Signs of employee embezzlement every owner should watch for

Most embezzlement isn't caught by an alarm going off. It's caught because a number stopped making sense, or because someone finally covered for the one employee who never let anyone else touch the books. By the time an owner sees it clearly, the theft has usually run for a year or two. The warning signs turn up much earlier. They live in how a person acts and in what the records do, and an owner who knows the pattern can catch them long before an auditor would.

Why the person you trust most is the one who can steal

The employee who steals is almost never a stranger. It's the person with access, the one who's been there for years, whose work nobody double-checks. Criminologist Donald Cressey mapped out why back in 1953, and the pattern still holds. Three things line up before a trusted person crosses the line.

First, a pressure they feel they can't talk about. A gambling debt, a sick relative, a lifestyle that outran the paycheck. Second, an opportunity, which almost always means weak oversight and one person holding too much of the process. Third, a story they tell themselves so they can stay a decent person in their own eyes. "I'm only borrowing it." "The company owes me." "I'll put it back after the busy season." Take away any one of the three and most fraud doesn't happen. The one an owner actually controls is opportunity.

Behavioral red flags you can see without opening the books

You don't need a forensic report to notice these. You need to watch the person, not just the output.

• Won't take a real vacation, and pushes back when anyone offers to cover the books
• Insists on doing work that could easily be shared, like opening the mail or reconciling the bank account alone
• Lives visibly beyond what you pay them, with no obvious second income
• Gets defensive or vague when asked an ordinary question about an account
• Has an unusually cozy relationship with one particular vendor

The vacation one is worth a closer look, because it trips up owners who read it as dedication. A scheme that runs through one person's hands has to be fed. Someone has to intercept the bank statement, answer the vendor who calls about a strange payment, and keep the second set of numbers straight. All of that breaks the moment somebody else sits in the chair for two weeks.

A bookkeeper who refuses to take a vacation isn't showing you loyalty. They may be the only thing standing between you and the discovery of what's gone.

Red flags in the books

The records tell on people too, usually before anyone says a word. Watch for source documents that go missing: a payment with no invoice behind it, bank statements that are always "at the accountant's," adjustments nobody can explain. Real transactions leave paper. Invented ones have gaps.

Look hard at your own vendor list sometime. A supplier with a name one letter off from a real one. A P.O. box where a street address should be. Invoices in suspiciously round numbers, or a vendor whose payments keep climbing while you can't point to anything they actually deliver. Any of those is worth a second pass.

Then there's payroll. A ghost employee collects a paycheck without working there, often a former staffer who was never deactivated, or a made-up name whose direct deposit quietly lands in someone else's account. And keep an eye on your margins. If sales hold steady but gross margin keeps slipping and no one can say why, money may be leaking out through inflated costs, skimmed cash, or padded expense reports.

The shapes these schemes take

A handful of setups account for most of what turns up. The fake vendor is the classic. Someone with authority to approve payments creates a shell company and pays it for nothing, or overpays a real supplier and splits a kickback. The paperwork looks routine. The work behind it doesn't exist.

Check tampering and skimming are harder to catch, because the theft may never touch your books at all. An employee alters payees or forges endorsements, or takes cash before a sale is ever recorded. Skimming leaves no entry to find, so you catch it by comparing what should have come in against what did. Lapping is a cousin of this: a stolen customer payment gets covered by the next customer's payment, and the hole is passed forward until someone stops feeding it.

First moves that don't tip anyone off

If something feels wrong, the instinct is to walk over and ask. Don't. A direct question hands the person time to change records, delete files, or rehearse a cover story, and it can wreck a later investigation or an insurance claim. Move quietly instead.

• Preserve records before anyone knows you're looking. Back up the accounting files, bank access, and email, and delete nothing.
• Keep it close. Talk to one trusted advisor outside the finance function, not the whole office.
• Bring in someone independent. A forensic accountant can test the full population of transactions rather than a sample, trace suspect payments to where the money actually landed, and do it without alerting the employee.
• Use a mandatory vacation as a quiet test. Have someone else run the books for two weeks and see what surfaces.

Embezzlement rarely announces itself, and it rarely stops on its own. If two or three of these signs describe your business right now, the next careful step is worth more than a confrontation you can't take back.

Think something is wrong with your numbers?

Talk to a forensic accountant. It is confidential, and there is no obligation.