When an employee misuses a company credit card, the company still owes the issuer for every charge and has to chase the employee separately to get the money back. The federal $50 liability cap does not apply, because an employee issued a card is an authorized cardholder, not a thief in the legal sense the statute cares about. Your job now is to stop new charges immediately, build a clean paper trail, and pick a recovery path — civil demand, criminal restitution, insurance, or a carefully handled payroll deduction — that fits the amount and the evidence.
Shut the Card Off First
Call the card issuer and suspend or deactivate the card the moment you suspect misuse. Nothing you do next matters if the employee is still charging while you investigate. One phone call contains the damage.
Then pull complete transaction records from the issuer for the full period in question: merchant names, dates, amounts, and point-of-sale locations. Gather every expense report the employee submitted during that same window, along with any receipts. Put the two side by side. Charges with no matching expense report, purchases at retailers unrelated to the employee’s role, and reports with altered or missing receipts are your strongest evidence.
If the employee claims the card was lost or stolen, transaction data showing continued PIN use, online-account logins, or purchases near the employee’s home address usually ends that defense. Keep everything organized chronologically. You will need the same file whether you go internal, civil, or criminal.
Bring in legal counsel before you confront the employee, especially if termination or a police referral is on the table. Accessing the employee’s personal devices without authorization, or making accusations in front of coworkers, can create liability for the company that dwarfs the original loss.
Why the Card Issuer Will Not Cover It
This is where employers get an unpleasant surprise. Federal law caps a cardholder’s liability for truly unauthorized credit card use at $50, but “unauthorized use” has a specific legal meaning: use by someone other than the cardholder who lacks actual or implied authority and from whom the cardholder receives no benefit.1eCFR. 12 CFR 1026.12 – Special Credit Card Provisions An employee who was handed a company card and told to use it for business expenses is an authorized cardholder. When that employee books a personal vacation on the account, it is misuse of authority, not unauthorized use. The issuer has no obligation to reverse the charge.
Regulation Z’s protections do reach business-purpose credit cards for genuinely unauthorized situations, such as a stranger using a stolen card.2Consumer Financial Protection Bureau. 1026.3 Exempt Transactions They do not reach employee misuse. Organizations that issue ten or more cards can negotiate different liability arrangements with the issuer, but absent that agreement, the company pays the bill and pursues the employee on its own.1eCFR. 12 CFR 1026.12 – Special Credit Card Provisions
Ways to Get the Money Back
Recovery is a separate problem from punishment. Even if the employee is prosecuted, that does not by itself put cash back in the company account. Employers usually have a few paths, and they are not mutually exclusive.
Demand Letter and Civil Suit
Start with a formal written demand that lists every unauthorized charge, states the total owed, and sets a deadline for repayment. A lot of employees pay at this stage once they understand the alternative is a lawsuit on the public record. If the demand is ignored, file a civil claim for the full amount. Small claims court works for smaller totals — most states allow claims somewhere between $8,000 and $20,000, depending on the jurisdiction. Larger amounts go to regular civil court. The documentation you built during the investigation is what wins these cases.
Criminal Restitution
If the case is prosecuted, the sentencing court can order the employee to repay the stolen funds to the company. Federal law authorizes restitution based on the actual loss to the victim and the defendant’s financial resources, and it can be ordered on top of fines and prison time.3Office of the Law Revision Counsel. 18 USC 3663 – Order of Restitution Restitution gives the company a court-enforceable payment obligation without having to file its own civil suit. Collection, though, depends on what the employee can actually pay, and satisfying a restitution order can take years.
Employee Dishonesty Insurance
If the company carries an employee dishonesty policy or a fidelity bond, credit card misuse is generally the sort of loss it exists to cover. These policies reimburse the employer for money, property, or services stolen by an employee, up to the bond limit. The claim requires documentation of the specific transactions and evidence tying them to the employee, and the insurer will want proof of a dishonest act rather than accounting error or negligence. If you later collect from the employee, the insurer is usually entitled to reimbursement up to the amount it paid.
