Employee theft is a serious issue. When the actions of one (or more) of your employees are placing the company at risk, it’s normal to want to act quickly and fire suspects. Unfortunately, this course of action will probably do more harm than good, as it may destroy morale and invite legal action from the terminated employees. This is why it’s crucial to establish a process for properly investigating employee theft.

To get an expert opinion on how to spot and investigate employee theft and embezzlement, we spoke to Matthew De Leon, Trustify’s VP of Investigations and a licensed private investigator.

The Impact of Employee Theft

Recent data reveals that U.S. employees steal $50 billion annually. Even scarier is how even a small instance of employee theft can snowball into a major financial crisis for the firm. “No one starts out by stealing a million dollars,” says De Leon. “They start by taking something small, say ten dollars from petty cash. When no one notices, they step it up - now they’re inflating expenses on reimbursement forms.” The longer the theft goes unnoticed, the more opportunities the employee has to fortify their scheme by increasing the amounts they steal and involving accomplices.

6 Signs of Employee Theft

It’s essential to take warning signs seriously, pay attention to your auditing process, and listen to any employee that may have a good reason to suspect a problem. Watch for these warning signs of employee theft:

  1. Excessive work (like overtime, working from home, never taking vacation): This can be a sign of someone who doesn’t want their responsibilities in the hands of another employee who may notice irregularities.
  2. Fierce protection of personal or close connections with vendors or clients: Any close connection an employee has with a organization that has a financial relationship with your business should be noted. “In this case, (the thief) is usually getting kickbacks,” explains De Leon. “Say, for example, I (the thief) give you (the vendor) the contract, and in return you give me a cut.” This sort of corruption is particularly common where family relationships intersect with business ones, De Leon notes. For instance if someone has awarded a contract to a family member, you should be asking yourself “are we paying more than we would be paying for someone else with comparable skills? Is this an abuse of power?”
  3. Excessive “travel” or other work-related expenses: Overstating legitimate expenses is a common method of fraud.
  4. Unexplainable extravagances: Large expenditures from an employee that likely cannot afford them is a common sign of theft, corruption, or embezzlement. “Look at Aldrich Ames (a famously corrupt CIA operative),” points out De Leon. “It should have set off a million red flags when he was driving a Jaguar at the pay grade he was at. He was parking a $70,000 car next to Honda Accords.” Try and spot an employee attempting to live the high life without the apparent wherewithal to do so, suggests De Leon - they may be funding their spending with fraud.
  5. Frequent smaller transactions: Petty cash can add up quickly, and lower-level theft is a warning sign of more serious fraud. “Embezzlers usually start out small. If they aren’t caught, this emboldens them,” warns De Leon.
  6. An entitled attitude: Look out for employees that act like they feel underappreciated or undervalued. According to De Leon, these people often feel as if their ill-gotten gains are fair compensation for their work. “Often, a thief will think ‘oh, the owner is making a million dollars a year, but I make $100,000. I’m entitled to fudge my parking expenses.’ They think they’re owed what they take.”

Hire Operatives With Military, Intelligence, and Law Enforcement Experience to Investigate Theft

We've uncovered corruption, vetted partners, tracked down witnesses, and searched the dark web for our clients. Find out what we can do for you:

Request a Consultation

10 Steps to Investigate Employee Theft

If you go into an investigation unprepared or fire employees hastily, you may find yourself in a crippling lawsuit for wrongful termination. Take caution when investigating theft and follow a process. Here are some basic steps to conduct an internal investigation, according to De Leon:

