Employee Theft Investigation: A Practical Guide for Employers

Posted on by

An employee theft investigation has one job: establish what happened, who was involved and how much was lost, using evidence that will hold up if the matter ends in a dismissal, an insurance claim, a civil suit or a police report. Do it in a fixed order. Quietly secure the evidence, limit who knows, confirm the facts before you confront anyone, interview fairly, and bring in outside specialists when the case is complex or the stakes are high. Rush any of those steps and you risk a ruined case, a wrongful termination claim or a privacy complaint.

This guide walks through each stage, the warning signs that justify opening a case, the legal traps, and how to decide between handling it in-house and hiring a private investigator.

Pi melbourne
Investigate Employee Theft with Care
Pi Melbourne conducts tailored investigations into corporate fraud, with professional surveillance and evidence collection for complex workplace concerns.

Explore investigation services

TL;DR

  • Treat every theft allegation seriously, keep the circle of people who know very small, and preserve records before anyone is confronted.
  • Tips are the most common way fraud comes to light: 43% of cases in the ACFE 2024 study, so an easy, safe reporting channel is worth more than most gadgets.
  • Build the case around the specific policy that was broken and the documents that prove it, not around a hunch.
  • Monitoring has legal limits that vary by country and state. Check them with an employment lawyer before you install cameras, track devices or record conversations.
  • Bring in a licensed investigator when the scheme is hidden, the suspect is senior, or you need court-ready surveillance footage and a clean chain of custody.

Table of Contents

Why employee theft deserves a formal investigation

Small losses are easy to wave away. Don’t. The ACFE 2024 Report to the Nations found that asset misappropriation, the category that covers stealing cash, inventory and other company property, appeared in 89% of the occupational fraud cases studied, with a median loss of USD 120,000 per case. Those are the researchers’ figures from fraud cases that were reported to them, not an average for every business. They still show how a quiet, repeated theft grows into a serious loss.

The same report warns that frauds found by accident or through police involvement tend to run longer and cost more than those caught through proactive checks such as surprise audits, document review and data analysis. Waiting for the problem to reveal itself is the expensive option.

Signs of employee theft that justify a closer look

No single sign proves anything. Patterns do. Pay attention when you see several of these together, or one that keeps repeating.

In your numbers

  • Inventory shrinkage that outpaces what your industry and your history would predict, especially if it clusters on certain shifts, days or locations.
  • Voids, refunds, discounts or “no sale” transactions concentrated under one login.
  • Cash drawer shortages that always seem to land on the same person or the same closing routine.
  • Vendor invoices with round amounts, unfamiliar vendors, duplicate payments, or vendors whose address matches an employee’s.
  • Expense reports with missing receipts, unusual timing or amounts just under your approval limit.
  • Payroll oddities: hours that do not match access logs, or paychecks to people nobody can place.

In behavior

  • Reluctance to take vacation or let anyone else cover a task, particularly one that touches cash, stock or accounts.
  • Unusual interest in areas outside the person’s role, or working alone at odd hours.
  • A lifestyle change that does not fit known income. This is a prompt to look at records, not evidence by itself.
  • Defensiveness, or fast anger, when routine questions about procedures come up.

In your systems

  • Access logs showing files, customer lists or pricing exports pulled by someone with no need for them.
  • Large email forwards or cloud uploads to personal accounts shortly before a resignation.
  • Shared passwords or credentials used outside normal hours.

Intellectual property and data count as theft too. Time theft, such as falsified hours or buddy punching, belongs in the same process and deserves the same fairness.

How to investigate employee theft, step by step

The order below reflects what the published guidance from investigation software providers and legal educators stresses: planning, a systematic approach and a high degree of confidentiality.

1. Contain the circle

Decide who needs to know. Usually that is the owner or a senior executive, HR and legal counsel. Leave out the suspect’s manager if the manager could be involved or could tip them off. Gossip destroys cases: evidence disappears, witnesses start coordinating their stories, and an innocent person’s reputation is damaged for good.

Write down, from the first day, what you know, how you learned it and who you told. That log becomes the backbone of the file.

2. Stop the bleeding without alerting anyone

When an organization finds evidence of theft, the Association of Corporate Counsel notes that early consideration must go to ending the fraud, preventing it from recurring and working out the extent of it. In practice that can mean quiet control changes that apply to everyone: dual sign-off on refunds, a cash count by two people, or tightened permissions on a system. Make them look routine.

