Embezzlement Investigation: Signs, Steps and Evidence

Posted on by

An embezzlement investigation answers four questions: did a theft happen, how much was taken and how, who did it, and can the money be recovered. The order matters. Spot the pattern quietly, preserve every record, bring in counsel and a financial specialist, and only then speak to the person involved. Confront too early and you risk destroyed records, a lawsuit, and a weaker case.

This guide is for owners, managers and finance leads who suspect that someone they trusted is taking money. It covers the warning signs, a working process, the evidence that holds up, and the legal limits that change from country to country.

Pi melbourne
Investigate Suspected Workplace Fraud
Pi Melbourne conducts customized investigations into corporate fraud, with professional surveillance and evidence collection tailored to specific client concerns.

TL;DR

  • Embezzlement is theft by someone who was trusted with the property. That trust is why it often runs for a year or more before anyone notices.
  • Look for patterns, not single oddities: skipped approvals, missing support, delayed deposits, altered checks, a lifestyle that doesn’t match the pay.
  • Do not confront anyone first. Preserve records, limit who knows, and call your insurer, a lawyer and a forensic specialist early.
  • Evidence only helps if you can show it was never altered, so document chain of custody from the first item collected.
  • Privacy and employment law differ by country. Check local rules before you monitor, copy or interview anyone.

Table of Contents

What embezzlement is, and how it differs from other theft

Embezzlement is the fraudulent taking of property that was entrusted to you. Cornell’s Legal Information Institute separates it from larceny on one point: the person already had the right to possess the property, or substantial control over it, because of their position.

That is the bookkeeper who pays invoices to a shell vendor, the store manager who skims deposits, or the office administrator with a company card. They never had to break in. The access was part of the job.

Terms vary by state. Some jurisdictions don’t use the word at all: in New York, for example, theft from an employer is charged as larceny rather than embezzlement. For an employer the label matters less than the facts you can prove: what was taken, when, by what method and by whom.

Signs of embezzlement at work

No single sign proves anything. Australia’s Commonwealth Fraud Prevention Centre notes that risk rises when several red flags appear together, such as skipped approvals, connected suppliers, inaccurate records, access to restricted areas, financial hardship, addiction or gambling.

On the numbers side, a 2025 guide from the California State University System lists warning signs of asset misappropriation that include:

  • unexplained increases in budgets or spending
  • missing supporting documents
  • delayed deposits
  • unusual reconciliations and duplicate payments
  • altered checks and an excess of voided transactions
  • purchases split to stay under approval thresholds
  • inventory shortages

In practice, owners tell us the first signal is often behavioral rather than financial. One person never takes leave, insists on handling a task alone, resists audits or hands over records slowly. Treat that as a reason to look at the numbers, not as proof.

How long it runs and what it costs

The scale is worth knowing. According to a summary of the ACFE Occupational Fraud 2024 report, the median loss in the study was $145,000 globally, and organizations with fewer than 100 employees lost a median of $141,000. The median scheme took 12 months to uncover, with losses averaging $9,900 a month.

Small businesses are not safe because they are small. They often have fewer controls and one person doing several jobs. The ACFE’s 2016 study found that anti-fraud controls were associated with lower losses and quicker detection, and that tips were the most common way fraud was found. That is an argument for giving staff a safe way to report concerns.

If you run a smaller firm, our guide to fraud in small business covers the warning signs and what an investigation can cost.

How to investigate suspected embezzlement, step by step

FindLaw describes four objectives for an employer facing suspected theft: establish whether a theft occurred, work out the amount and method, remove wrongdoers and prevent repeats, and recover what was lost. A workable sequence follows from them.

1. Stay quiet and widen your view

In the first days, the most important rule is simple: do not confront the employee yet. An early confrontation can prompt the destruction or alteration of records, the movement of funds, and exposure to wrongful termination or defamation claims if your evidence is incomplete, as FraudOrder explains. One law firm’s guide recommends quiet fact-checking and avoiding unsupported accusations or restrictions while you review payroll, receipts and internal logs.

First impulses to resist: firing, locking the person out, or looking through their desk. Forensic Strategic Solutions notes that keeping the employee on the payroll can make it easier to obtain records, because employees have a duty to cooperate in a legitimate investigation.

