Police investigate embezzlement by following the money. The work centers on building a documentary trail that connects a suspect to missing funds, combining subpoenaed financial records, analysis of the victim organization’s internal accounting, interviews with co-workers and vendors, digital forensics, and search warrants. Most of these cases begin only after someone inside the organization notices a problem and reports it, and most take months — sometimes years — to resolve. Who handles the investigation depends on the size of the loss and the type of organization involved.
Who Handles the Case
Small-scale theft from a private business — a bookkeeper skimming a few thousand dollars, for example — usually stays with local police or a county detective unit. Larger schemes, schemes that cross state lines, and schemes involving certain organizations go federal.
The FBI treats embezzlement as financial institution fraud when banks, credit unions, or similar institutions are the victims, and leads corporate fraud investigations into accounting schemes and executive self-dealing.1Federal Bureau of Investigation. White-Collar Crime Federal jurisdiction also attaches when the victim organization receives more than $10,000 a year in federal funding — grants, contracts, subsidies, or insurance — and the embezzled amount is $5,000 or more.2Office of the Law Revision Counsel. 18 USC 666 – Theft or Bribery Concerning Programs Receiving Federal Funds That threshold pulls in a lot of organizations: hospitals, universities, local governments, and nonprofits that take any federal money.
In federal cases, the FBI commonly works alongside the IRS, the U.S. Postal Inspection Service, and the Treasury Department’s Financial Crimes Enforcement Network (FinCEN).1Federal Bureau of Investigation. White-Collar Crime Whichever agency takes the lead, the investigative method is similar.
How an Investigation Starts
Police do not go looking for embezzlement. A case opens when someone reports money is missing, and that someone is almost always the victim organization itself. A business owner notices cash flow that does not match the books. An auditor flags payments to a vendor nobody can find. A board member spots unauthorized transfers.
Before most organizations call the police, they run some kind of internal review — their accountant or an outside auditor digs into the discrepancies first. That internal work usually produces the initial evidence law enforcement needs to open a formal case. Investigators will ask the reporting party for supporting documents: bank statements showing unauthorized withdrawals, audit results, a timeline of the suspicious activity, and an explanation of how the suspect had access to the funds.
The quality of this first report matters a great deal. A vague complaint about “money missing” gives detectives little to work with. A detailed account showing specific transactions, dates, and the suspect’s role in handling finances gives investigators a starting point and makes it far more likely the case gets pursued.
Following the Paper Trail
Once a case is open, investigators focus on collecting and analyzing every financial record they can reach. This is painstaking work, and it eats most of the investigative hours.
Subpoenaing Bank and Financial Records
Investigators use legal tools to compel banks and other financial institutions to produce records. Under the Right to Financial Privacy Act, federal authorities must follow specific procedures — including written certification and, in most cases, notice to the customer — before an institution releases account information.3Federal Deposit Insurance Corporation. VIII-3 Right to Financial Privacy Act In practice, detectives obtain subpoenas or court orders that unlock the suspect’s bank accounts, credit card statements, wire transfer logs, and deposit records. In federal cases, a grand jury subpoena can compel much broader production.
Investigators also benefit from reports banks already file on their own. Under the Bank Secrecy Act, banks must file a Suspicious Activity Report (SAR) with FinCEN for transactions they suspect involve illegal activity, are structured to evade reporting rules, or have no apparent lawful purpose.4Financial Crimes Enforcement Network. FinCEN SAR Electronic Filing Instructions A SAR can surface a scheme before the victim even knows money is gone, and gives investigators a running start in tracing where it went.
Combing Through Internal Records
Alongside bank records, detectives dig into the victim organization’s own documents: accounting ledgers, payroll files, vendor payment records, and expense reports. They look for patterns that match the familiar embezzlement schemes — ghost employees collecting paychecks, invoices from shell companies the suspect controls, electronic payments routed to personal accounts, inflated expense reimbursements.
Each suspicious transaction gets traced from origin to destination. Investigators map where the money started, what authorization moved it, and where it landed. When the suspect has been manipulating records to cover tracks, this stage can take months by itself.
Digital Forensics and Forensic Accountants
Modern embezzlement almost always leaves a digital footprint. Investigators recover data from computers, servers, email accounts, and mobile devices. Deleted files, hidden spreadsheets, and email threads discussing transfers all become evidence. Data a suspect believes they erased can often be pulled back through forensic imaging of hard drives.