3. Preserve evidence before you do anything else

Secure the material that could be altered or deleted:

  • Point-of-sale and accounting exports, with dates and the name of the person who pulled them
  • Video footage from your own cameras, copied before the system overwrites it
  • Badge, door and system access logs
  • Email and messaging records on company systems, within what your policy and local law allow
  • Original paperwork such as invoices, timesheets and receipts

Keep originals untouched and work from copies. Record who handled each item and when. A broken chain of custody is one of the quickest ways to have good evidence thrown out or discounted.

4. Define what policy or law was broken

A legal commentator quoted in a Lorman Education Services white paper makes the point that an investigation should identify the key facts and the specific company policies and rules that any discipline will rest on. That discipline matters. “We think she’s stealing” is a feeling. “Between March and June, 41 refunds totaling a stated amount were issued under her login without a matching return, in breach of section 4 of the cash handling policy” is a case.

5. Analyze the records

Lay out the facts on a timeline. Compare the suspect’s transactions with those of peers doing the same job. Look for what the numbers say about who, how often, how much and since when. A spreadsheet and patience solve most small cases. Larger or more technical schemes, such as vendor fraud, payroll manipulation or data exfiltration, may need a forensic accountant or digital forensics specialist.

6. Consider covert observation, carefully

If the records point to a person but do not prove the act, discreet surveillance can show what the paperwork cannot: stock leaving the building, goods sold on the side, time claimed while working elsewhere. This is where untrained efforts go wrong. Amateur filming can alert the suspect, create privacy exposure for you, or produce footage a lawyer cannot use. Surveillance by someone trained to document lawfully, and to testify about it, is a different thing.

7. Interview with a plan

Interview witnesses first, the suspect last. For the suspect’s interview:

  • Have a second person from HR present as a note taker.
  • Prepare your documents and questions in advance, and ask open questions before you show your evidence.
  • Do not threaten, promise leniency or accuse. State the facts and let the person respond.
  • Take notes and, where lawful and consented to, consider a signed statement.
  • Check local rules on employee representation. In the US, unionized employees may have the right to ask for a representative at an investigatory interview, so ask counsel before you proceed.

8. Decide, document and act

Before you take action, CaseIQ’s guidance for HR teams begins with making sure your evidence of theft is strong. Then choose the response: termination, repayment agreement, civil recovery, a police report or an insurance claim. These are not mutually exclusive. Decide with counsel, apply the same standard you would to any other employee, and put the outcome in writing.

Detection: why a tip line beats a hidden camera

Detection: why a tip line beats a hidden camera — overview diagram

It is tempting to think technology catches thieves. The data say people do. In the ACFE study, tips were the most common detection method, uncovering 43% of cases, and employees were the largest source of those tips. The ACFE report breaks the sources down further, with employees providing 52%, customers 21% and vendors 11%.

What that means for a business owner:

  • Give staff a way to report concerns without going through their own manager, such as a phone line, an email address monitored by someone senior, or an outside hotline.
  • Say plainly that reports are taken seriously and that retaliation will not be tolerated.
  • Follow up on every tip, even the vague ones. A tip that goes nowhere teaches people not to try again.

The fastest way to turn a theft you can prove into a lawsuit you might lose is to collect evidence unlawfully or fire someone without a defensible process. The rules differ by country, and in the US by state, so treat the points below as the questions to put to your lawyer, not as legal advice.

Monitoring and privacy

Video, audio, email review, GPS tracking and device monitoring each carry their own rules. Audio recording is the one that most often catches employers out, because consent requirements differ from one jurisdiction to another. Notice, a written policy and a legitimate business reason go a long way, but confirm what applies where your employee works before you record anything.

Australia gives a useful illustration of the principle of proportion. The Fair Work Ombudsman’s workplace privacy guide addresses employee records and privacy obligations, and in the Privacy Act case against 7-Eleven, the privacy regulator found the company had interfered with individuals’ privacy by collecting facial images and faceprints through its customer feedback mechanism. That case concerned customers rather than staff, but it shows how collecting sensitive data without a clear necessity and proper consent can backfire. The same logic applies when you consider biometric or covert monitoring of staff, wherever you operate.

Termination

In Australia, the Fair Work Ombudsman lists conduct such as theft under serious misconduct, which can justify dismissal without notice, though a fair process still matters. In the US, most employment is at will, but contracts, union agreements, state law and discrimination protections can all limit what you can do. If you have any doubt, speak to an employment attorney before the termination meeting, not after.

Reporting to police

That choice is yours, and it should be made deliberately. Police involvement can help with recovery and deterrence, but it can also bring delays and loss of control over the timeline. Your insurer may also have notification requirements and deadlines, so read your policy early.