2. Limit who knows

Keep the circle small: ownership, counsel, and whoever must act on the records. Privilege can be lost by disclosure, and the International Bar Association’s 2021 report advises limiting investigation communications and interview materials to need-to-know recipients.

3. Preserve before you analyze

Issue a hold so nothing is deleted on a routine schedule. That covers auto-deleting email, scheduled shredding and database purges. Then catalog documents, computers, devices and digital accounts. Forensic Strategic Solutions warns that cases have been undone when an employer turned off a computer or downloaded files from a hard drive and changed the evidence. Do not poke around the suspect’s machine yourself.

4. Call your insurer early

FindLaw advises contacting your risk manager or agent early to learn your rights under fidelity bond, crime loss or employee dishonesty policies. Many policies require notice within a set, sometimes short, window after discovery. Do nothing that compromises the insurer’s rights against the wrongdoer.

5. Build the team

A typical team includes a financial investigator such as a certified fraud examiner, a computer forensics specialist, a white-collar attorney and employment counsel, according to Forensic Strategic Solutions. Where privilege matters, a Clayton Utz checklist suggests that the legal department and outside lawyers engage forensic accountants and investigators directly, rather than the business unit doing so.

6. Analyze, interview, report

DLA Piper’s checklist runs from setting the mandate through preserving records to analyzing data, interviewing witnesses and reporting findings. Interviews come after the paper trail, so you already know the answers to most of your questions.

FindLaw suggests obtaining signed written statements where possible, keeping interviews free of coercion or duress, and ideally having a neutral, trusted manager witness them. If company counsel conducts the interview, the IBA recommends explaining at the start that counsel represents the company, not the employee, and that the company controls privilege.

For employee-theft cases in particular, see our practical guide to an employee theft investigation.

The records that prove what happened

Investigations are won on documents and data, not on instinct. Whiteford, Taylor & Preston’s 2025 client alert lists the core financial source documents: bank statements with check images, cash payments, ACH and wire logs, payments through apps such as Venmo and Cash App, corporate card statements, and general ledgers, with particular attention to journal entries and adjusting entries and their timing.

Digital records tell you who did what and when. S-RM Inform describes digital evidence in internal investigations as spanning:

Source Examples
End-user devices Laptops, desktops, mobile phones
Communications Corporate email, Teams, Slack, SMS, WhatsApp
Enterprise systems Microsoft 365, Google Workspace, financial platforms, HR systems, databases
Log sources Network logs, VPN records, security tooling

The same analysis stresses that value comes from connecting records across systems into one timeline: the transaction, the approval, the email explaining the urgency, the document on the laptop and the login record. In retail and hospitality, add CCTV, point-of-sale data, timekeeping, inventory counts and access logs.

Chain of custody

Collecting evidence is half the job. You also have to show it was never changed. Every item should enter a log recording who held it, when, how it moved and where it was stored. DLA Piper recommends forensic collection to avoid changing metadata. Our explainer on chain of custody shows how this keeps evidence admissible.

Sealed evidence pouch beside custody log

Surveillance and observation in an embezzlement case

Paper trails don’t answer every question. Sometimes you need to know whether an employee is meeting a supplier, handling cash off the books, or working elsewhere while claiming hours. Professional surveillance can document that in photos and video that are usable in legal proceedings.

The legal limits are tight, though. Before any monitoring, check what you may lawfully do. Our guide to workplace surveillance laws explains what employers can monitor. Surveillance that breaks the law can taint the very evidence you were trying to get.

Our published price for surveillance is $1,000 to $1,450 one-off, detailed on our surveillance pricing page. Other engagements are scoped to the case.

If you operate in several countries, or an employee, supplier or account sits overseas, local rules decide what you may collect and how. RSM’s global playbook says to assess local privacy and investigative law before collecting, transferring or processing information, including blocking statutes and whistleblower confidentiality, and to seek local legal advice when needed.

  • United States. The Supreme Court’s decision in Upjohn v. United States recognizes protection for communications by corporate employees to counsel, made within their duties to get legal advice for the company, including information held by lower-level employees.
  • European Union. A June 2026 analysis of a CJEU ruling says internal investigations involving employee data must be incident-related, purpose-bound and proportionate. It recommends less intrusive sources, such as contracts, invoices, logs and other interviews, before private communications are opened.
  • Across borders. The IBA’s report says investigations stay subject to privacy and data-protection rules even when voluntary, and that privilege should never be assumed across jurisdictions.

