How to recognize internal theft, protect evidence, and build a defensible case — without stepping outside the law.
Few problems feel more personal than discovering that the loss on your books is coming from inside the building. Occupational fraud is also stubbornly common and expensive. In its most recent global study, the Association of Certified Fraud Examiners found a median loss of roughly $104,000 per case, with the typical scheme running about 12 months before anyone caught it — and small businesses are disproportionately hit because they run leaner controls. See the ACFE’s Report to the Nations for the full data.
The instinct to march down the hall and confront the person you suspect is understandable. It is also the fastest way to lose the case. This guide walks through what employee theft actually looks like, how to preserve evidence before you tip anyone off, and the lawful investigative steps that hold up for termination, prosecution, and insurance recovery. For a departing employee or trade secret matter, our IP theft investigation service preserves and examines the evidence, and you can request it online.
Warning Signs of Internal Theft
Rarely does a single red flag prove anything. Patterns matter more than incidents. Watch for:
- Inventory shrinkage or cash shortages that cluster around one person’s shifts, register, or department.
- An employee who refuses to take vacation, resists cross-training, or insists on personally handling one account or process.
- Vendor invoices that never quite reconcile, round-number payments, or a supplier no one but one employee has met.
- Lifestyle changes that outpace a known salary, paired with unusual defensiveness about their work.
- Missing documentation, altered records, voided transactions, or after-hours system access with no business reason.
Common Types of Employee Theft
- Cash schemes: skimming before a sale is recorded, larceny after, and fraudulent refunds or voids.
- Inventory and asset theft: product, equipment, tools, or supplies walking out the door, often masked as damage or shrink.
- Data theft: client lists, trade secrets, and files copied to personal drives — frequently as an employee prepares to leave for a competitor.
- Time and payroll fraud: padded hours, buddy punching, ghost employees, or inflated commissions.
- Vendor, billing, and kickback schemes: shell suppliers, inflated invoices, or a purchasing employee taking payments to steer contracts.
Preserve First, Before You Confront
This is the step business owners skip most often, and it is the one that decides whether you recover anything. The moment a suspect senses they are being watched, records get deleted, inventory gets returned, and stories get aligned. Before you say a word:
- Quietly secure the originals — ledgers, invoices, schedules, surveillance footage, and access logs — and note who had custody of each.
- Do not log into the employee’s workstation, phone, or accounts yourself. Improper access can destroy metadata and expose you to liability. Preserve the device intact.
- Avoid mass emails, accusatory meetings, or gossip. Keep the circle of people who know as small as possible.
- Write down what you know and when you learned it. A clean timeline is the backbone of every later decision.
A professional digital forensics examiner can image a computer or phone in a way that preserves evidence and keeps it admissible — something an internal “quick look” almost always ruins.
Lawful Investigation Steps
A defensible investigation moves methodically, documenting each step:
- Document review. Reconcile financials, match invoices to deliveries, audit voids and refunds, and compare timecards to access logs. Most cases are proven on paper first.
- Digital forensics. Company-owned devices and systems can be examined for deleted files, data exfiltration, and email trails when done by a qualified examiner following proper chain-of-custody procedures.
- Covert surveillance where legal. Observation of company premises can confirm theft in progress. What is permissible varies by state and setting — audio recording and areas with a reasonable expectation of privacy have strict limits — so this belongs with a licensed professional. Learn more about surveillance services.
- Background and asset checks. A lawful review can surface prior undisclosed history or connections to a suspect vendor. See background checks.
- Interviews. Structured, non-coercive interviews — typically saved for last, after the evidence is assembled — are where a well-built case often closes.
What NOT to Do
- Don’t accuse before you have proof. A premature accusation can trigger defamation or wrongful-termination exposure — and warns the thief.
- Don’t search personal property, vehicles, phones, or personal accounts without clear legal authority. Illegal searches taint your evidence and can become your liability.
- Don’t use a polygraph as a shortcut. Most private employers are sharply restricted from requiring lie-detector tests under federal law.
- Don’t detain, coerce, or threaten. Let evidence and, where appropriate, law enforcement do that work.
- Don’t handle evidence casually. Broken chain of custody sinks otherwise strong cases.
Building a Case That Actually Holds Up
The goal is a package that stands on its own for whichever path you choose — and often all three. For termination, you want documented policy violations and consistent, evenhanded treatment. For prosecution, you want an evidence file investigators and prosecutors can act on without re-doing your work. For insurance recovery under an employee-dishonesty or crime policy, you want quantified losses supported by records and, frequently, a formal investigative report. The same disciplined evidence trail serves every one of these.
When to Hire a Licensed Investigator — and Coordinate With Counsel
Bring in professionals early when losses are significant, the scheme is sophisticated, the suspect holds a position of trust, or you intend to prosecute or file a claim. A licensed investigations team conducts the work within the law, preserves admissibility, and produces a report that holds up under scrutiny — the things internal efforts most often get wrong.
Loop in an employment attorney in parallel. Counsel guides lawful process, protects certain communications, and helps you avoid missteps in discipline and termination. Investigators and attorneys work best as a coordinated team, not in sequence after something has already gone wrong.
Frequently Asked Questions
Should I confront the employee as soon as I suspect theft?
No. Confrontation before you have preserved evidence and understood the full scope almost always destroys records and warns accomplices. Secure the evidence and consult a professional first.
Can I read an employee’s work email or search their company computer?
Company-owned systems can often be reviewed, but the manner matters. A DIY look can spoliate evidence and raise privacy issues. Have a qualified forensic examiner handle company devices and steer clear of personal accounts and property entirely.
