🔒 Find an Employee Who Embezzled or Stole: Investigation & Recovery Guide ()

Discovering that an employee has stolen from your business is a gut punch that goes beyond the financial loss—it’s a betrayal of trust that can threaten your company’s survival. Whether it’s embezzlement, inventory theft, data theft, or misuse of company funds, this guide walks you through every step of locating the employee, building your case, recovering stolen assets, and pursuing both criminal prosecution and civil recovery.

Employee theft and embezzlement are far more common than most business owners realize. The problem spans every industry and company size, from small family businesses to major corporations. Employees with access to finances, inventory, customer data, or company accounts can cause devastating losses over weeks, months, or even years before the theft is discovered. In many cases, the employee has already left the company—or abruptly disappeared—by the time the losses come to light.

The financial impact on businesses is staggering. According to the Association of Certified Fraud Examiners, the typical organization loses 5% of annual revenue to occupational fraud. Small businesses are hit especially hard because they often lack the internal controls and oversight that larger companies use to detect and prevent theft. A single dishonest employee can steal enough to bankrupt a small company, destroy years of hard work, and leave the owner struggling to recover.

If an employee has stolen from your business, acting quickly and strategically is essential. You need to locate the individual, preserve evidence, understand your legal options for both criminal prosecution and civil recovery, and take steps to prevent future losses. This comprehensive guide provides the roadmap for each of these critical steps.

$150K
Median Loss Per Employee Fraud Case
18 mos
Average Time Before Detection
75%
Of Employees Have Stolen at Least Once
24 hrs
Professional Skip Trace Time

🚨 Types of Employee Theft

Employee theft takes many forms, and understanding the type of theft you’re dealing with affects your investigation strategy and legal options.

💰

Embezzlement

Misappropriating funds entrusted to the employee’s care. This includes skimming cash, diverting payments, writing checks to fake vendors, unauthorized wire transfers, and manipulating accounting records to conceal theft. Embezzlement is often the most financially damaging form of employee theft.

📦

Inventory Theft

Stealing physical products, materials, equipment, or supplies from the workplace. Ranges from office supplies to expensive merchandise or raw materials. May involve falsifying inventory records to hide the theft or creating fake shipments.

💳

Credit Card/Expense Fraud

Misusing company credit cards for personal purchases, submitting false expense reports, inflating reimbursement claims, or making unauthorized purchases on company accounts.

💻

Intellectual Property Theft

Stealing trade secrets, customer lists, proprietary software, designs, formulas, or confidential business information—often to take to a competitor or to start a competing business.

👥

Payroll Fraud

Creating ghost employees, inflating hours, altering pay rates, continuing to collect paychecks after termination, or manipulating commission calculations to pay themselves more than earned.

🏗️

Kickback Schemes

Receiving secret payments from vendors or contractors in exchange for directing business their way, approving inflated invoices, or overlooking poor performance. Often involves collusion with outside parties.

🔍 Immediate Steps After Discovering Theft

The actions you take in the first 24-72 hours after discovering employee theft are critical. Mistakes made now can compromise your ability to prosecute or recover losses later.

Do NOT confront the employee directly before consulting with an attorney and preserving evidence. Premature confrontation gives them time to destroy evidence, hide assets, or flee. Your first priority is securing evidence and protecting your business from further losses.

🔐 Step 1: Secure Evidence Immediately

✓
Preserve Digital Records: Immediately back up all relevant computer files, emails, financial software data, access logs, and security camera footage before anything can be altered or deleted.
✓
Secure Financial Records: Lock down bank statements, canceled checks, credit card statements, invoices, purchase orders, and accounting records related to the theft.
✓
Document the Discovery: Write down exactly how and when the theft was discovered, who discovered it, and what evidence exists. Create a detailed timeline of the suspected theft.
✓
Restrict Access: Immediately change passwords, revoke system access, disable security badges, and lock the employee out of all company systems, accounts, and facilities.
✓
Inventory Physical Assets: Conduct an immediate count of inventory, equipment, and supplies in the area the employee had access to. Document everything that’s missing.

📋 Step 2: Consult Professionals

1

⚖️ Hire an Attorney

An employment or criminal defense attorney (on the prosecution side) can guide your investigation, preserve your legal options, and ensure you don’t inadvertently compromise your case. This is essential before contacting law enforcement.

