Employee Theft: What to Do When You Discover It

The bookkeeper has been with you for twelve years. You trusted her completely. Now your accountant is showing you how the numbers don't add up—and they haven't added up for a long time. The amount missing is significant. You're angry, you're betrayed, and you're about to make decisions that matter. This is not the time to act on impulse.

Employee theft is one of the most disorienting experiences a business owner can face. The violation of trust compounds the financial loss. The urge to confront, fire, call the police, and sue—all at once—is understandable but often counterproductive.

The First 48 Hours

What you do immediately after discovery shapes your options for everything that follows.

Secure the evidence before alerting the employee. Pull records, preserve emails, copy files, secure video footage. If the employee learns they're under suspicion before you've gathered what you need, critical evidence may disappear.

Limit who knows about the situation. Every additional person increases the risk of premature disclosure, whether intentional or accidental. Until you've secured evidence and made decisions about how to proceed, keep the circle small.

Get legal counsel involved early. The decisions you're about to make—about termination, criminal referral, civil claims, and communication—have legal implications you may not anticipate. The cost of early counsel is small compared to the cost of mistakes.

Don't confront the employee until you're ready. What feels like necessary confrontation may actually be counterproductive. You want the evidence secured, your approach planned, and your options understood before you take action.

Understanding What You're Dealing With

Employee theft comes in many forms, and the approach differs depending on what happened.

Cash theft—skimming, register manipulation, deposit diversions—is often discoverable through forensic accounting but may have limited documentation.

Vendor fraud—fake vendors, kickbacks, overbilling—involves paper trails that can be traced but may implicate third parties.

Expense fraud—falsified expense reports, personal purchases on company cards—leaves records but often involves smaller individual amounts over longer periods.

Inventory theft—merchandise walking out the door—may be harder to prove to specific individuals without surveillance.

Time theft—falsified timesheets, buddy punching—is common but often treated differently than theft of money or property.

Understanding the type and scope of the theft helps determine your approach. Some situations warrant aggressive pursuit; others may be better handled through termination and improved controls.

Criminal Versus Civil

Reporting theft to police and pursuing civil recovery are separate decisions. You can do both, either, or neither.

Criminal prosecution is handled by the state. You're a witness and victim, not a party controlling the case. The prosecutor decides whether to charge and what plea to accept. Criminal conviction doesn't automatically produce financial recovery for you.

Civil recovery is your lawsuit for damages. You control it, but you bear the costs. Civil judgments require collection—and employees who steal are often judgment-proof, meaning they don't have assets to pay.

Some business owners pursue criminal prosecution to create leverage for civil recovery. An employee facing felony charges may be more motivated to repay. But this approach has limits: prosecutors don't appreciate their cases being used as collection tools, and the employee's cooperation in repayment doesn't guarantee favorable treatment in criminal court.

Others prefer to handle the matter privately—termination, civil claim, and move on—to avoid the publicity and disruption of criminal proceedings. This is a legitimate choice but may feel unsatisfying if the theft was significant.

Recovery Sources

Before assuming you'll recover from the employee, consider what other recovery sources exist.

Fidelity bonds or crime insurance may cover employee theft. Review your policies promptly—reporting deadlines may be short. Coverage limits, deductibles, and proof requirements vary.

If the theft involved collusion with vendors or customers, those third parties may have deeper pockets than your former employee. Conspiracy and conversion claims can reach beyond the individual.

If professionals—accountants, bookkeepers—failed to detect theft that proper procedures would have caught, professional liability coverage might apply. This is fact-specific and relationship-dependent.

The employee's own resources are usually limited. People who steal from their employers typically aren't sitting on assets. Lawsuits produce judgments; judgments require collection; collection from people without money is frustrating.

The Termination Decision

You can fire an employee suspected of theft. You don't need a criminal conviction or even certainty. Oklahoma is an at-will employment state; you can terminate for any lawful reason or no reason.

But how you terminate matters. If you accuse someone of theft and you're wrong—or you can't prove it—defamation claims can follow. If the investigation or termination process treats similarly-situated employees differently, discrimination claims become possible.

The safest approach is often to terminate for documented policy violations or simply without stated cause, rather than explicitly accusing the employee of criminal conduct. You accomplish the same result with less legal risk.

Exit procedures should include recovery of company property, disabling access to systems and facilities, and reminders about confidentiality obligations. The departing employee should not continue to have access to anything.

Preventing the Next Time

After managing the immediate crisis, evaluate how it happened and how to prevent recurrence.

Separation of duties is the most fundamental control. No single employee should control both the creation and review of financial transactions. The bookkeeper who writes checks shouldn't reconcile bank statements.

Regular audits—internal or external—create detection risk that deters theft and catches it earlier when it occurs.

Mandatory vacations require someone else to perform duties, often revealing irregularities the regular employee had concealed.

Background checks at hiring can reveal prior problems—though many employee thieves have clean records until they don't.

Hotlines and reporting mechanisms give other employees a way to report concerns without confronting the suspected individual directly.

None of these are perfect. Determined employees can circumvent controls, especially when they have trust and access. But making theft harder to commit and easier to detect changes the risk calculus.

---

Employee theft creates financial loss, operational disruption, and a profound sense of betrayal. Managing it well requires moving past the initial shock to secure evidence, make strategic decisions, and pursue recovery through appropriate channels.

At Addison Law, we help businesses respond to employee theft and fraud, from initial investigation through civil recovery. If you've discovered theft or want to strengthen your preventive controls, contact us.

---

Need Strategic Counsel?

Navigating complex legal landscapes requires more than just knowledge; it requires strategic foresight. Contact Addison Law Firm today.

Contact Us

This article is for general information only and is not legal advice.