Is covert surveillance of employees legal?
Sometimes, within limits that vary by state. Video in non-private work areas is more permissible than audio recording or watching areas where people expect privacy. Because the rules are specific, use a licensed provider.
Will an investigation help me recover money?
It can. A properly documented case supports restitution through prosecution and claims under employee-dishonesty or crime insurance coverage — both of which typically require the kind of quantified, well-evidenced report a professional investigation produces.
Talk to a Licensed Investigator
Honeybadger Solutions is a veteran-owned (SDVOSB), licensed private investigation and digital forensics firm serving clients nationwide. If you suspect internal theft, protect your evidence and your business by talking to a professional before you act. Book a confidential consultation.
Related: Investigations · Digital Forensics · Surveillance Services · Background Checks
This article is for general information only and is not legal advice; consult a licensed attorney about your specific situation.
The controls that would have prevented it
Nearly every internal theft investigation ends with the same finding: a control that exists on paper was not operating. Reviewing them is worth doing before you need an investigation and again after one.
Segregation of duties. The person who authorises a payment should not be the person who enters the vendor, and neither should reconcile the account. Most embezzlement in small organisations is possible because one trusted person does all three, usually because the business is too small to separate them — which is a reason for compensating controls, not for accepting the exposure.
Independent reconciliation. Bank statements reviewed by someone outside the accounting function, even briefly, is one of the highest-return controls available to a small business. Owners who open the statement themselves each month catch things no system catches.
Vendor master discipline. New vendors require approval and verification of banking details through an independent channel. Fictitious vendor schemes run for years in organisations where anyone can add a payee.
Mandatory time away. Schemes that require constant maintenance — lapping receivables, covering a missing deposit each week — collapse when the person is away and someone else handles the work. Enforced, uninterrupted leave is a genuine detective control.
Inventory cycle counts performed by someone who does not control the inventory.
How loss is quantified, and why that matters before you act
Employers routinely act on a suspicion and then discover they cannot put a number on it, which undermines everything that follows — termination, restitution, insurance, prosecution.
Quantification usually comes from reconstructing records rather than from a confession: comparing authorised payments against supporting documentation, matching inventory movements against sales, analysing transaction timing and amounts for patterns, reviewing voids, refunds and discounts by employee, and comparing the suspect’s activity against peers doing the same job. Payroll, expense reimbursement and purchasing card data are frequently more productive than anyone expects.
Do this before the confrontation. A documented figure changes the conversation entirely, and it is the difference between a restitution agreement that holds and one that unravels.
Insurance, and the notice trap
Employee dishonesty coverage — sometimes called a fidelity bond or crime coverage — is common and commonly mishandled.
Three things determine whether a claim pays. Notice timing: most policies require prompt notice after discovery, and an employer who investigates quietly for three months before notifying can find the claim denied on that basis alone. Proof of loss: policies require documentation to a standard, which is another reason quantification matters. Policy conditions: some require a police report; some exclude losses discovered after the employee left; some require prosecution to be pursued.
Read the policy early in the process, not at the end. Notify the carrier on the timeline the policy requires even if the investigation is incomplete — a notice of circumstances preserves the claim while you continue working.
Employment law runs alongside the investigation
Every step of an internal theft investigation is also an employment matter, and the two sets of obligations do not always point the same way.
Searches of company property are generally permissible where a clear policy exists and expectations of privacy have been reduced; searches of personal property and personal devices are a different question entirely. Monitoring must be consistent with your policies and applied consistently across employees, because selective enforcement is where discrimination claims come from. Interviews should be conducted with two people present, documented contemporaneously, and free of any suggestion that the employee is not free to leave — detaining someone in a conference room converts an interview into a false imprisonment claim.
Final pay, accrued leave and deductions are governed by Arizona wage law, and withholding pay to offset an alleged theft is one of the most common and expensive mistakes an employer makes. Pay what is owed, pursue recovery separately, and take advice first.
Prosecution, civil recovery, or neither
These are three different paths with different burdens and different outcomes, and it is worth deciding deliberately rather than by default.
Criminal referral costs little, may produce restitution ordered as part of a sentence, and removes your control over timing and outcome. Prosecutors decline cases that are poorly documented, so the quality of your file determines whether it goes anywhere.
Civil action gives you control and a lower burden of proof, and it is only worth pursuing if the person has assets or income to collect against. An asset check before filing avoids winning an uncollectible judgment.
Restitution agreement resolves matters quickly and privately and depends on voluntary compliance. If you take this path, document it properly, secure it where possible, and be realistic about default.
Many employers pursue more than one, and some deliberately pursue none — reputational and operational considerations are legitimate factors. Make it a decision.
What to do in the first forty-eight hours
- Preserve access logs, camera footage, email and financial records before retention windows close. Do not let anyone “clean up.”
- Restrict the suspect’s access quietly where it can be done without signalling — this is a judgement call and sometimes it cannot.
- Read the insurance policy and calendar the notice deadline.
- Engage counsel, and consider engaging the investigator through counsel.
- Do not confront, and do not discuss the matter with other staff.
- Begin quantification from records rather than assumptions.
This is general information and not legal advice. Employment, wage and privacy obligations vary; consult counsel before acting on a specific matter.
Related sector pages
- Retail loss prevention and security in Arizona — Shrink, point-of-sale exception reporting and the internal-versus-external split in a retail setting.
- Arizona Cybercrime Index — Reported cybercrime and fraud data for the state, updated as new figures are published.
Browse by topic
Security guard services · Private investigations · Cybersecurity · Digital forensics · Financial fraud investigation · Executive protection · All articles