2

📊 Engage a Forensic Accountant

For embezzlement and financial fraud, a forensic accountant can trace the stolen funds, quantify losses, identify the methods used, and prepare evidence that holds up in court. Their report becomes key evidence.

3

🚔 File a Police Report

Report the theft to law enforcement. Criminal prosecution creates additional pressure on the employee and may result in court-ordered restitution. Provide police with your evidence and the forensic accountant’s findings.

4

🛡️ Notify Your Insurance

If you have employee dishonesty coverage (fidelity bond), crime insurance, or a commercial policy with theft provisions, file a claim. These policies may cover some or all of your losses.

🎯 Locating the Employee Who Stole

If the employee has already left the company or disappeared, you’ll need to locate them for both criminal prosecution and civil recovery. Here’s how to find them.

📁 Information from Your Employment Records

📁 Mine Your HR Files

Your employee files contain a wealth of information for locating them: their full legal name and Social Security Number, home address (possibly multiple addresses over the course of their employment), phone numbers, emergency contacts (often family members who know their whereabouts), references listed on their application, previous employers, vehicle information (if they had a parking pass or company vehicle), and banking information from direct deposit. The Social Security Number is especially valuable because it enables professional skip tracing services to locate them through credit bureau data, which tracks their most recent address.

💻 Digital Footprint Investigation

💻 Leverage Technology

Employees who steal often leave digital trails even after they leave. Check company email records for forwarded emails or contacts that might reveal where they went. Review company cell phone records if they had a company device—call history can show contacts and frequent locations. Check if they updated LinkedIn with a new employer or location. Search social media for lifestyle upgrades that don’t match their salary—expensive purchases, new cars, or luxury vacations can indicate where stolen funds went and where the person currently is. IP addresses from their last logins to company systems may also reveal their location.

🔍 Professional Skip Tracing

🔍 Expert Location Services

When internal resources aren’t sufficient, professional skip tracing services provide the fastest and most reliable way to locate a former employee. With the individual’s Social Security Number from your employment records, professional services can access credit bureau header data showing their current address, utility connection records, vehicle registration information, and employment history. Results typically come back within 24 hours. For embezzlement cases involving significant losses, the cost of skip tracing ($75-150) is negligible compared to the potential recovery.

⚡ 24-Hour Turnaround
🗺️ All 50 States
🔒 Confidential
📊 Database-Verified
🎯 85%+ Success Rate

🔒 Need to Locate an Employee Who Stole from Your Business?

Our professional skip tracing team specializes in locating individuals for fraud and theft recovery. With access to comprehensive databases and over 20 years of experience, we find the people who took your money—typically within 24 hours.

Find Your Former Employee Now →

⚖️ Criminal Prosecution

Criminal prosecution of employee theft serves multiple purposes: it can result in restitution orders requiring the employee to repay what they stole, it creates leverage for civil recovery, and it deters other employees from stealing.

🚔 Filing Criminal Charges

🚔 Working with Law Enforcement

File a detailed police report including all evidence you’ve gathered. For larger thefts, the case may be investigated by a detective specializing in financial crimes. Provide the forensic accountant’s report, documentation of the theft, and the employee’s identifying information. Law enforcement may take weeks or months to investigate, but your thorough documentation speeds the process. For significant amounts, the case may be referred to the district attorney’s office for felony prosecution. Employee theft and embezzlement are criminal offenses in every state, with penalties ranging from misdemeanors for smaller amounts to serious felonies for larger thefts.

📋 Criminal Penalties by Theft Amount

Theft Amount Typical Classification Potential Penalties
Under $1,000 Misdemeanor (Petty Theft) Up to 1 year jail, fines, restitution
$1,000 – $10,000 Misdemeanor or Low Felony 1-5 years prison, fines, restitution
$10,000 – $100,000 Felony (Grand Theft) 2-10 years prison, significant fines, restitution
Over $100,000 Serious Felony 5-20+ years prison, heavy fines, full restitution
Federal Cases Federal Felony Up to 30 years if wire/mail fraud involved
Criminal restitution orders can be powerful collection tools. When the court orders the defendant to pay restitution as part of their sentence, failure to pay can result in probation violations and additional jail time. This creates strong motivation for the former employee to repay what they stole. Restitution orders can also be enforced like civil judgments in most states.

