Embezzlement in business is the intentional diversion of company money or property by someone the business trusted with access to it, and it is the rare crime that comes with a paper trail written by the thief. Schemes typically run about a year before anyone notices, and the dollar losses are only part of the damage; the breach of trust can threaten the company itself. This is a working guide to how embezzlement is defined, what it costs the person who commits it, and what a business should do the moment it surfaces.
What Separates Embezzlement From Other Theft
The defining feature is lawful access. A burglar never had permission to touch the property. An embezzler did. That difference drives what a prosecutor has to prove.
Three elements have to be established. A trust-based relationship: the business gave the person authority over money or property as part of their job, such as signing checks, managing accounts, or handling inventory. A diversion for personal benefit: the person treated company property as their own and permanently deprived the business of its value. And intent: the person acted deliberately, not through a mistake or a misreading of policy.
Intent is where most defenses live. Sloppy record-keeping on its own will not sustain a conviction. But a pattern of diversions, especially one the employee tried to conceal, builds the circumstantial case for intent quickly.
Schemes That Show Up Most Often
Most business embezzlement falls into a handful of recurring patterns. Knowing the shape of each one is the first step toward spotting it.
Skimming intercepts cash before it ever hits the books. The employee pockets money from a sale without ringing it up or records a lower amount than the customer actually paid. Because no record of the full transaction exists, skimming is one of the hardest schemes to catch through routine accounting reviews.
Lapping is more elaborate. An employee steals a payment from Customer A, then covers that shortfall by applying Customer B’s next payment to Customer A’s account. The cycle continues across dozens of accounts, creating a web of misallocated credits that can persist for years if nobody reconciles individual customer balances against actual receipts.
Payroll fraud takes several forms: keeping a terminated employee on the payroll and routing their checks to a personal account, creating fictitious employees entirely, or inflating hours on timesheets. In companies where one person handles both payroll entry and check distribution, this one is disturbingly easy to pull off.
Billing schemes rely on a fake vendor or shell company that submits invoices for goods or services the business never received. The employee approves payment and the money flows to an account they control. A variation uses a real vendor but inflates invoices, with the employee pocketing the difference.
Check tampering and unauthorized electronic transfers are the most direct. Forging a signature on a business check, altering the payee line, initiating wire transfers without authority, or disguising personal purchases on a corporate card as legitimate procurement all land here.
Federal Criminal Penalties
When embezzlement involves federal funds, crosses state lines, or targets federally insured institutions, federal prosecutors can bring charges under several statutes carrying steep penalties.
Stealing government money or property is punishable by up to 10 years in federal prison. If the total amount is $1,000 or less, the maximum drops to one year.1Office of the Law Revision Counsel. 18 USC 641 – Public Money, Property or Records
Bank employees and officers face harsher treatment. Embezzlement from a federally insured bank carries fines up to $1,000,000 and a maximum of 30 years in prison. For amounts of $1,000 or less, the ceiling is one year and a fine.2Office of the Law Revision Counsel. 18 USC 656 – Theft, Embezzlement, or Misapplication by Bank Officer or Employee
Many embezzlement cases also support mail fraud or wire fraud charges when the perpetrator used email, phone systems, or the postal service as part of the scheme, which is nearly always the case in a modern business. Mail and wire fraud each carry a maximum of 20 years in prison, rising to 30 years if the scheme affected a financial institution.3Office of the Law Revision Counsel. 18 USC 1341 – Frauds and Swindles
On top of imprisonment, federal law lets courts impose fines up to twice the gross gain the defendant received or twice the gross loss the victim suffered, whichever is greater.4Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine Federal sentencing guidelines also use a loss table that raises the offense level as the stolen amount grows: embezzling $200,000 adds 12 levels to the base offense, and stealing more than $1,000,000 adds 16, pushing sentences significantly higher before any other factor comes into play.
A conviction at any level typically ends the person’s professional career. Licensing boards in accounting, law, finance, and insurance routinely revoke credentials after a felony conviction for dishonesty.
