Small business embezzlement costs companies with fewer than 100 employees a median of roughly $141,000 per case, and it usually runs for months or years before anyone notices. The damage is severe precisely because smaller companies lack both the financial cushion to absorb the loss and the layered oversight to catch it early. Nearly every scheme traces back to the same structural weakness: one trusted person handling too many financial tasks with too little supervision.
The Schemes Owners Actually See
Embezzlement in a small company tends to follow a handful of recognizable patterns. Knowing what they look like is the first step to spotting one in your own books.
Cash Skimming and Lapping
Skimming is the simplest version. An employee takes cash before it ever hits the accounting system, usually at the point of sale. Because the money was never recorded, there is no line item to reconcile. The only way to catch it is by noticing that revenue trends don’t match foot traffic, inventory movement, or other indirect indicators.
Lapping is more involved. An employee pockets a payment from one customer, then covers the gap by applying the next customer’s payment to the first account. It becomes a rolling shell game that requires constant attention to keep customer statements looking normal. Lapping schemes often collapse on their own when the employee goes on vacation or calls in sick, which is one reason mandatory time off works as a detection tool.
Payroll Fraud
Ghost employees are a classic tactic. An administrator with sole control over payroll creates a fictitious worker or keeps a terminated employee on the books, then routes those paychecks into a personal account through direct deposit. Inflating hours on legitimate timecards works the same way when the same person who enters time data also approves payments. When one individual controls both sides of the process, these schemes can run for years before anyone asks the right question.
Expense Reimbursement Fraud
Employees submit fabricated or inflated receipts for costs the business never incurred. A personal dinner becomes a client meal; a weekend trip becomes a site visit. Owners who approve reimbursements without scrutinizing supporting documents create an open invitation to test the limits. There’s a secondary problem too: the fraudulent expenses get booked as legitimate deductions, which means tax filings are built on false data and could trigger issues during an audit.
Digital Payment Fraud
Modern embezzlement increasingly involves electronic transfers and payment apps. An employee with account access can initiate small ACH transfers, redirect vendor payments to accounts they control, or use business-linked payment platforms for personal purchases. Unlike a forged check, digital transactions can be initiated remotely and scheduled to process during off-hours. Payment apps carry particular risk because they lack the fraud protections built into credit card networks, and funds sent through them are rarely recoverable once the transfer completes.
What Legally Counts as Embezzlement
Embezzlement is distinct from ordinary theft in one critical way: the person who took the money had legitimate access to it first. The Department of Justice defines it as the fraudulent taking of property by someone to whom that property was entrusted or into whose hands it lawfully came.1U.S. Department of Justice. Criminal Resource Manual 1005 – Embezzlement That element of trust is what separates embezzlement from larceny, where the thief never had permission to handle the property at all.
To secure a conviction, prosecutors generally need to prove three things. The defendant had lawful access to the money or property through a relationship of trust, such as an office manager handling deposits or a bookkeeper managing accounts payable. The defendant used that access to divert the property for personal benefit. And the defendant acted intentionally rather than making an honest mistake.2United States Courts for the Ninth Circuit. 23.1 Theft of Government Money or Property (18 U.S.C. 641) The line between a bookkeeping error and a criminal act lives in that intent element, which is why documentation of the defendant’s pattern of behavior matters so much at trial.
Criminal Penalties
Most small business embezzlement cases are prosecuted under state law, where penalties scale with the amount stolen. Felony thresholds vary but fall between $1,000 and $2,500 in the majority of states, with maximum sentences for felony-level embezzlement ranging from a few years to well over a decade depending on the jurisdiction and the amount involved. Some states impose harsher penalties when the defendant held a fiduciary position or victimized a vulnerable person, regardless of the dollar amount.