💼 Civil Recovery Options

In addition to criminal prosecution, you can (and should) pursue civil recovery. Civil lawsuits give you more control over the process and potentially greater financial recovery than criminal restitution alone.

📋 Civil Lawsuit for Damages

📋 What You Can Recover

A civil lawsuit against the former employee can recover the actual amount stolen (compensatory damages), consequential damages caused by the theft (lost business, investigation costs, audit fees), punitive damages in some jurisdictions to punish particularly egregious conduct, attorney fees and court costs in many states, and pre-judgment and post-judgment interest on the stolen amounts. Civil suits have a lower burden of proof than criminal cases (preponderance of the evidence versus beyond reasonable doubt), making them easier to win. You can pursue civil action even if the criminal case doesn’t result in conviction.

💰 Asset Recovery Strategies

💰 Finding and Seizing Stolen Assets

  • 🏠 Property Liens: Place liens on real estate purchased with stolen funds or owned by the former employee
  • 🚗 Vehicle Seizure: Identify and seize vehicles bought with embezzled money
  • 💳 Bank Account Freeze: Obtain court orders to freeze bank accounts containing stolen funds before they can be dissipated
  • 📊 Wage Garnishment: After judgment, garnish wages from the employee’s current employer
  • 🔍 Asset Discovery: Use court-ordered depositions and interrogatories to force disclosure of all assets
Consider filing for a prejudgment attachment or temporary restraining order (TRO) early in the case. These court orders can freeze the employee’s bank accounts and prevent them from selling assets before your lawsuit is resolved. Speed matters because embezzlers often spend, hide, or transfer stolen funds quickly once they know they’ve been caught.

🛡️ Insurance Recovery

Several types of business insurance may cover employee theft losses. Check your policies carefully and file claims promptly.

📋

Fidelity Bonds

Employee dishonesty bonds specifically cover losses from employee theft, embezzlement, and fraud. These can provide significant recovery and are essential for businesses that handle cash or financial transactions.

🏢

Commercial Crime Insurance

Broader crime insurance policies may cover employee theft as well as computer fraud, funds transfer fraud, and forgery. Review your policy declarations page for specific coverage types and limits.

📊

Business Owner’s Policy (BOP)

Some BOPs include limited employee theft coverage as a standard inclusion. Check whether your policy has this provision and what the limits are. The coverage may be relatively small compared to the loss.

💻

Cyber Insurance

If the theft involved electronic funds, data theft, or computer-related fraud, your cyber insurance policy may provide coverage. This is increasingly relevant as more embezzlement involves digital transactions.

🔐 Preventing Future Employee Theft

Once you’ve addressed the current theft, implementing stronger controls protects your business from future losses.

✅ Essential Internal Controls

✓
Separation of Duties: No single employee should control an entire financial process. Separate authorization, custody, and record-keeping functions so that theft requires collusion.
✓
Regular Audits: Conduct surprise audits of cash, inventory, and financial records. External audits are more credible than internal reviews, and the threat of audit deters dishonest behavior.
✓
Background Checks: Screen all employees before hire, especially those with access to money, inventory, or sensitive information. Check criminal history, credit history, and employment references.
✓
Bank Reconciliation: Reconcile bank statements monthly, and have someone other than the person who writes checks or handles deposits perform the reconciliation.
✓
Expense Oversight: Require receipts for all expenses, review credit card statements carefully, and have a supervisor approve all purchases above a specified threshold.
✓
Security Systems: Install cameras in areas with cash, inventory, or sensitive equipment. Use access controls, login monitoring, and activity alerts for financial systems.
✓
Whistleblower Hotline: Create a confidential way for employees to report suspicious activity. Many fraud schemes are discovered through tips from coworkers rather than through audits.
✓
Mandatory Vacations: Require employees in financial positions to take at least one consecutive week of vacation annually. Many embezzlement schemes are discovered when the perpetrator is absent and someone else handles their duties.

📊 Red Flags That Indicate Employee Theft

Recognizing the warning signs of employee theft can help you catch it earlier and limit your losses. While none of these indicators prove theft on their own, multiple red flags appearing together warrant investigation.