DIY, in-house or private investigator?

Situation Usually fine in-house Consider an outside investigator
Small, single-incident shortage Yes, with HR and a documented review Rarely needed
Pattern pointing to one person, records are clear Yes, with counsel guidance If you need independent verification
Suspect is a manager, owner’s relative or finance staff Risky: conflicts of interest Strongly
Theft happens off-site, after hours or in the field Hard to prove from paperwork Yes, for surveillance and evidence
Possible collusion, vendor fraud or data theft Limited by your own access and skills Yes
You expect litigation or an insurance claim Evidence quality is critical Yes, for court-ready documentation

An outside investigator brings three things you rarely have internally: independence, trained discretion and evidence prepared to be used. Independence matters because friends and colleagues of the suspect often work down the hall from you. Discretion matters because a suspect who realizes they are being watched stops, and then the case is gone.

Our perspective: what we see go wrong

We have been running private investigations since 2006, and the mistakes in workplace theft cases are remarkably consistent.

The first is confronting too early. An owner who is sure, and angry, speaks to the employee before the evidence is secured. The employee deletes, denies and hires a lawyer. A case that was solvable in a fortnight becomes a stalemate.

The second is evidence that cannot be used. Phone footage taken from across the room, screenshots with no date, records handled by five people with no log. Courts, insurers and employment tribunals want to know where evidence came from and who touched it. Our investigators, who include former law enforcement and military personnel and polygraph specialists, build every file with that question in mind, and we use advanced technology to capture photos and video suitable for legal proceedings.

Our perspective: what we see go wrong — overview diagram

The third is treating every case the same way. A bartender skimming cash needs different handling than a bookkeeper redirecting payments or a salesperson taking client lists to a rival. That is why we tailor each investigation to the client’s situation instead of running a fixed package.

The fourth is forgetting that the goal is a decision you can defend. Our job is not to produce a confession or satisfy anger. It is to give you facts you can act on, whether that means a dismissal, a recovery claim, a police report or the discovery that the person you suspected is innocent. We have seen all four outcomes, and the last one is as valuable as the first.

— Global

When Pi Melbourne can help

If your records point to theft but you cannot prove who is behind it, or you need discreet surveillance and properly documented evidence, Pi Melbourne can help. We handle corporate misconduct and fraud investigations, employee monitoring, surveillance and evidence gathering for legal proceedings, and we serve clients worldwide. Tell us what you are seeing and what outcome you need, and we will explain what an investigation would involve before you commit to anything.

Quick checklist for the first 48 hours

  1. Write down what you know and who you have told.
  2. Limit the circle to the people who must know, and involve counsel.
  3. Copy video, logs, transaction exports and paperwork. Keep originals untouched.
  4. Make quiet, company-wide control changes that stop further loss.
  5. Check the policy or law that applies to what you suspect happened.
  6. Check monitoring and recording rules before you add any new surveillance.
  7. Decide whether the matter is in-house or needs an outside investigator.
  8. Do not confront the suspect until the evidence is secured.

FAQ

What can an employer do if an employee steals?

An employer can discipline or dismiss the employee, seek repayment, pursue a civil claim, report the matter to police, or claim on insurance. Which of those is available depends on your country, your state, any employment contract and the strength of your evidence. Speak with an employment lawyer before acting, and make sure the investigation is documented first.

How do you prove an employee is stealing?

You prove it with records and, where needed, observation: transaction logs, inventory counts, video, access data, witness statements and a documented interview. The strongest cases link a specific act to a specific person and a specific policy, with a clear chain of custody for every item. When the paperwork alone does not show who did it, lawful surveillance by a trained investigator can fill the gap.

Should I confront the employee right away?

No. Confronting someone before you have secured the evidence gives them time to delete files, alter records and prepare a story. Gather and preserve the proof first, interview witnesses, and speak to the suspect last, with HR present and a prepared set of questions.

Sometimes, but the rules differ by country and, in the US, by state, and audio recording is the most sensitive area. A clear written policy, notice and a genuine business reason help, but get legal advice before you record or track anyone. Surveillance carried out in public or in your own business premises is treated differently from monitoring private communications.

When should I hire a private investigator for employee theft?

Hire one when the suspect is senior, when the theft takes place off-site or after hours, when collusion or data theft is likely, or when you expect litigation. An independent investigator can work discreetly and produce evidence prepared for legal use, which protects both the case and the business.

Sources