  1. Begin a discreet investigation: Though misconduct is stressful, there’s no use in sounding the alarms. Not only will this signal to a potential thief that they should further hide their actions, it will disrupt workflow and promote paranoia. Start your investigation slowly, examining all employees - including those outside the department in question. “Look at everyone. Otherwise you might build your investigation to fit the theory, rather than building your theory to fit the results of your investigation,” De Leon explains. “This is also why it’s good to have an objective outside investigator - that way no personal feelings will shape the investigation.”
  2. Look for weaknesses in internal processes and create a list of suspects: “I like to look at the systems in place to prevent employee theft and see where the weaknesses are,” says De Leon. Finding these weaknesses will help create a list of potential suspects.
  3. Start narrowing down your list of suspects: According to De Leon, you should start using employee files and critical thinking to start narrowing your list of subjects. “I focus on who has access to the stolen property and how a reasonable person would go about avoiding getting caught. I would look at employee files to see if anything sticks out, too.” Using these techniques you should be able to cut down your list of potential suspects.
  4. Run background checks (real ones, not cheap ones): “If permissible (by the company and the local laws) I would run background checks on the suspected employees,” advises De Leon. “Sadly most people think that cheap, automated background checks are all they need for this. Often these checks miss the sort of information that can be invaluable, like previous terminations.” A proper background check (such as a Trust and Safety Check) will consider past employment, social media presences, and financial information along with criminal records. Use the information provided by the check to look for anything that stands out, like discrepancies between someone’s lifestyle and their pay.
  5. Make small changes to the workplace: According to De Leon, small shifts in processes and routines can force a thief to show their hand. “Make changes to schedules, access privileges to areas, and generally implement small changes that would make the theft harder. Then see who reacts and how.” This helps further narrow the list of suspects and may even drive the thief to out themselves. “A good investigation is conducted by removing things that don’t fit and seeing what remains,” says De Leon.
  6. Interview suspects: De Leon strongly advises anyone investigating employee theft to conduct interviews last. In fact, don’t discuss your investigation with any employees before you reach the interview stage. “Speaking to coworkers can tip off the suspect,” De Leon says. “You don’t know the relationship between the suspect and their colleagues. What if two or more employees are in this together? They might work together to throw you off by giving you information that will hinder or corrupt your investigation.” By saving interviews for last you’ll have all the data from your investigation thus far to inform your questions and back up any allegations. You’ll also reduce the chance of being frozen out by employees, shutting down your investigation. When you have all the evidence, a careful and methodical approach (like that used by a trained investigator) can even encourage a suspect to start rationalizing their theft, supplying a confession as a result.
  7. Document everything: Creating a clear paper trail is imperative. Time-stamped documentation can clear up any ambiguity if the employee(s) decide to take legal action against you. Note all of your actions, record your interviews, and keep all of your evidence organized.
  8. Take action: Once you have sufficient evidence of theft or, ideally, a confession, you need to take action to remove or discipline the employee(s) involved.
  9. Recover stolen properties: Work with an attorney if you wish to take action to recover your stolen assets. You don’t want to damage or undermine your investigation by inadvertently breaking the law.
  10. Shore up processes: After you have handled the current theft, you should take some time to evaluate how this happened and how to prevent employee theft in the future.

How Not to Investigate Employee Theft

If you handle the investigation carefully you can limit the impact the theft on your company. If you don’t, you can destroy morale and invite a lawsuit. Here are some tactics you should always avoid:

  • False or unprepared accusations: If you try to pin the wrong employee for the theft you might drive the accused to take legal action and cause the office to clam up, halting your investigation before you have the evidence you need to defend your allegations.
  • Illegal forms of interrogation: Being aggressive to the point of being coercive is dangerous, ineffective, and illegal, as AutoZone discovered when it used the ‘Reid Technique,’ a tactic that involved subjecting employees to hours of interrogation to obtain a confession. In one incident an employee was pushed to falsely confess for stealing $820 that was later found by the bank employees that reported it missing. The employee later sued AutoZone and won.
  • Pay cuts: Even if an employee is found to have stolen company property, cutting or docking pay is dangerous. You should to consult with your HR department and legal counsel before acting to recover stolen property.
  • Hasty terminations: Even a guilty employee terminated for theft can sue for wrongful termination and win if your investigation is found to be lacking.

Why You Should Consider Using Professional Investigators

There are thousands of ways to turn an issue of employee theft into a morale crisis and a lawsuit too. For these reasons and more, we recommend hiring professionals to conduct an internal employee theft investigation rather than doing it yourself. “Using outside professionals helps keep the investigation objective, protects the company from legal action, and avoids having the investigation get out of hand,” De Leon stresses.

So, if you do decide to employ a professional, why should you choose Trustify? Well, for starters, we have the largest network of private investigators in the country, including investigators with backgrounds in the Justice Department and other three-letter agencies. Our network is more than capable of conducting an investigation that is legally compliant, discreet, and compiles sufficient evidence to terminate the culprits and offer insights that can help theft in the future. Contact Trustify to setup a consultation today.

Elliot Rysenbry

Download the Open Source Intelligence Guide

Hundreds of Businesses Use Trustify to Get the Facts

Request a Consultation