Internal theft is the misappropriation of an employer’s assets by someone inside the organization who already has legitimate access to them. That access is what makes these schemes effective: the median loss from a single occupational fraud case runs about $145,000, and the typical scheme operates for roughly a year before anyone notices. Roughly nine out of ten cases involve some form of asset misappropriation, whether the asset is cash, inventory, data, or paid working hours.
Because the perpetrator has lawful entry to the cash drawer, the accounting system, the server, or the time clock, the warning signs usually sit in the gap between two sets of records that nobody is comparing.
The Common Forms Internal Theft Takes
Cash and Inventory
The most direct version is the physical removal of cash or merchandise. An employee walks out with stock, office equipment, or supplies. The loss shows up as missing inventory and reduced revenue.
Skimming is harder to see. The employee takes cash from a transaction before it is recorded, so the accounting system shows nothing missing. A cashier who rings up a sale for less than the actual price and pockets the difference creates a gap that only surfaces when a physical count fails to match sales data. Without point-of-sale audits or surveillance, this can run for months.
Financial and Accounting Schemes
Embezzlement is the classic financial scheme. A person entrusted with funds channels them to personal use. The defining element is lawful possession before the diversion, which is why a bookkeeper who moves company money commits embezzlement while a stockroom worker who takes merchandise commits larceny.
Concealment often takes the form of lapping, where a stolen payment from one customer’s account is covered by a later payment from a different customer, with the deficit shifting around indefinitely. The scheme falls apart when the employee goes on vacation or leaves the job, which is why rotation of duties is one of the most effective controls available. Fictitious-vendor fraud works through the accounts payable system: the employee creates a fake supplier, submits invoices, and collects the payments. Expense reimbursement fraud is the same logic at smaller scale.
Data and Trade Secret Theft
Not all stolen assets are physical. Customer lists, source code, manufacturing processes, and strategic plans can represent years of investment. When an employee emails product designs to a competitor or copies a confidential database to a personal device, the original files may still sit on the company server, but the exclusive hold on that information is gone.
Federal law defines a trade secret broadly as any financial, business, scientific, technical, or engineering information that derives economic value from being kept secret, so long as the owner has taken reasonable measures to protect it.1Office of the Law Revision Counsel. 18 U.S. Code 1839 – Definitions A company that leaves sensitive data on an unprotected shared drive will struggle to prove trade secret theft; one with access controls, encryption, and confidentiality agreements has a much stronger case.
The Computer Fraud and Abuse Act adds a separate layer. “Exceeding authorized access” means using legitimate login credentials to obtain information the employee wasn’t entitled to see.2Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers An IT administrator who can reach the entire server but downloads customer financial data for personal gain has exceeded authorized access even though the system let them in.
Time and Payroll Fraud
Time theft doesn’t remove anything from the premises, but the employer still pays for labor it never received. Buddy punching, where one worker clocks in for an absent colleague, is probably the most common tactic. Falsified timesheets inflate start and end times. Employees who spend large portions of a shift on personal business create the same loss through a different path. Rather than one dramatic hit, time fraud creates a persistent drag on payroll costs, often invisible in organizations without electronic timekeeping.
Criminal Penalties
State Charges
Every state draws a line between misdemeanor and felony theft based on the value of the stolen property. Those thresholds vary widely, from as low as $200 to as high as $2,500. Below the line, theft is generally a misdemeanor carrying county jail time; above it, charges escalate to a felony with the possibility of state prison. Many states further divide felony theft into multiple degrees, so a $3,000 theft and a $1 million theft are both felonies but are charged very differently. Embezzlement is often prosecuted under the same theft statutes, sometimes under its own code section.
Federal Charges
Federal charges enter the picture when the theft involves government property, interstate communications, or computer systems. Several statutes apply directly:
- Theft of government property under 18 U.S.C. § 641 carries up to 10 years in prison. If the total value is $1,000 or less, the maximum drops to one year.3Office of the Law Revision Counsel. 18 U.S. Code 641 – Public Money, Property or Records
- Wire fraud under 18 U.S.C. § 1343 covers any scheme to defraud that uses electronic communications, including email, phone, or wire transfers, with a maximum of 20 years. Federal prosecutors reach for this statute often because nearly every modern scheme touches some electronic communication.4Office of the Law Revision Counsel. 18 U.S. Code 1343 – Fraud by Wire, Radio, or Television
- Computer fraud under 18 U.S.C. § 1030 carries up to five years on a first offense for exceeding authorized access for financial gain, with the maximum doubling to 10 years on a second conviction.2Office of the Law Revision Counsel. 18 U.S. Code 1030 – Fraud and Related Activity in Connection With Computers
- Theft of trade secrets under 18 U.S.C. § 1832 carries up to 10 years for an individual. A convicted organization faces fines of up to $5,000,000 or three times the value of the stolen trade secret, whichever is greater.5Office of the Law Revision Counsel. 18 U.S. Code 1832 – Theft of Trade Secrets
In federal property and fraud cases, the court must order the defendant to pay restitution to the victim. It is not discretionary. The defendant must return the stolen property or, if that is impossible, pay the greater of its value at the time of the theft or at sentencing.6Office of the Law Revision Counsel. 18 U.S. Code 3663A – Mandatory Restitution to Victims of Certain Crimes Restitution is on top of any prison sentence or fine, not in place of one.