🚩 Behavioral Warning Signs

✓
Lifestyle Changes: An employee suddenly driving an expensive new car, wearing designer clothes, taking luxury vacations, or buying a house that doesn’t match their salary should raise questions about the source of their income.
✓
Refusing Vacation: Employees who never take time off may be afraid their scheme will be discovered while they’re away. Mandatory vacation policies exist specifically to catch this pattern.
✓
Working Unusual Hours: Coming in early, staying late, or working weekends when no one else is around provides opportunity to steal without witnesses or oversight.
✓
Defensiveness About Their Work: Getting unusually defensive when asked questions about their area of responsibility or resisting audits or reviews of their work product.
✓
Close Vendor Relationships: Unusually close personal relationships with specific vendors can indicate kickback schemes or collusion.
✓
Financial Difficulties: Employees experiencing financial stress—gambling problems, substance abuse, divorce, excessive debt—are statistically more likely to rationalize stealing from their employer.

📉 Financial Red Flags

📉

Unexplained Shortages

Cash register shortages, inventory discrepancies, or missing supplies that can’t be explained by normal business operations. Small, consistent shortages often indicate ongoing theft rather than one-time errors.

📄

Altered Documents

Voided transactions, modified invoices, duplicate payments, unusual journal entries, or checks written to unfamiliar vendors. Any pattern of financial document irregularities warrants investigation.

📊

Revenue Trends

Revenue declining while business activity remains steady, or profit margins shrinking without clear market reasons. Embezzlement often shows up as unexplained revenue or profit declines.

🧾

Expense Anomalies

Expenses increasing faster than business growth, unusual vendor payments, or expenses in categories that don’t align with business operations. Unusual spikes in certain expense categories deserve scrutiny.

🏛️ Working with Law Enforcement Effectively

Getting law enforcement to investigate employee theft can sometimes be challenging, especially for smaller amounts. Here’s how to make your case compelling.

📋 Preparing Your Police Report

Don’t just walk into a police station and say “my employee stole from me.” Come prepared with a written summary of the theft (who, what, when, where, how much), the forensic accountant’s report or your own detailed documentation, copies of relevant financial records, the employee’s full identifying information (name, date of birth, Social Security Number, last known address, vehicle information), and any admissions or confessions (recorded or in writing, if applicable). The more organized and well-documented your complaint, the more seriously law enforcement will take it and the faster the investigation will proceed.

🔄 If Police Won’t Investigate

If local police are reluctant to investigate—which can happen with smaller amounts or overwhelmed departments—you have options. Contact the district attorney’s office directly, as they may accept cases that police don’t actively investigate. For wire fraud or mail fraud (common in embezzlement schemes), contact the FBI or U.S. Postal Inspection Service, as these become federal crimes. State attorneys general may investigate cases involving certain industries. Meanwhile, your civil lawsuit continues regardless of whether criminal charges are pursued. You don’t need a criminal conviction to win a civil case and recover your money.

❓ Frequently Asked Questions

Here are detailed answers to the most common questions about finding and recovering from employee theft:

