Employee embezzlement happens when a worker who was lawfully entrusted with company money or property diverts it for personal use. It is prosecuted as a felony in most cases involving meaningful dollar amounts, carries federal prison exposure of up to 10 years for theft of government funds over $1,000 and up to 30 years for bank employees, and almost always triggers a court order to repay the victim. Employers who catch it have several parallel avenues for recovery: criminal restitution, civil lawsuits, and fidelity insurance claims.
What Employee Embezzlement Is
Embezzlement is different from ordinary theft in one important way. A thief takes something they were never supposed to have. An embezzler starts with lawful possession — the company gave them access to accounts, inventory, or funds as part of the job — and then converts those assets for personal benefit. The U.S. Department of Justice defines the offense as “the fraudulent appropriation of property by a person to whom such property has been entrusted, or into whose hands it has lawfully come.”1U.S. Department of Justice. Criminal Resource Manual 1005 – Embezzlement
To convict, prosecutors typically need to prove three things: that the employer entrusted the employee with property, that the employee intentionally converted it for personal benefit, and that the employee meant to permanently deprive the employer of it. The conversion itself can be as simple as moving company funds into a personal account or as layered as running payments through a fake vendor.
How Employees Steal
Most embezzlement follows a handful of well-worn playbooks. The method usually depends on what the employee has access to, and the schemes tend to exploit gaps in oversight rather than sophisticated technology.
- Check fraud. An employee with access to company checks forges a signature, changes the payee, or writes checks to themselves. Some schemes involve “washing” legitimate checks with chemicals to erase and rewrite the amount.2Office of the Comptroller of the Currency. Check Fraud
- Skimming. The employee pockets cash payments from customers before recording the transaction. Because the money never hits the books, skimming is one of the hardest schemes to catch through normal accounting reviews.
- Phantom vendors. The employee sets up a shell company and submits fake invoices for goods or services that were never provided. The company pays, and the money flows to the employee’s front company.
- Expense fraud. Inflated or fabricated expense reports, or personal purchases on a company credit card, give employees a direct path to company funds with almost no paper trail if no one reviews the charges.
- Payroll manipulation. Employees with payroll access add ghost employees, inflate hours, or adjust their own pay rates. In small companies where one person handles the entire process, these schemes can run for years.
Cryptocurrency has added a newer variation. An employee with wallet access or exchange credentials can transfer funds to personal wallets and use mixing services to obscure the trail, though every blockchain transaction is permanently recorded and forensic investigators can often trace funds back to identity-verified exchange accounts.
Warning Signs
The Association of Certified Fraud Examiners found that 43% of occupational fraud cases are detected by tips, more than three times the rate of the next most common method.3Association of Certified Fraud Examiners. 2024 Report to the Nations Coworkers and managers noticing something off is the single most effective detection tool, which means knowing what to look for matters more than any audit.
Behavioral red flags include an employee who never takes vacation, insists on handling certain accounts alone, or becomes defensive when anyone asks about their work. Lifestyle changes that don’t match the person’s salary — a new car, expensive vacations, unexplained wealth — are classic indicators.4Department of Defense Inspector General. Fraud Red Flags and Indicators On the financial side, watch for vendors nobody else recognizes, invoices without supporting documentation, and accounting discrepancies that always seem to have a ready explanation.
None of these signs prove embezzlement on their own. But when several appear together, they warrant a closer look, and early looks tend to keep losses small. ACFE data shows median losses climb sharply with tenure: schemes by employees with less than a year on the job cause a median loss of $50,000, while those by employees with more than 10 years reach $250,000.3Association of Certified Fraud Examiners. 2024 Report to the Nations
What to Do When You Suspect It
Start by preserving evidence. Financial records, emails, access logs, and computer files need to be secured before the employee has a chance to alter or destroy anything. Most employers then run an internal investigation to determine what happened and how much is missing. Forensic accountants play a central role: they trace funds through complex records, identify transactions that don’t match legitimate activity, and quantify the total loss.5Association of Certified Fraud Examiners. The Power of Forensic Accountants in Uncovering Fraud and Protecting Organizations Their findings become the backbone of both criminal complaints and civil lawsuits.
Once the review confirms criminal conduct, report the matter to local law enforcement, or to a federal agency like the FBI for larger cases involving federal programs or financial institutions. Employers sometimes hesitate here out of concern about defamation liability, but that concern is largely misplaced. Statements made to law enforcement about suspected crime are generally protected by an absolute privilege, and internal discussions among managers and investigators with a legitimate business reason to know are typically covered by a qualified privilege for good-faith statements. The main thing to avoid is broadcasting accusations to people who have no role in the investigation.
Filing a Suspicious Activity Report
Banks, brokerages, insurance companies, and money services businesses have an additional duty. They must file a Suspicious Activity Report with the Financial Crimes Enforcement Network when they detect suspicious transactions involving $5,000 or more. The filing deadline is 30 days from the date the institution first identifies the activity, extendable to 60 days if no suspect has been identified.6Financial Crimes Enforcement Network. FinCEN SAR Electronic Filing Instructions Failing to file can expose the institution itself to regulatory penalties.
Criminal Penalties the Employee Faces
Most employee embezzlement is prosecuted at the state level, though several federal statutes apply when the victim or funding source has a federal connection.
Federal Charges
Stealing, converting, or misapplying federal government money or property triggers 18 U.S.C. § 641. If the value exceeds $1,000, the offense is a felony punishable by up to 10 years in prison.7Office of the Law Revision Counsel. 18 USC 641 – Public Money, Property or Records Under the general federal sentencing framework, felony fines can reach $250,000 for individuals.8Office of the Law Revision Counsel. 18 USC 3571 – Sentence of Fine Values of $1,000 or less drop to a misdemeanor with a one-year maximum.