State Criminal Penalties
Every state criminalizes embezzlement, though thresholds and penalties vary. The dividing line in most states is the felony threshold, which separates misdemeanor-level punishment from serious prison time. Thresholds range from as low as $200 in some states to $2,500 in others, and at least 37 states have raised their thresholds since 2000.5The Pew Charitable Trusts. The Effects of Changing Felony Theft Thresholds
Below the felony threshold, embezzlement is generally a misdemeanor carrying up to one year in jail and modest fines. Above it, the offense becomes a felony, and prison sentences scale with the amount stolen; high-value embezzlement in many states carries potential sentences of 10 to 20 years. Because state laws differ so much, anyone facing charges or weighing whether to report an incident should consult a criminal attorney licensed in the relevant state.
What To Do When You Discover Embezzlement
The first 48 hours after discovery matter more than most business owners realize. What you do, and what you avoid doing, determines whether you preserve your legal options or quietly destroy them.
Secure Evidence and Cut Off Access
Before confronting anyone, lock down the financial records and systems the suspect had access to. Change passwords, restrict system permissions, and preserve electronic records including emails, transaction logs, and bank statements. If video or audio surveillance captured relevant activity, secure the originals and store copies separately. The point is to keep the suspect from deleting evidence or covering tracks.
Remove the person’s access to company finances immediately. Depending on the situation, that may mean administrative leave, a transfer to a different role, or termination. If the evidence supports termination, document the reason clearly in writing and limit distribution to the employee’s personnel file.
Bring in a Forensic Accountant
A forensic accountant traces money trails, quantifies the total loss, and prepares evidence in a format that holds up in court. Their analysis often uncovers additional theft beyond what first triggered suspicion. These professionals work alongside legal teams so that evidence collection meets the standards required for both criminal prosecution and civil litigation. Hourly rates typically run from $150 to $500 or more depending on complexity and experience, but the investment generally pays for itself by surfacing the full scope of losses and strengthening recovery.
Report to Law Enforcement
File a police report and give the investigating officer all supporting documentation. For cases involving federal funds, bank fraud, or schemes that crossed state lines, contact the FBI or the relevant federal agency. Many business owners hesitate because they worry about publicity, but a criminal investigation creates leverage for financial recovery and opens the door to court-ordered restitution.
Talk to an Attorney
A lawyer experienced in commercial litigation can advise on parallel criminal and civil strategies, assess whether your insurance covers the loss, and guide you through restitution claims. Waiting too long to get legal advice is one of the most common and costly mistakes after discovering internal theft.
Civil Recovery and Restitution
Criminal prosecution and civil lawsuits run on parallel tracks, and businesses that recover the most pursue both. They serve different purposes and operate by different rules.
Criminal Restitution
Federal law requires courts to order restitution for property offenses committed through fraud when the victim suffered a financial loss.6Office of the Law Revision Counsel. 18 USC 3663A – Mandatory Restitution to Victims of Certain Offenses The order covers the full amount of the victim’s losses regardless of the defendant’s ability to pay, and the court cannot reduce the amount based on the defendant’s financial circumstances.7Office of the Law Revision Counsel. 18 USC 3664 – Procedure for Issuance and Enforcement of Order of Restitution Payments can be structured as lump sums, installments, or in-kind transfers.
Restitution orders look strong on paper, but collection is where reality sets in. Many embezzlers have spent the money by the time they are caught. Repayment becomes a condition of probation or supervised release, which exposes the defendant to additional prison time for non-payment, but that is cold comfort if the funds are gone.
Civil Lawsuits
A civil suit for embezzlement does not require a criminal conviction or even criminal charges. The burden of proof is lower: you need to show it is more likely than not that the person took the money, rather than proving it beyond a reasonable doubt. That difference matters, because some cases that are hard to prosecute criminally are perfectly viable as civil claims.
Civil judgments let you pursue compensatory damages covering the stolen amount plus interest and legal costs. Once you have a judgment, you can enforce it through wage garnishments and property liens, giving your business a legal claim against the perpetrator’s current and future assets. If others helped facilitate the embezzlement or failed in a supervisory duty, they may face civil liability too.
Insurance Recovery
Fidelity bonds and commercial crime insurance policies cover losses from employee theft, forgery, and computer fraud. Businesses with this coverage should file a claim as soon as the loss is quantified. These policies often require prompt notification and cooperation with the insurer’s investigation. If your business does not carry fidelity coverage, an incident is the moment to add it; policies are available with coverage limits up to $30 million for larger organizations.
Tax Consequences
Embezzlement creates tax implications on both sides of the transaction that many business owners overlook.
