Employee Embezzlement: Workplace Theft, Investigations, and Recovery

Employee embezzlement differs from ordinary theft or larceny in how the person obtained the property. In larceny, the taker never had lawful possession; they simply took something that was not theirs. In embezzlement, the employee was lawfully entrusted with the money or property through their role, then wrongfully converted it. A cashier authorized to handle the register who pockets cash, or an accountant who diverts company funds to a personal account, has committed embezzlement rather than larceny.

This distinction shapes how a case is charged and proven. Prosecutors must show the lawful possession and the fraudulent conversion, not a break-in or a simple taking, which is why workplace theft of this kind is prosecuted under theft or larceny statutes and turns on the employee's role and authority.

Whether employee embezzlement is a felony usually depends on the value of what was taken, and the threshold varies by state and can change over time. Smaller amounts are often charged as a misdemeanor, while amounts above a state's felony threshold, which can range from under a thousand dollars to several thousand, are charged as a felony. Many states prosecute embezzlement within their larceny or theft framework, grading the offense by the dollar amount and sometimes by aggravating factors. In New York, for example, grand larceny in the fourth degree generally begins when the value exceeds $1,000, while higher degrees apply as the amount increases. Thresholds and charging levels vary by state.

Federal charges can also apply in some situations. Under 18 U.S.C. § 641, embezzlement, theft, or conversion of federal money or property is a federal offense, and 18 U.S.C. § 666 reaches theft involving organizations or programs that receive federal funds; wire transfers can also bring federal wire fraud into play. The charge level drives the potential penalties, so confirm how the relevant state grades the offense rather than assuming. The same loss can be a misdemeanor in one place and a serious felony in another.

The most common methods include cash skimming, where an employee takes cash before it is recorded; false or inflated expense reimbursements; payroll schemes such as ghost employees or inflated hours; billing schemes involving fake vendors or kickbacks; and unauthorized transfers or check tampering that move company funds to the employee. Theft of inventory or company property, and misuse of company funds through accounts or cards, are also frequent.

Many of these rely on the employee both initiating and recording transactions, so a lack of separation of duties is a recurring vulnerability. Where transfers or electronic payments are involved, the conduct can also implicate wire transfer fraud, and the same records that reveal the scheme are what an investigation will rely on.

Warning signs of internal theft often appear in both the numbers and the behavior. Financial red flags include unexplained shortfalls, accounting discrepancies, missing documentation, duplicate or altered records, vendors no one can verify, and a books-to-bank mismatch. Behavioral signs can include an employee who refuses to take vacation or share duties, lives noticeably beyond their means, or is unusually protective of records and processes.

None of these alone proves embezzlement, since each can have an innocent explanation. Treat warning signs as a reason to review carefully and discreetly rather than to accuse. Acting on suspicion alone, without verifying through records first, can create legal exposure if the conclusion turns out to be wrong.

A business that suspects embezzlement should first preserve the relevant records, financial statements, transaction logs, emails, access records, and any documents tied to the suspected scheme, before the employee knows of any concern. Securing this evidence, and limiting the employee's access to systems and funds where possible, prevents both further loss and the destruction of proof. Many employers bring in counsel and forensic accountants to conduct a careful internal review rather than acting on assumptions.

A measured internal investigation establishes what actually happened, how much was lost, and over what period, which is essential before confronting anyone or involving authorities. Conduct the review discreetly and document each step. A well-run internal investigation is what turns suspicion into the kind of evidence that supports termination, a police report, or a civil recovery action.

Depends on the circumstances. Options include a civil claim against the employee for the loss, restitution ordered as part of a criminal case, and in some situations claims against insurance, such as an employee dishonesty or fidelity bond policy if the business carries one. Recovery is strongest when the loss is well documented and the employee has assets or insurance stands behind the loss.

The practical limit is that an employee may have already spent the money or lack assets to repay it, which can make full recovery difficult even with a judgment. Pursue recovery and any insurance claim in parallel with the criminal question rather than waiting, and preserve the documentation that both a civil claim and a breach of fiduciary duty theory, where the employee owed such a duty, will depend on.

Before talking to an employer's investigators or law enforcement, an accused employee should understand that statements made early can be used later and are difficult to walk back. It is generally wise to seek legal advice before giving an account, signing any admission or repayment agreement, or turning over personal devices or records. Intent is central to embezzlement, and an innocent explanation, an authorized expense, a recording error, a genuine misunderstanding, is often best presented with guidance rather than in an unprepared interview.

