy violations and consistent, evenhanded treatment. For prosecution, you want an evidence file investigators and prosecutors can act on without re-doing your work. For insurance recovery under an employee-dishonesty or crime policy, you want quantified losses supported by records and, frequently, a formal investigative report. The same disciplined evidence trail serves every one of these.

When to Hire a Licensed Investigator — and Coordinate With Counsel

Bring in professionals early when losses are significant, the scheme is sophisticated, the suspect holds a position of trust, or you intend to prosecute or file a claim. A licensed investigations team conducts the work within the law, preserves admissibility, and produces a report that holds up under scrutiny — the things internal efforts most often get wrong.

Loop in an employment attorney in parallel. Counsel guides lawful process, protects certain communications, and helps you avoid missteps in discipline and termination. Investigators and attorneys work best as a coordinated team, not in sequence after something has already gone wrong.

Frequently Asked Questions

Should I confront the employee as soon as I suspect theft?

No. Confrontation before you have preserved evidence and understood the full scope almost always destroys records and warns accomplices. Secure the evidence and consult a professional first.

Can I read an employee’s work email or search their company computer?

Company-owned systems can often be reviewed, but the manner matters. A DIY look can spoliate evidence and raise privacy issues. Have a qualified forensic examiner handle company devices and steer clear of personal accounts and property entirely.

Is covert surveillance of employees legal?

Sometimes, within limits that vary by state. Video in non-private work areas is more permissible than audio recording or watching areas where people expect privacy. Because the rules are specific, use a licensed provider.

Will an investigation help me recover money?

It can. A properly documented case supports restitution through prosecution and claims under employee-dishonesty or crime insurance coverage — both of which typically require the kind of quantified, well-evidenced report a professional investigation produces.

Talk to a Licensed Investigator

Honeybadger Solutions is a veteran-owned (SDVOSB), licensed private investigation and digital forensics firm serving clients nationwide. If you suspect internal theft, protect your evidence and your business by talking to a professional before you act. Call 602-725-2818 or book a confidential consultation.

This article is for general information only and is not legal advice; consult a licensed attorney about your specific situation.