The warning signs of employee fraud, and your first 48 hours

Owners who discover fraud inside their business often say the same thing afterward: the signs were there, they just didn’t read them as signs. The person was trusted, the work got done, and nobody had a reason to look closely. Fraud rarely announces itself. It shows up as small things that don’t quite add up, in the people and in the books.

Here’s what those small things tend to look like, and what to do in the first two days after you suspect something. Those early decisions often shape whether the facts can be established later.

Behavioral red flags

People who take money from their employer usually don’t look like criminals. They look like reliable, long-tenured staff. What changes is the pattern around them. Watch for:

• Living beyond apparent means. New vehicles, expensive trips, or home renovations that don’t fit what you know about the person’s pay and circumstances.
• Financial pressure. Talk of debt, a divorce, medical bills, a gambling problem, or a family member in trouble. Pressure isn’t proof of anything, but it’s one of the common ingredients.
• An unusually close relationship with a vendor or customer. Frequent personal contact, gifts, or a habit of insisting that one supplier gets the work.
• Reluctance to share duties or take vacation. Someone who never takes time off, won’t cross-train a colleague, or gets defensive when another person offers to cover their desk.
• Control over a process nobody else sees. One person who opens the mail, records the deposits, pays the bills, and reconciles the bank account. When a single employee owns an entire cycle from start to finish, there’s no one positioned to notice a problem.

Any one of these can have an innocent explanation. The concern is a cluster, especially when it sits next to access to cash, payments, or the accounting system.

Transactional red flags

The books often tell the story before anyone else does. Common signs include:

• Missing or altered documents. Invoices that are photocopies instead of originals, receipts with changed amounts or dates, or supporting paperwork that is “misplaced” for certain transactions.
• Round-number payments, or payments just under an approval limit. If a manager must sign off above a certain amount, a run of payments sitting just below it deserves a closer look.
• New vendors that don’t look like real businesses. A vendor with only a P.O. box, no phone number or website, or an address, bank account, or tax ID that matches an employee’s.
• Unexplained adjustments. Write-offs, credit memos, voided transactions, or journal entries that nobody can explain, particularly ones posted near period-end.
• Reconciliations that are late or never reviewed. A bank reconciliation that is always behind, or one that gets done but never looked at by anyone other than the person who prepared it.

Your first 48 hours

Once you suspect something, the instinct is to act fast and get answers. That instinct is right about speed and wrong about method. The goal in the first two days is to protect the evidence and your options, not to solve the case.

Preserve the records. Don’t let anyone delete, reorganize, or “clean up” files, email, or accounting data, including well-meaning staff who want to help. Suspend any routine that automatically deletes email or overwrites backups. Keep paper records where they are and restrict access to them.

Secure devices and system access, quietly. Work with whoever manages your IT to preserve the person’s computer, phone (if company-owned), and accounts before anything is wiped, reissued, or reset. Changes to access should be planned so they don’t tip anyone off and so the records stay intact. Don’t go through the devices yourself; how the data is collected can matter later.

Don’t confront the person. A confrontation before the facts are established tends to produce a denial, a resignation, and missing records. Interviews should come later, planned with your attorney and your fraud examiner.

Limit who knows. Keep the circle as small as you can. Every additional person who knows is another chance for the suspect to hear about it, and for rumor to get ahead of facts. Don’t discuss it on company email or channels the person can see.

Call your attorney. Decisions about employment action, interviews, reporting to law enforcement, and recovery have legal consequences. Get advice before you take any of them. Your attorney may also want to be involved in how the investigation is structured.

Contact your insurer early. Many businesses carry crime or fidelity coverage, sometimes as part of a broader policy, without realizing it. These policies often have notice requirements and proof-of-loss requirements, and missing them can put coverage at risk. Pull your policy, check what it requires, and notify the carrier as your policy directs.

Bring in a fraud examiner. A Certified Fraud Examiner can scope the problem, trace the transactions, quantify the loss, and document findings in a way that holds up with insurers, attorneys, and, if it comes to that, the courts. An examiner who is independent of your day-to-day bookkeeping also avoids the awkwardness of having your own staff investigate a colleague.

Why prevention is worth the effort

Every one of the red flags above is harder to hide when basic controls are in place, and none of the following needs a large finance team:

• Segregation of duties. Split the work so that no single person handles a transaction from start to finish. The person who writes checks shouldn’t reconcile the bank account. The person who records deposits shouldn’t also handle the cash. Where the team is too small to split everything, add an independent review.
• Owner review of bank statements. Have the statements come to you directly, unopened, or give yourself read-only online access. Look through them regularly. Scan the payees, the check images, and anything unfamiliar. Just knowing the owner looks is a deterrent.
• Vendor master-file controls. Limit who can add or change vendors, require documentation for every new vendor, and verify any change to a vendor’s bank account by calling a number you already have on file, not one supplied in the request. Periodically compare vendor addresses and bank accounts against employee records.

Controls won’t make fraud impossible, but they shorten how long it can run and make the warning signs easier to see. Goldman Tax and Advisory’s managing partner, Rodd Goldman, is a CPA and Certified Fraud Examiner, and he leads the firm’s fraud examinations personally.