Employees of organizations that receive more than $10,000 per year in federal grants, contracts, or other assistance fall under 18 U.S.C. § 666 if they steal property worth $5,000 or more. That reaches hospitals, universities, nonprofits, and local government agencies. The maximum penalty is 10 years in prison and a fine.9Office of the Law Revision Counsel. 18 USC 666 – Theft or Bribery Concerning Programs Receiving Federal Funds
Bank employees face the harshest federal exposure. Under 18 U.S.C. § 656, an officer, director, or employee of a federally insured bank who embezzles any amount can be fined up to $1,000,000 and imprisoned for up to 30 years.10Office of the Law Revision Counsel. 18 USC 656 – Theft, Embezzlement, or Misapplication by Bank Officer or Employee Even amounts under $1,000 carry up to one year in prison.
State Charges
Every state treats embezzlement differently, and penalties almost always scale with the amount stolen. The threshold that separates misdemeanor from felony usually falls somewhere between $1,000 and $2,500, though a few states set it as low as $500. Felony sentences commonly range from one to 20 years depending on the state and the amount. Many states use tiered structures that ratchet up the classification at multiple dollar thresholds, and prosecutors in some jurisdictions can charge each act of conversion separately, which means an employee who stole monthly for years may face dozens of counts.
How Employers Recover Losses
A criminal conviction does not make the employer whole. Recovery typically runs on three parallel tracks.
Court-Ordered Restitution
Federal law makes restitution mandatory, not discretionary, for property offenses committed through fraud or deceit when an identifiable victim suffered a financial loss. Under the Mandatory Victims Restitution Act, the sentencing court must order the defendant to repay the victim in addition to any prison time or fines.11GovInfo. 18 USC 3663A – Mandatory Restitution to Victims of Certain Crimes Restitution orders survive bankruptcy in most cases and are enforceable like other federal judgments. Collecting the full amount is a different problem: by the time a case reaches sentencing, the stolen funds are often gone, and payments may trickle in over years as a condition of supervised release. Employers should not rely on criminal restitution alone.
Civil Lawsuits
You don’t need to wait for a conviction to file a civil case, and the civil burden of proof (preponderance of the evidence) is lower than the criminal standard (beyond a reasonable doubt). Common claims include conversion (the civil equivalent of theft), fraud, unjust enrichment, and breach of fiduciary duty. Courts can also impose a constructive trust on assets the employee bought with stolen money, which lets the employer claim specific property rather than just a monetary judgment.
Timing matters. Civil statutes of limitations for conversion and fraud generally range from two to six years depending on jurisdiction, with the clock often starting when the employer discovered the theft or reasonably should have. Delays in filing can be fatal to a claim, especially once the employee has had time to spend or hide assets.
Fidelity Insurance
Fidelity and crime insurance exists specifically to cover losses from employee dishonesty, including stolen money, forged checks, computer fraud, and funds transfer fraud.12Travelers. Fidelity and Crime Insurance Policies have dollar limits that may fall well short of a major loss, they typically require prompt notification after discovery, and they won’t cover losses the employer knew about and tolerated. If you recover through both insurance and civil litigation, the insurer is generally entitled to subrogation, meaning it can step into your shoes and pursue the employee for what it paid you. Businesses that handle significant cash or give employees access to large accounts should review coverage limits periodically.
Tax Deduction
A business that loses money to embezzlement can deduct the theft loss under Section 165 of the Internal Revenue Code. The IRS defines a qualifying theft as “the taking and removal of money or property with the intent to deprive the owner of it” where the taking is illegal under applicable state law.13Internal Revenue Service. Topic No. 515 – Casualty, Disaster, and Theft Losses The deductible amount is generally the adjusted basis of the stolen property, which for cash is simply the amount taken, reduced by any insurance reimbursement or restitution you receive or expect to receive. Business theft losses are reported on Section B of IRS Form 4684. Individual employees who are themselves victims of job-related theft can no longer deduct those losses as miscellaneous itemized deductions; that limitation does not apply to the business.14Internal Revenue Service. 2025 Instructions for Form 4684 – Casualties and Thefts
How to Prevent It
Over half of occupational fraud cases happen because of missing internal controls or because existing controls were overridden.3Association of Certified Fraud Examiners. 2024 Report to the Nations The controls most likely to prevent embezzlement are neither expensive nor complicated:
- Segregate duties. No single employee should control an entire financial process from start to finish. The person who approves invoices should not be the same person who cuts checks, and the person who runs payroll should not distribute the payments.
- Require dual authorization. Two signatures on checks and two approvals for wire transfers above a set dollar amount eliminate a huge category of schemes.
- Run surprise audits. An unexpected review of cash flow and vendor payments deters would-be embezzlers who rely on predictable oversight.
- Review vendors independently. Have someone outside accounts payable periodically review the full vendor list. Phantom vendor schemes collapse the moment an independent set of eyes asks who a company is and what it does for you.
- Screen employees. Run background checks before hiring anyone who will handle money, and periodically during employment. Prior fraud convictions are a strong predictor of future risk.
- Provide a reporting channel. Since tips are the top detection method by a wide margin, giving employees a confidential way to report concerns — a hotline, an online portal, or a designated contact outside their chain of command — dramatically increases the odds of early detection.
Small businesses are disproportionately vulnerable because they often lack the staffing to properly separate financial duties. If one person handles all your money, at minimum make sure a second person reviews bank statements every month and spot-checks expenses and vendor payments.