The practical rule: get local counsel’s view before you image a device, read email or record a conversation in a country you don’t operate from every day.

Finding people and assets anywhere in the world

Embezzlers move. The employee resigns and relocates, the funds go offshore, the vendor is registered somewhere you have never been. Recovery, the fourth objective, then depends on locating a person or an asset across borders.

We work on location and asset questions internationally. Our asset search investigation service looks at what a person or company holds, and we have worked cases tracing people abroad, as our page on finding a missing person in the UK shows. Overseas work follows the local law of each country, which is why we scope it case by case.

Who you can ask for advice: former FBI and military investigators

Most owners have never run a fraud investigation. Early advice from someone who has is worth more than a late fix.

Who you can ask for advice: former FBI and military investigators

Our team includes experienced private detectives, among them former FBI and military agents, along with ex-police and polygraph specialists. If you want a view on how a case like yours would be built, how evidence is gathered for court, or whether it points toward law enforcement, that is a reasonable first conversation. Read more about our former FBI agent investigators.

Hiring ex-military investigators brings discipline to the work: planning, patience on long observations, and careful reporting. We use that experience on surveillance and on sensitive personal and corporate matters. An investigator advises on facts and evidence. A lawyer advises on your legal position, and you need both.

Our perspective

Embezzlement cases are lost in the first week more often than in the last. An owner who is hurt and angry confronts the employee, and the records change overnight. Our approach is the opposite: stay calm, preserve, and build a picture that a court or an insurer can follow.

Every case is different, so we tailor the investigation to the client’s situation rather than run a template. Our investigators are former police, military and polygraph specialists who use modern technology to produce photos and video suitable for legal proceedings. We think that combination of field discipline and careful documentation is what turns a suspicion into evidence.

We also think discretion is part of the service. The person you suspect may be innocent, and may still be working beside you tomorrow.

P.i Melbourne

When to involve a lawyer, forensic accountant or police

Bring a lawyer and a forensic accountant in before you decide anything big. One law firm’s guide advises using an attorney or forensic accountant to validate evidence and interpret discrepancies. If the investigation confirms theft, you then decide whether to report to law enforcement, giving documented facts and no speculation about motive.

Reporting is a decision, not an automatic first step. DLA Piper’s checklist says to evaluate voluntary disclosure and its timing. The ACFE’s 2016 study found that 40.7% of victim organizations did not refer cases to law enforcement, a historical figure and not a current rate. A clean evidence file makes either path easier, whether you prosecute, pursue a civil claim or claim on insurance.

How we can help

If you suspect an employee or partner of taking money, we can carry out the investigation with you and your counsel: surveillance, evidence gathering, and tracing people or assets. Start with our corporate investigations service, which is tailored to each business.

Pi melbourne

We also cover fraud investigation, staff monitoring and evidence collection for court, and related cases such as payroll fraud. Contact us through Pi Melbourne for a confidential first conversation.

FAQ

What is the first thing to do if I suspect embezzlement?

Do nothing visible. Don’t confront the person, fire them or touch their devices. Preserve records, stop routine deletion, call your insurer and speak to a lawyer. Then bring in a forensic specialist to review the numbers.

How long does an embezzlement investigation take?

It depends mainly on the size of the business and how complex the scheme is. A simple skimming case can be traced faster than a multi-year scheme across several systems. The ACFE-based figures above show the median scheme ran 12 months before discovery, so expect a lot of history to review.

Do I have to report embezzlement to the police?

Not always as a first step. Once an investigation confirms theft, you decide whether and when to report, with legal advice. Check your insurance policy too, because some require timely notice of a claim.

Can I read an employee’s email during an investigation?

Only within the law where you are. In the EU, for example, employee-data processing must be proportionate and incident-related, and less intrusive sources should come first. Get local legal advice before you access private communications.

Can a private investigator help with an embezzlement case?

Yes. An investigator can gather evidence through lawful surveillance, trace people and assets and document findings for counsel. They work alongside your lawyer and forensic accountant, not in place of them.

Sources