Because the schemes get complex, police frequently bring in forensic accountants. These specialists untangle layered transactions, reconstruct altered records, trace funds through multiple accounts, and produce reports that translate the financial chaos into something a jury can follow. In large cases, forensic accounting is the backbone of the prosecution.
Interviews and Surveillance
Records tell investigators what happened. Interviews help establish who did it and whether they did it on purpose. Proving intent — that the suspect knowingly took money they were not entitled to — is essential to a conviction, and documents alone do not always get there.
Detectives interview a range of people connected to the organization. Co-workers who observed the suspect’s behavior. Managers who can explain approval chains and financial procedures. Vendors who may have been unknowingly roped into fraudulent billing. A co-worker might describe the suspect approving payments that normally required someone else’s sign-off. A vendor might confirm they never provided the services on an invoice.
Circumstantial evidence matters too. When someone on a modest salary is suddenly driving a luxury car, taking expensive vacations, or paying cash for a home renovation, that lifestyle evidence becomes relevant once investigators tie it to the timing of missing funds. It is not proof by itself. It corroborates the financial trail.
The suspect is typically interviewed last, after detectives have already assembled substantial evidence. By then, investigators know the answers to most of what they are asking. The interview is as much about documenting the suspect’s account, and any inconsistencies in it, as it is about learning anything new. Some cases also involve physical or electronic surveillance before contact is made, to gather additional proof or confirm the scheme is still active.
Search Warrants and Asset Seizure
The Fourth Amendment requires that search warrants be supported by probable cause and specifically describe both the place to be searched and the items to be seized.5Library of Congress. Amdt4.5.1 Overview of Warrant Requirement To get one, investigators prepare a sworn affidavit laying out what they have gathered and explaining why they believe more evidence exists at a particular location. A judge decides whether the facts are sufficient.6Legal Information Institute. Probable Cause
With a warrant in hand, police can search a suspect’s home, vehicle, office, or storage unit for the listed items. In an embezzlement case, officers look for hidden financial records, computers, external drives, large amounts of cash, and assets purchased with stolen money — luxury goods, jewelry, vehicles, anything that shows where the funds went.
Beyond gathering evidence, the government can seize property that represents the proceeds of the crime. Federal law authorizes civil forfeiture of property traceable to certain fraud and embezzlement offenses, including theft from federally funded programs and financial institution fraud.7Office of the Law Revision Counsel. 18 USC 981 – Civil Forfeiture Forfeited assets can be transferred to courts to fund restitution to victims.8Federal Bureau of Investigation. Asset Forfeiture
Handing the Case to Prosecutors
The investigation ends when detectives package everything — the financial analysis, forensic reports, interview transcripts, digital evidence, and a timeline of the alleged crime — into a case file. That file goes to the prosecutor’s office: a District Attorney at the state level, a U.S. Attorney in federal cases. Police do not file criminal charges. That decision belongs to the prosecutor.
Prosecutors review the evidence and decide whether they can prove every element of the offense beyond a reasonable doubt. For embezzlement, that means showing the suspect had lawful access to the money or property, that they took or converted it for their own use, and that they did so intentionally. If the evidence is strong, charges are filed. If gaps remain, prosecutors may send the case back for more work.
In practice, a large share of financial crime cases resolve by plea agreement rather than trial. A defendant might plead to fewer or lesser charges in exchange for cooperating, particularly when more than one person was involved.
How Long It Takes, and Why Timing Matters
Embezzlement cases do not resolve quickly. A straightforward case with clear records and a single suspect might take several months. Complex schemes involving multiple accounts, shell companies, or years of manipulated records can run two or three years, sometimes longer. Federal investigations tend to run long because of the sheer volume of records and the coordination between agencies.
That timeline collides with a statute of limitations the victim may not realize is ticking. Under federal law, prosecutors generally have five years from the date of the offense to bring charges.9Office of the Law Revision Counsel. 18 USC 3282 – Offenses Not Capital The window extends to ten years for offenses involving financial institutions, including embezzlement from banks and credit unions.10Office of the Law Revision Counsel. 18 USC 3293 – Financial Institution Offenses State deadlines vary, with many in the three-to-six-year range.
Embezzlement often goes undetected for years, and organizations sometimes spend additional months on internal review before contacting police. By the time law enforcement builds a case, the clock may be close to running out. Reporting promptly, and showing up with organized records — specific transactions, bank statements, documentation of the suspect’s access and responsibilities — is the single most effective thing a victim can do to keep an investigation moving and bring charges before the deadline expires.