Absolutely—and you should. Criminal prosecution and civil litigation are separate legal proceedings with different purposes. Criminal charges punish the behavior and can result in restitution orders, while civil lawsuits compensate your business for losses. You don’t have to choose one or the other. In fact, a criminal conviction makes the civil case easier because the conviction can be used as evidence in the civil proceeding. Start both processes as soon as possible.
Even if the stolen funds have been spent, you still have recovery options. A civil judgment remains enforceable for 10-20 years and accrues interest. You can garnish future wages, place liens on property they acquire later, and levy bank accounts when funds appear. Criminal restitution orders create ongoing obligation to repay, with jail time as a consequence of non-payment. The employee may also have assets—homes, vehicles, retirement accounts—that can be reached through the judgment enforcement process.
For significant amounts (generally over $10,000), hiring professionals is strongly recommended. Forensic accountants, private investigators, and attorneys bring expertise that strengthens your case and avoids mistakes that could compromise it. Internal investigations can miss evidence, inadvertently destroy data, or create legal liability if conducted improperly. Professionals know how to preserve evidence, document findings in a way that holds up in court, and avoid actions that could be seen as harassment or privacy violations.
Employees who flee after stealing can still be prosecuted and sued. For interstate cases, many states have extradition agreements that allow law enforcement to bring the individual back for criminal prosecution. Civil lawsuits can be filed in the state where the theft occurred, and judgments can be domesticated in other states for enforcement. For employees who flee internationally, recovery is more complex but not impossible—it may involve working with federal law enforcement, international recovery attorneys, or foreign courts depending on the country.
In most states (at-will employment), you can terminate an employee at any time for any legal reason. However, consult with an attorney before terminating a suspected thief. In some cases, it may be strategic to keep them employed temporarily while gathering evidence—if they don’t know they’re under investigation, they may continue patterns that generate additional evidence. Your attorney can advise on the best timing for termination based on the specifics of your case.
Statutes of limitations vary by state and by the type of claim. Criminal statutes typically range from 3-7 years for theft-related offenses, with some states allowing longer periods for embezzlement. Civil statutes for fraud and conversion typically run 3-6 years. The clock usually starts when the theft is discovered (or reasonably should have been discovered), not when it occurred. This “discovery rule” is important because embezzlement often continues for months or years before detection.
Filing a claim may affect your premiums, but the financial recovery from the claim typically far outweighs any premium increase. Additionally, implementing stronger internal controls after the incident can help keep premiums manageable. Your insurance agent can discuss the specific implications for your policy. Not filing a legitimate claim means absorbing the entire loss yourself, which is rarely the better financial choice.
Generally, family members aren’t liable for the employee’s theft unless they participated in the scheme or received stolen funds. However, if the employee transferred assets to family members to avoid collection (fraudulent conveyance), you may be able to recover those assets through the courts. For example, if the employee transferred a house into their spouse’s name right after the theft was discovered, a court can potentially reverse that transfer. Forensic accountants can trace fund flows to identify where stolen money ended up.
Debts arising from embezzlement, larceny, and fraud are generally non-dischargeable in bankruptcy. This means the employee cannot wipe out what they owe you by filing for bankruptcy protection. You’ll need to file an adversary proceeding in the bankruptcy case to establish that the debt is non-dischargeable. This typically requires proving the debt resulted from fraud, defalcation while acting in a fiduciary capacity, or willful and malicious injury—all of which apply to employee theft. An attorney experienced in bankruptcy adversary proceedings can handle this for you.
Costs vary significantly based on the complexity of the case. Skip tracing to locate the employee typically costs $75-150 and is one of the most cost-effective investments in the process. Forensic accounting generally runs $5,000-25,000 or more depending on how long the scheme lasted and the complexity of the financial records. Attorney fees for civil litigation vary widely—from a few thousand dollars for straightforward cases to tens of thousands for complex embezzlement schemes. However, many civil suits against former employees result in recovery of attorney fees as part of the judgment. For smaller theft amounts under your state’s small claims limit, you can file in small claims court with minimal filing fees and no attorney. Always weigh the total expected costs against the amount at stake, and discuss fee structures with your attorney early in the process—some may work on contingency arrangements for larger cases where recovery is likely.
A forensic accountant is essential for complex embezzlement and financial fraud cases. They trace the flow of stolen funds through financial records, quantify the total amount stolen (which is often much larger than initially estimated), identify the methods the employee used to steal and conceal the theft, prepare detailed reports that serve as evidence in both criminal and civil proceedings, provide expert testimony in court, and help identify where the stolen money went—including accounts, purchases, or transfers to third parties. Their work often reveals that the theft was far more extensive than initially believed, which affects both the criminal charges and civil recovery amounts.
Generally no—a new employer isn’t liable simply for hiring someone who previously committed theft. However, if the new employer knew about the theft and the employee is still engaging in fraudulent activity using their new position, there may be limited circumstances where liability exists. More importantly, knowing the employee’s new employer is valuable for civil collection—you can garnish their wages, serve them at their workplace, and the employment information confirms their current location for legal proceedings. Professional skip tracing often identifies current employment as part of the search results.

📚 Related Resources

Continue your investigation, recovery, and business protection efforts with these comprehensive guides from our team:

🔍
Skip Tracing Services
Professional people location services
📊
Asset Search Services
Find hidden assets and stolen funds
⚖️
Service of Process Guide
Locate people to serve legal papers
🛡️
Find Someone Who Scammed You
Recovery guide for fraud victims

🔒 Employee Theft Demands Swift Action

Every day that passes gives a dishonest former employee more time to hide assets and cover their tracks. Our professional skip tracing team can locate them within 24 hours so you can pursue criminal prosecution and civil recovery.

Locate Your Former Employee Today →