This is not about hiding wrongdoing; it is about ensuring the facts are accurately understood. Seek advice before responding in detail. The difference between a defensible explanation and a damaging admission often comes down to how and when it is given, which is the heart of any criminal or civil embezzlement matter.

Repaying embezzled money does not automatically make a criminal case disappear. Embezzlement is an offense against the state once charged, so a prosecutor, not the employer, decides whether to pursue or drop charges, and repayment does not erase the underlying conduct. That said, restitution and repayment can matter in practice: they may influence an employer's decision whether to report, a prosecutor's charging decision, or a court's view at sentencing, and full restitution is often part of a negotiated resolution.

The risk is that an unguided repayment or a signed admission, offered in hopes of ending the matter, can instead become powerful evidence of guilt. Treat any repayment or settlement discussion as a legal decision, not just a financial one. How it is structured can either help resolve the case or deepen the exposure, which is why guidance matters before any money changes hands.

Whether to report employee embezzlement to the police is a separate decision from terminating the employee, and it belongs to the employer up until a report is made. Some businesses prefer to handle the matter quietly through termination and a civil or insurance recovery, while others report it for criminal prosecution. Reporting starts a criminal process the employer no longer controls, while declining to report may simplify matters but can limit certain remedies.

Employment, defamation, and contract considerations can also affect how the situation is handled. Weigh the goals, recovery, deterrence, risk, and confidentiality, with legal advice before reporting, since the decision is difficult to reverse once law enforcement is involved.

Accusations of embezzlement are sometimes based on mistakes, because sloppy recordkeeping, approved transactions, or honest errors can resemble theft. An accused employee in that position should avoid giving a detailed statement, signing an admission, or agreeing to repay before the allegation is understood, since early statements are hard to undo and intent is the central issue.

Preserving anything that supports an innocent explanation, approvals, receipts, communications, is important, as is getting legal advice. How and when an innocent explanation is presented often determines whether the matter is cleared up or escalates into a charge.

Employee embezzlement is theft by an employee who was trusted to handle the employer's money or property. The key distinction from ordinary theft is authorized access: the employee was allowed to handle the asset, but not to convert it for personal use. A deliberate diversion is required, so a genuine mistake or an approved transaction does not qualify. It is both a crime and a civil wrong at the same time.

It depends mostly on the dollar amount. Below a state's threshold it is usually a misdemeanor; above it, a felony, with that line falling somewhere between under a thousand dollars and several thousand depending on the state. Larger sums and aggravating factors push the grading higher. Federal charges enter the picture in narrower situations, such as federal funds or wire transfers. The same theft can be charged very differently from one state to the next, so the threshold should be confirmed locally.

Do not confront the employee yet. Work the problem in this order:

• Preserve records first, statements, transaction logs, emails, and access logs, before anyone is tipped off.
• Quietly limit that employee's access to funds and systems.
• Bring in counsel and, often, a forensic accountant for a discreet review.
• Decide on termination, reporting, and recovery only once you have a documented picture.

A premature confrontation or any deletion of records can sink both a prosecution and your own recovery.

An employer should not assume it can withhold wages or final pay to offset a suspected loss. Wage deduction and final-pay rules vary by state, and many limit or prohibit deductions without the employee's consent or a court order. Improper withholding can create separate liability for the employer under wage laws, even where embezzlement turns out to be real. Recover through a civil claim, restitution, or insurance instead, and get advice before touching pay.

Yes. The same conduct can lead to both a criminal case and a civil lawsuit, because they serve different purposes. A criminal case is brought by the state to punish the offense and can result in penalties and restitution, while a civil claim is brought by the employer to recover the loss. The two can run in parallel, and a criminal restitution order does not necessarily bar a separate civil action, though amounts recovered in one may affect the other.

Not by itself. Once charged, the case belongs to the prosecutor, not the employer, and repayment does not undo the conduct. Restitution can still help in practice, shaping whether an employer reports, how charges are framed, or how a court views sentencing. The trap for an accused person is that an unguided repayment or signed admission can become strong proof of guilt, so any repayment should be structured as a legal step, not just a payment.

It happens, because sloppy records, approved transactions, or honest errors can look like theft. Protect yourself: do not give a detailed statement, sign an admission, or agree to repay before you understand the allegation, since early statements are hard to undo and intent is the central issue. Save anything that supports your account, approvals, receipts, messages. Then get advice, because the timing and framing of an innocent explanation often determine whether the matter is cleared or escalates.