Lapping in accounting is an embezzlement scheme in which an employee steals a customer’s payment and then covers the resulting shortage by posting a later customer’s payment to the first customer’s account, repeating the shuffle indefinitely to keep every balance looking current. It is a sub-category of skimming within asset misappropriation, the fraud family that appears in roughly 89% of occupational fraud cases.1Association of Certified Fraud Examiners. 2024 Report to the Nations The scheme only works when one person controls both incoming cash and the accounts receivable ledger, and it unravels the moment someone else looks at either.
How the Scheme Works
The cycle starts when an employee pockets a payment meant for Customer A’s outstanding invoice. That creates an immediate hole. The company received money, but Customer A’s balance still looks unpaid, and without a cover-up Customer A will get an overdue notice and the theft surfaces fast.
So when Customer B’s payment arrives the next day, the employee credits it to Customer A’s account. A is now clean, but B carries the shortage. Customer C’s payment then plugs B, Customer D’s plugs C, and the chain keeps going. Every stolen dollar demands a fresh payment from another customer to cover the previous gap.
The web expands with each theft. The perpetrator has to maintain a shadow record tracking which balances are fake and which payments are being rerouted where. That is the scheme’s weak point. It requires constant, hands-on management. One missed day, one surprise audit, or one customer who calls to ask why their payment was never acknowledged, and the structure collapses.
Red Flags in the Records
The most telling financial sign is a consistent gap between the date a payment arrives and the date it reaches the bank. In a healthy process, receipts hit the deposit within a day or two. When someone is lapping, payments sit in limbo while the employee works out how to reroute them. A pattern of three-, four-, or five-day delays across multiple accounts is worth investigating.
Frequent unexplained adjustments are another signal. Write-offs, small credits, and balance reductions that don’t correspond to any customer dispute or return often show up when the fraudster can’t immediately find a new payment to plug the gap. The adjustments zero out a balance temporarily without any real money changing hands.
Customer complaints deserve special weight. If a client insists they already paid an invoice that still shows outstanding, that is direct evidence something went wrong between receipt and posting. One complaint is a clerical slip. Several complaints across different accounts suggest someone is intercepting payments before they are recorded.
Accounts receivable aging reports can expose the problem too. Lapping tends to push balances into older buckets. If your 60-day and 90-day categories are growing without a corresponding change in your customer base or credit terms, someone may be cycling payments through accounts rather than applying them properly.
Red Flags in the Employee
Employees running lapping schemes guard their territory. They resist cross-training, decline help, and insist on personally handling every step from opening mail to posting entries. This isn’t dedication. Someone managing a floating shortage of misapplied payments can’t afford to let an outsider see the ledger.
Refusal to take time off is the single most reliable behavioral indicator. Federal Reserve supervisory guidance is blunt on the point: most embezzlement schemes require the wrongdoer’s continuous presence, and requiring employees in sensitive positions to be absent for a minimum of two consecutive weeks lets pending transactions clear under someone else’s oversight.2Board of Governors of the Federal Reserve System. SR 96-37 (SUP) Supervisory Guidance on Required Absences from Sensitive Positions An employee who always has an excuse to skip vacation is waving a flag.
How to Confirm a Suspicion
Red flags make you suspicious. Confirming lapping takes targeted procedures that test whether payments were applied to the right accounts at the right time.
Direct Confirmation With Customers
Positive confirmation is the classic lapping detector. A reviewer sends letters to a sample of customers asking them to verify their outstanding balance, and customers reply to the reviewer rather than to the company. The employee has no chance to intercept the response or explain away a discrepancy. If a customer reports a different balance than the ledger shows, the mismatch gets traced back through individual transactions.3Public Company Accounting Oversight Board. Comparison AS 2310 with ISA 505 and AU-C Section 505 Under auditing standards, external confirmation is essentially required for accounts receivable unless the balance is immaterial or risk is low enough to justify other procedures.
Receipt-to-Posting Gap Analysis
Modern accounting software earns its keep here. Pull the timestamp when a payment was received, whether from a mail log, lockbox record, or electronic deposit, and compare it with the timestamp when the payment was posted to a customer’s account. Legitimate payments post within hours or a day. Lapped payments show multi-day gaps because the employee held them while shuffling balances. A spike in the average gap for one employee’s transactions, compared with others handling the same work, narrows the investigation quickly.
Benford’s Law Analysis
Benford’s Law predicts that the leading digits of naturally occurring financial data follow a specific distribution. The digit 1 appears first about 30% of the time, and higher digits appear progressively less often. Manual journal entries used for adjustments, accruals, and corrections suit this analysis well. Deviations from the expected pattern, particularly concentrations of entries just below a testing threshold, can flag fictitious entries used to disguise lapping activity.
Daily Deposit Reconciliation
The simplest control is also one of the most effective. Have someone other than the cash handler compare the total on the bank deposit slip to the total in the daily cash receipts log before anything is posted. When those numbers don’t match, money was removed between receipt and deposit. Doing this daily rather than monthly catches lapping before the employee can cover the gap with the next incoming payment.
Controls That Prevent Lapping
Prevention is cheaper than detection. Lapping requires one person to control both incoming cash and the receivable ledger, and every effective control targets that single point of failure.