Federal charges enter the picture under specific circumstances. If the embezzled property belongs to the federal government, the case falls under 18 U.S.C. § 641, which carries up to ten years in prison for amounts exceeding $1,000 and up to one year for amounts at or below that threshold.3Office of the Law Revision Counsel. 18 U.S.C. 641 – Public Money, Property or Records Organizations that receive more than $10,000 in federal program funds fall under 18 U.S.C. § 666, which covers embezzlement of $5,000 or more and also carries up to ten years.4Office of the Law Revision Counsel. 18 U.S.C. 666 – Theft or Bribery Concerning Programs Receiving Federal Funds
The heaviest federal exposure comes from wire fraud and mail fraud charges. Prosecutors frequently layer these onto embezzlement cases because almost any scheme that uses electronic banking, email, or the postal system to move stolen funds qualifies. Both carry a maximum of twenty years in prison.5Office of the Law Revision Counsel. 18 U.S.C. 1343 – Fraud by Wire, Radio, or Television6Office of the Law Revision Counsel. 18 U.S.C. 1341 – Frauds and Swindles If the fraud affects a financial institution, that ceiling rises to thirty years and a fine of up to $1,000,000. Federal sentencing guidelines also increase the effective sentence based on total loss amount, number of victims, and whether the defendant abused a position of trust.
What to Do First
Before contacting law enforcement, gather what you can. Pull bank statements, payroll records, access logs, and any documentation that shows the discrepancy. You don’t need to build a complete case, but investigators will take the report more seriously if you can point to specific dollar amounts and a plausible suspect rather than a vague sense that money is missing. A forensic accountant can quantify the loss and trace the funds; hourly rates typically run $150 to $400, with full investigations for smaller cases costing roughly $3,000 to $10,000.
File a report with your local police department. Embezzlement is a property crime, and the police report creates the official record that prosecutors, insurers, and the IRS will all reference later. For cases involving electronic transfers, internet-based fraud, or larger amounts that may involve federal jurisdiction, the FBI accepts reports through tips.fbi.gov, through local FBI field offices, and through ic3.gov for internet-enabled schemes.7Federal Bureau of Investigation. White-Collar Crime
Timing matters. The standard federal statute of limitations for embezzlement is five years from the date of the offense.8Office of the Law Revision Counsel. 18 U.S.C. 3282 – Offenses Not Capital State deadlines typically fall in the three-to-seven-year range for felony-level cases. Because embezzlement often continues over a long period, the clock may restart with each individual act, but waiting still shrinks the window for prosecution and makes evidence harder to preserve.
Building the Evidence
Bank statements and canceled checks are the foundation. Compare actual deposits against point-of-sale reports or invoiced amounts to find gaps where cash was diverted before being recorded. Review general ledger entries for unusual adjustments, round-number entries, and transactions posted at odd hours. These anomalies rarely prove anything on their own, but they point investigators toward the right accounts and time periods.
Audit trails from accounting software provide a digital record of every entry, edit, and deletion. Employee access logs show who was logged in when specific changes were made. Cross-reference those logs with physical timecards or badge swipes to confirm the person was actually on-site. Examine canceled checks for unauthorized payees or signatures that don’t match known signers. Vendor lists deserve special scrutiny: a common scheme involves creating a fictitious vendor and routing payments to a personal account.
Maintain a clean chain of custody for everything you collect. Once you suspect embezzlement, make copies of electronic files and store originals securely. If records are altered or lost after suspicion arises, both the criminal case and any civil recovery become dramatically harder to win.
Getting the Money Back
Criminal Restitution
In federal cases, restitution is not optional. The Mandatory Victims Restitution Act requires courts to order defendants convicted of offenses against property, including fraud and embezzlement, to repay the victim in full.9Office of the Law Revision Counsel. 18 U.S.C. 3663A – Mandatory Restitution to Victims of Certain Crimes State courts routinely impose restitution as well. The order sounds reassuring, but collecting on it is another matter. A defendant who spent everything they stole has nothing to garnish, and restitution payments from prison wages can trickle in at a few hundred dollars a year. Getting a restitution order and actually recovering the money are two different things.
Civil Litigation
A separate civil lawsuit gives you tools the criminal case doesn’t. You can pursue the defendant’s personal assets, seek prejudgment attachment to freeze bank accounts and property before trial, and potentially recover attorney’s fees. Prejudgment attachment is powerful but difficult to obtain. Courts treat it as an extraordinary remedy and require you to show a likelihood of success on the merits, identify specific assets, and demonstrate a real risk that the defendant will hide or spend what’s left before judgment. You’ll also need to post a bond.
