Home  /  Guides  /  Employee theft

How to investigate employee theft

Most internal loss is discovered by accident, long after it starts. When you suspect an employee is stealing, how you respond determines whether you resolve it cleanly — or turn a loss into a lawsuit.

Guide by Draco Investigative Services · Updated September 2026

The signs worth taking seriously

Employee theft ranges from cash and inventory to padded expenses, fraudulent refunds, time theft, and data. A single red flag rarely proves anything, but patterns are telling:

  • Inventory or cash shortages that track to one person’s shifts
  • A reluctance to take time off, or to let anyone else handle their duties
  • Voided sales, refunds, or adjustments clustering around one employee
  • Vendor or expense irregularities and lifestyle changes that do not fit the salary
  • Missing documentation, or records that do not reconcile

Why discretion has to come first

The instinct to confront is understandable and almost always wrong. Tipping off a suspect lets them cover their tracks, destroy evidence, or get ahead of the story — and confronting the wrong person, or handling it clumsily, can expose you to defamation, wrongful-termination, and privacy claims. The first move is to investigate quietly and build the facts.

Building a case that holds up

A professional investigation gathers evidence lawfully and documents it to a standard that survives scrutiny — because you may need it for a termination, an insurance claim, or a prosecution. Depending on the situation, that can include discreet surveillance, review of transaction and access records, digital forensics where data or devices are involved, and, when appropriate, professional interviews.

Just as important, it is done within employment and privacy law, so the way you got the evidence does not become the employee’s defense. That combination — thorough and lawful — is what turns a suspicion into a defensible, resolvable matter.

Employee-theft questions

Not first. Confronting a suspect tips them off to cover their tracks and, if you are wrong or handle it poorly, can expose you to legal claims. Investigate quietly and build the facts before anyone is confronted.

Discreetly — through methods like transaction and access-record review, digital forensics, and surveillance where warranted — establishing what is happening before the employee is aware anything is underway.

Yes, when conducted within employment and privacy law. Doing it correctly is exactly what keeps the evidence usable and protects you from claims — which is why professional handling matters.

That is the goal. We document everything to an evidentiary standard so it holds up for a termination, an insurance claim, or referral to law enforcement, and we can coordinate with your counsel and HR.

Handle it quietly, resolve it cleanly.

Tell us what you are seeing in a confidential consultation. We will establish the facts discreetly and defensibly, so you can act with confidence.

Explore Corporate Investigations