Deducting the Loss
A business can deduct an embezzlement loss in the tax year the theft is discovered, not the year it occurred, which matters because schemes often span multiple years. The deductible amount equals the adjusted basis of the stolen property minus any insurance reimbursement or other recovery you receive or expect to receive.8Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses
If you have filed an insurance claim and there is a reasonable chance of recovery, you cannot deduct the portion you expect to get back. You deduct only the unreimbursed balance. If the insurance claim is later denied, you deduct the remainder in the year you learn the reimbursement will not come through.9Internal Revenue Service. Publication 547 – Casualties, Disasters, and Thefts
Business theft losses are reported on Section B of IRS Form 4684. The loss must result from conduct that qualifies as theft under state law, and you must have no reasonable prospect of recovery beyond what you have already accounted for.
The Embezzler’s Tax Problem
Embezzled money is taxable income to the person who stole it. The Supreme Court established this rule in 1961, holding that anyone who exercises control over misappropriated funds owes income tax on those funds in the year the embezzlement took place. The embezzler can therefore face criminal penalties and an IRS bill at the same time, often with interest and penalties for failing to report the income.
Statute of Limitations
Time limits apply to both criminal prosecution and civil lawsuits. Miss them and a business can be left with no legal recourse regardless of how strong the evidence is.
For federal criminal charges, the general statute of limitations is five years from the date of the offense.10Office of the Law Revision Counsel. 18 USC 3282 – Offenses Not Capital Because embezzlement schemes often span years, each individual act of theft can start its own five-year clock. State criminal statutes of limitations vary but commonly fall in the three-to-six-year range.
Civil fraud claims in most states are subject to a discovery rule that delays the start of the clock until the victim knew or reasonably should have known about the fraud. That matters for embezzlement, which is designed to stay hidden. Even so, most states impose an outer limit, often six to ten years from when the fraud actually occurred, regardless of when it was discovered. Do not assume you have unlimited time because the scheme was concealed. Consult an attorney promptly after discovery to determine the applicable deadlines in your jurisdiction.
Prevention and Internal Controls
Recovery is expensive, slow, and often incomplete. Prevention costs a fraction of what a single incident destroys. Businesses that rarely get hit share a few common practices.
Segregation of Duties
The single most effective control is making sure no one person can initiate a transaction, approve it, record it, and reconcile the books. When the same employee who writes checks also reconciles the bank statement, you have created an open invitation. Separate these functions so at least two people are involved in every financial process. Smaller businesses that cannot fully separate roles should add detailed supervisory review as a compensating measure: the owner or a senior manager personally reviews bank statements, canceled checks, and vendor invoices every month.
Mandatory Vacation Policies
Requiring employees in financial roles to take at least two consecutive weeks of vacation each year is one of the oldest fraud-detection tools in the book. Many embezzlement schemes require constant maintenance: covering shortfalls, adjusting records, intercepting statements. When the perpetrator is away for two straight weeks and someone else handles their duties, irregularities surface. Banks have used this policy for decades, and it works just as well in other industries.
Surprise Audits and Account Reconciliation
Scheduled audits give embezzlers time to prepare. Unannounced spot checks on cash handling, expense reports, vendor payments, and payroll are far more effective. Monthly reconciliation of bank statements by someone other than the person who manages deposits and disbursements catches discrepancies while they are still small enough to investigate easily.
Anonymous Reporting Channels
Co-workers notice things before audits do. A confidential reporting mechanism, whether a third-party hotline, web form, or dedicated email, gives employees a safe way to raise concerns without fear of retaliation. For publicly traded companies, the Sarbanes-Oxley Act provides explicit whistleblower protections, prohibiting employers from retaliating against employees who report conduct they reasonably believe constitutes fraud.11Whistleblower Protection Program. Sarbanes-Oxley Act (SOX) Employees who experience retaliation can file a complaint with the Department of Labor within 180 days of the violation.
Background Checks and Access Controls
Running criminal background checks before hiring anyone who will handle money is basic due diligence. Equally important is limiting system access to what each role actually requires. A shipping clerk does not need access to the general ledger. An accounts receivable clerk does not need the ability to create new vendors. Tighten permissions, review them annually, and revoke access immediately when someone changes roles or leaves the company.