Civil cases operate on a lower burden of proof than criminal prosecutions, so a defendant who escapes conviction can still lose a civil judgment. The practical question is whether the defendant has anything worth pursuing. If the stolen funds are gone and the defendant has no significant assets, a civil judgment becomes a piece of paper you can’t collect on.
Insurance Coverage
Employee dishonesty coverage, sometimes called a fidelity bond, reimburses your business for losses caused by employee theft, forgery, and embezzlement up to your policy limits. It can be purchased as a standalone commercial crime policy or added as an endorsement to a business owner’s policy. If your business sponsors an employee benefit plan, federal law requires every plan fiduciary to carry a fidelity bond equal to at least 10% of the plan’s assets, with a minimum of $1,000 and a maximum of $500,000 in most cases.10Office of the Law Revision Counsel. 29 U.S.C. 1112 – Bonding
Watch the limits. Most policies exclude losses caused by a business owner, losses from an employee whose prior theft you already knew about, and indirect costs like lost future revenue or business interruption. Filing a claim requires prompt notification and documentation of the loss, typically including the police report and the results of any internal investigation. Read your policy before an incident occurs so you know what’s covered and what the claims process requires.
The Tax Deduction
Embezzled funds are a deductible business loss under federal tax law. The IRS treats theft losses from a trade or business as allowable deductions, defined as the taking of money or property with intent to deprive the owner, where the taking is illegal under the law of the state where it occurred.11Internal Revenue Service. Casualty, Disaster, and Theft Losses The deductible amount equals your adjusted basis in the lost property, minus any insurance payout or other reimbursement you’ve received or expect to receive.
The timing rule catches many owners off guard. You deduct the loss in the year you discover the theft, not the year the embezzlement actually occurred.12Office of the Law Revision Counsel. 26 U.S.C. 165 – Losses If you’re still waiting on an insurance claim or restitution with a reasonable chance of recovery, you can’t deduct that portion until the year you become reasonably certain the money won’t come back.13Internal Revenue Service. Publication 547 – Casualties, Disasters, and Thefts Report the loss on Section B of Form 4684 (Casualties and Thefts), which covers business and income-producing property.11Internal Revenue Service. Casualty, Disaster, and Theft Losses
If you later receive restitution or an insurance payment after you’ve already taken the deduction, the recovered amount may need to be reported as income in the year you receive it. Keep detailed records of the loss amount, the basis for your calculation, and all related insurance correspondence.
Preventing the Next One
The single most effective deterrent is separating financial duties so that no one person controls an entire transaction from start to finish. The person who writes checks shouldn’t be the person who reconciles the bank statement. The person who enters payroll data shouldn’t be the one who approves it. In a five-person office, full separation isn’t always realistic, but partial measures help. Having the owner personally review bank statements, requiring two signatures on checks above a set amount, or assigning an outside accountant to handle monthly reconciliations all create checkpoints that make sustained theft harder to hide.
Documentation discipline matters more than most owners think. Every expense reimbursement should require receipts and a supervisor’s approval before payment. Every vendor should be verified against a master list before the first check goes out. Payroll changes, including new hires, terminations, and rate adjustments, should require sign-off from someone other than the payroll administrator. None of this is complicated, but it needs to be enforced consistently. The schemes above thrive on informal approvals and unchecked trust.
Reconcile key accounts monthly, and have someone outside the day-to-day accounting process review and sign off on each reconciliation. Electronic controls matter too: restrict access to financial systems based on job function, require unique login credentials for every user, change passwords regularly, and audit access logs periodically. If your accounting software tracks who made each entry and when, make sure someone is actually looking at those logs.
Mandatory time off is an underrated detection tool. Lapping schemes and other ongoing manipulations require the perpetrator’s constant attention. When an employee who never takes a vacation is forced to step away for a week, the person covering their duties may notice that accounts don’t balance or that certain transactions don’t make sense. Anonymous reporting channels, even something as simple as a dedicated email address that goes to the owner, give honest employees a way to flag concerns without fear of retaliation. Industry data consistently shows that tips are the most common way occupational fraud gets detected, and businesses without a reporting mechanism catch fraud far less often.