Tread Carefully With Paycheck Deductions
Taking the money out of the employee’s final paycheck feels like the fastest fix. The wage laws make it one of the most dangerous.
The federal Fair Labor Standards Act generally prohibits deductions that push an employee’s pay below minimum wage, and the Department of Labor treats deductions for theft or property damage as being for the employer’s benefit, which subjects them to that minimum-wage floor.4U.S. Department of Labor. Fact Sheet 16: Deductions From Wages for Uniforms and Other Facilities Under the Fair Labor Standards Act (FLSA) You cannot get around this by demanding cash reimbursement in place of the deduction.
Federal courts have recognized a narrow exception for intentional misappropriation, allowing repayment of deliberately stolen amounts to be deducted even below minimum wage. Relying on that exception is risky. If the employee disputes intent and files a wage claim, the employer ends up defending FLSA litigation that can cost more than the original loss. State laws pile on: some states forbid theft-related wage deductions unless the employee agrees in writing or the employer obtains a court order, and others allow deductions with far fewer restrictions. Check your state’s wage payment law before touching the paycheck, and get legal advice if the number is meaningful.
Criminal Exposure for the Employee
An employee who intentionally misuses a company card can face charges for theft, embezzlement, or credit card fraud. Under federal law, using a stolen or fraudulently obtained credit card to obtain $1,000 or more in goods, services, or cash within a single year carries up to $10,000 in fines, up to ten years in prison, or both.5Office of the Law Revision Counsel. 15 USC 1644 – Fraudulent Use of Credit Cards; Penalties Most cases, though, are handled under state theft or embezzlement statutes, where the felony threshold typically falls somewhere between $950 and $2,500 in total value.
Timing matters. The federal statute of limitations for most fraud offenses is five years from the date of the crime, extending to ten years when the offense affects a financial institution.6Library of Congress. Statute of Limitation in Federal Criminal Cases: An Overview State limitations vary. Employers who sit on a discovery for months while they debate whether to report risk running out the clock on prosecution — and on the leverage that a pending criminal case gives them in civil recovery.
Tax Treatment of the Loss
The stolen amounts are taxable income to the employee in the year the misuse occurred, whether or not the employee is caught or ordered to make restitution. The Supreme Court has held that money acquired unlawfully is gross income under IRC Section 61, the same as lawfully earned income.7Internal Revenue Service. PMTA-2024-06 If the employee does not report it, additional tax and civil penalties apply.
The company can deduct the theft loss under IRC Section 165. The deduction is available in the tax year the loss is discovered, not the year the theft occurred, and it must be reduced by any amount recovered through insurance or otherwise.8Office of the Law Revision Counsel. 26 U.S. Code 165 – Losses Reporting the embezzled amounts to the IRS both documents the company’s loss and creates a record that the employee received unreported income.
A Written Policy Is Your Best Piece of Evidence
A written credit card policy does more than set expectations; it becomes evidence. When an employee has signed a policy that prohibits personal use and then charges a family trip, the company’s case for intentional misuse gets much stronger. Without a signed policy, the employee can argue they did not know the rules or thought the charge was acceptable.
A policy worth having covers:
- Who is eligible for a card and under what circumstances, tied to job function.
- Specific categories of authorized expenses, with examples of what is and is not allowed.
- Spending limits per transaction, per day, or per billing cycle, set through the card issuer so they are enforced automatically rather than on the honor system.
- A firm deadline for submitting itemized receipts for every charge, creating an audit trail that makes concealment difficult.
- An explicit statement that personal use will result in discipline up to termination, a duty to reimburse all unauthorized charges, and possible referral to law enforcement.
Require every cardholder to sign the policy before receiving a card, and keep the signed copy in the personnel file. Review expense reports on a set schedule rather than waiting for something to look wrong, and use monitoring tools that flag unusual spending patterns, non-business merchants, or charges outside normal working hours. Companies that catch this behavior early are almost always the ones that were already looking for it.