Civil Recovery by the Business
Criminal prosecution is handled by the government, but the victimized business can file its own civil suit, and it doesn’t have to wait for a criminal conviction to do so.
The most common theory is conversion: one party takes another’s property with intent to deprive them of it. The remedy is return of the property or its fair market value. Breach of fiduciary duty applies when the employee held a position of trust, such as a manager, officer, or financial custodian. These suits seek compensatory damages and may include legal fees.
For trade secret theft, the Defend Trade Secrets Act provides a federal civil cause of action. A court can issue an injunction against further misuse, award monetary damages covering actual losses and unjust enrichment, and, if the misappropriation was willful and malicious, add exemplary damages up to double the compensatory amount plus reasonable attorney fees.7GovInfo. 18 U.S. Code 1836 – Civil Proceedings
There is a trap on that last point. Federal law requires employers to include a notice of whistleblower immunity in any contract or agreement governing trade secrets or confidential information. The notice must tell the employee that disclosing a trade secret to a government official or in a sealed court filing to report a suspected legal violation carries no criminal or civil liability.8Office of the Law Revision Counsel. 18 U.S. Code 1833 – Exceptions to Prohibitions An employer that skips the notice forfeits the right to exemplary damages and attorney fees in any DTSA suit against that employee. Many businesses still miss this.
Beyond federal law, a number of states allow treble damages (three times the actual loss) in civil theft cases. The standards vary by jurisdiction, but the structure gives businesses a reason to pursue civil recovery even when the raw dollar amount would otherwise make litigation uneconomical.
What Employers Can and Can’t Do While Investigating
Catching an employee stealing does not give the employer unlimited authority to investigate however it wants. Several federal laws constrain the process, and violating them can create liability of their own.
Outside Investigators and the FCRA
When an employer hires an outside firm to investigate a suspected theft, the Fair Credit Reporting Act applies. Before obtaining the report, the employer must give the employee a standalone written notice that an investigation may occur and must get written permission. If the investigation leads to termination or another adverse action, the employee must receive a copy of the report and a summary of their FCRA rights beforehand, and a follow-up notice identifying the reporting company and explaining their right to dispute the findings afterward.9Federal Trade Commission. Using Consumer Reports: What Employers Need to Know Skipping steps can turn a justified termination into a lawsuit the employer loses.
Polygraphs
The Employee Polygraph Protection Act generally bans lie-detector tests in the workplace. It allows a narrow exception for ongoing theft investigations, and only for polygraphs specifically. All of the following must be true: the test relates to a specific incident of economic loss, the employee had access to the property, and the employer has a reasonable basis for suspecting that particular employee.10Office of the Law Revision Counsel. 29 U.S. Code 2006 – Exemptions The employer must also hand the employee a detailed written statement describing the loss, the access, and the basis for suspicion at least 48 hours before the test.11eCFR. 29 CFR 801.12 – Exemption for Employers Conducting Investigations of Economic Loss or Injury Random polygraph sweeps are flatly prohibited.
Docking the Paycheck
The first instinct after discovering a theft is often to deduct the loss from the employee’s next check. Under the Fair Labor Standards Act, deductions for cash shortages, missing merchandise, or stolen property cannot drop pay below the federal minimum wage or cut into required overtime.12U.S. Department of Labor. Handy Reference Guide to the Fair Labor Standards Act State laws add further restrictions. Some prohibit unilateral deductions entirely; others require specific written authorization. A deduction done the wrong way can produce a wage-and-hour claim worth more than the original theft.
Tax Treatment for the Business
A victimized business can deduct its theft losses, and the IRS has its own interest in whoever took the money.
To claim the loss, the employer files Form 4684 (Casualties and Thefts). The deductible amount is the property’s adjusted basis minus any salvage value and any insurance reimbursement. Business theft losses are not subject to the $100 per-incident floor or the 10% of adjusted gross income threshold that limit individual deductions.13Internal Revenue Service. Publication 547 (2025), Casualties, Disasters, and Thefts For stolen inventory, the business can instead adjust opening inventory or purchases downward so the loss flows through cost of goods sold. Either way, the employer must document ownership, the fact of the theft, when the theft was discovered, and the status of any insurance claim.
If the employer suspects the perpetrator failed to report the stolen funds, Form 3949-A lets the business file a referral with the IRS.14Internal Revenue Service. Form 3949-A Information Referral Stolen cash is taxable income to the thief regardless of how it was obtained.