Segregation of Duties
The person who opens the mail and logs incoming checks should never be the same person who posts payments to customer accounts.4UCLA Business and Finance Solutions. Segregation of Duties (Preventive and Detective) A third person should handle the monthly bank reconciliation. This three-way split means no individual sees the full transaction lifecycle from receipt to recording to reconciliation. Small businesses that cannot staff three separate roles should at least have a manager or owner review the daily deposit and compare it with the receipts log independently.
Lockbox Banking
A lockbox arrangement removes employee contact with payments almost entirely. Customers mail their checks to a secure post office box managed by the bank, and the bank collects, processes, and deposits the payments directly into the company’s account. The company receives deposit data and remittance images electronically. With no employee touching payments, there is nothing to intercept.
Mandatory Consecutive Vacations
Requiring employees in cash-handling and receivable-posting roles to take at least two consecutive weeks of vacation each year is a proven fraud control. During the absence, a different employee processes the work and encounters the misapplied payments, unexplained adjustments, or customer complaints the original employee had been managing in real time. The Federal Reserve requires banking organizations to enforce this minimum two-week absence for employees in sensitive positions precisely because the scheme collapses without the perpetrator’s daily intervention.2Board of Governors of the Federal Reserve System. SR 96-37 (SUP) Supervisory Guidance on Required Absences from Sensitive Positions
Independent Customer Statements
Monthly account statements mailed directly to customers by someone outside the accounts receivable department create an external check on the ledger. If a customer’s balance is inflated because their payment was diverted to cover another account, the customer sees the error and contacts the company. The employee cannot suppress a complaint that lands on someone else’s desk.
Pre-Employment Screening
Before placing someone in a position with access to cash receipts and financial records, a background check can surface prior fraud convictions or financial distress. Federal law requires employers to provide a clear written disclosure and obtain the applicant’s written consent before pulling a consumer report for employment purposes.5Office of the Law Revision Counsel. United States Code Title 15 – Section 1681b Background checks don’t prevent fraud on their own, but they are a low-cost filter that occasionally catches what interviews miss.
Digital Audit Trails
Modern accounting systems can log every entry with a timestamp, the user who made the change, and the original versus modified values. Turning on these logs and restricting who can override or delete entries makes lapping far harder to execute. The employee can still misapply a payment, but the trail shows exactly when it happened and who did it. Automated alerts for unusual patterns, such as the same employee posting an abnormally high number of manual adjustments, add a real-time layer that passive log reviews miss.
What to Do If You Discover a Scheme
The instinct when you spot employee theft is to confront the person immediately. That is usually a mistake. The first priority is preserving evidence before the employee realizes the scheme has been identified.
Lock down access to the accounts receivable system, email accounts, and any physical files the employee controls. If your accounting software has audit logs, export them before anyone can alter the records. Copy relevant bank statements, deposit slips, customer correspondence, and adjustment reports. The investigation needs to document what was changed, when, and by whom.
If the suspected loss is substantial, bring in an attorney before taking other steps. Investigations conducted at the direction of legal counsel can be protected by privilege, which matters if the case ends up in court. A forensic accountant can reconstruct the flow of misapplied payments, quantify the total loss, and produce documentation that holds up in civil and criminal proceedings.
Filing a police report creates an official record of the theft and is often a prerequisite for insurance recovery. Many fidelity and commercial crime policies require prompt notification after discovery of a loss, and failing to report can jeopardize a claim. Keep the insurer informed of material developments throughout the investigation.
Lapping that involves mailing fraudulent invoices or account statements can be prosecuted as mail fraud, carrying a maximum sentence of 20 years in federal prison.6Office of the Law Revision Counsel. United States Code Title 18 – Section 1341 Frauds and Swindles If the scheme uses electronic transfers, email, or any wire communication, it can be charged as wire fraud with the same 20-year maximum.7Office of the Law Revision Counsel. United States Code Title 18 – Section 1343 Fraud by Wire Radio or Television When the fraud affects a financial institution, the maximum rises to 30 years and a fine of up to $1,000,000 under either statute. State embezzlement and theft charges often run in parallel.
Deducting the Loss
Businesses that lose money to a lapping scheme can generally deduct the unrecovered theft loss under federal tax law. The deduction is allowed for any loss sustained during the taxable year that is not compensated by insurance or other reimbursement, and a theft loss is treated as sustained in the year the taxpayer discovers it, not the year the theft actually occurred.8GovInfo. United States Code Title 26 – Section 165
To claim the deduction, you need documentation that the property was stolen, when you discovered the loss, and whether a reasonable prospect of recovery exists through insurance, civil action, or restitution. If inventory was affected, you can deduct the loss either through an adjustment to cost of goods sold or as a separate theft loss deduction, but not both.9Internal Revenue Service. Publication 547 (2025) Casualties Disasters and Thefts
The rules differ for business owners filing as individuals. For tax years 2018 through 2025, the Tax Cuts and Jobs Act restricted personal casualty and theft loss deductions to losses arising from federally declared disasters. That restriction expires on December 31, 2025.10Congressional Research Service. Expiring Provisions in the Tax Cuts and Jobs Act Starting in 2026, individuals can again claim personal theft loss deductions regardless of whether the loss is connected to a disaster, subject to the standard limitations. Losses on business or income-producing property were never affected by the TCJA restriction and have remained deductible throughout.9Internal Revenue Service. Publication 547 (2025) Casualties Disasters and Thefts