Embezzlement investigations are in high demand for our corporate investigators. Embezzlement is the form of corporate fraud that tends to produce the most visceral response in the people who discover it. Not because the financial loss is always the largest — though in serious cases it can be very significant — but because of what the discovery means. Someone who was trusted with the organisation’s resources used that trust to steal from it. Often over a long period. Often without anyone noticing.
In my experience, embezzlement cases share a consistent character. The perpetrator is rarely peripheral. They tend to be established, well-regarded, and in a position that gives them both the access and the institutional cover to sustain the fraud without scrutiny. The mechanism varies — funds diverted through the payment system, assets converted for personal use, company resources deployed for private purposes — but the underlying dynamic is the same: a person in a position of trust exploiting that position for financial gain, over a period long enough to generate real damage.
This article explains what embezzlement looks like in practice, how it is investigated, and what recovery options are available when the full picture has been established.
What Is Embezzlement?
Embezzlement refers to the fraudulent appropriation of property or funds by a person to whom they have been entrusted. In English law, it is not a distinct statutory offence — the conduct typically falls within the Theft Act 1968, which defines theft as the dishonest appropriation of property belonging to another with the intention of permanently depriving the owner of it. Where the embezzlement involves deception — false invoices, falsified records, or misrepresentations made to obtain payment — the Fraud Act 2006 may also apply.
The distinguishing feature of embezzlement, as opposed to straightforward theft, is the access granted by the employment or fiduciary relationship. The embezzler does not take something they were never supposed to have. They take something they were given authority to manage — and they use that authority to divert it. That distinction matters legally, because it shapes the nature of the breach involved and, in director or senior officer cases, may also engage the statutory duties imposed by the Companies Act 2006.
Embezzlement at the corporate level encompasses a wide spectrum of conduct. At one end, it involves individual employees skimming cash receipts, redirecting small payments, or converting company property for personal use. At the other, it involves senior executives or directors systematically diverting corporate funds over extended periods through the deliberate manipulation of financial systems, supplier relationships, and approval processes. Both are serious. The scale simply determines the complexity of the investigation required.
How Embezzlement Occurs
Embezzlement does not happen because an organisation employs dishonest people. It happens because honest-appearing people, given access and authority without adequate oversight, find that the opportunity to exploit that access is available, sustainable, and — at first — apparently without consequence. In my experience, the first transgression is usually smaller and more tentative than what follows. The absence of detection is taken as confirmation that the risk is manageable. The scale increases.
The mechanisms through which embezzlement is sustained in a corporate environment are consistent with the broader pattern of internal fraud I have described across this series. They cluster around the same structural conditions: individual control without independent oversight, access that exceeds operational necessity, approval processes that are nominal rather than genuinely scrutinised.
Payment System Manipulation
The diversion of company funds through the accounts payable or treasury function is one of the most common mechanisms. An employee with the authority to initiate or approve payments creates fictitious transactions — through phantom vendors, falsified invoices, or the manipulation of legitimate payment instructions — and directs the proceeds to accounts they control. The transactions look routine within the payment system. They are processed, approved, and recorded in a way that does not immediately distinguish them from legitimate activity.
What makes this form of embezzlement sustainable is the volume of legitimate transactions that surrounds it. In a business processing hundreds of payments each month, a handful of fraudulent ones sit within the data without producing an obvious anomaly. They are only visible when the data is examined with investigative intent — looking for patterns, for threshold structuring, for vendors that cannot be independently verified — rather than processed in the normal operational flow.
Asset Conversion
The conversion of company assets — vehicles, equipment, inventory, intellectual property, or access to company facilities and accounts — for personal use or gain is a form of embezzlement that frequently operates alongside financial diversion. An employee authorises the purchase of assets that are then used personally. Company vehicles are applied to private journeys and the associated costs charged to the business. Inventory is diverted from the supply chain. In each case, the asset is legitimately within the employee’s authority to manage. The embezzlement lies in the use to which it is put.
Asset conversion is harder to detect than payment diversion because it does not always produce a financial anomaly in the accounts. The vehicle appears on the asset register. The inventory is recorded as stock movement. The IP is used under an arrangement that looks, from the outside, like a legitimate commercial licence. Identifying the fraud requires a comparison between what the asset records show and what is actually happening — which is an investigative task, not an accounting one.
Payroll and Expense Manipulation
Embezzlement through payroll takes several forms: ghost employees whose salaries are directed to accounts the perpetrator controls, the inflation of legitimate pay rates or bonus entitlements, and the systematic submission of fictitious or inflated expense claims. I have addressed these mechanisms in detail in the payroll fraud and expense fraud articles in this series. What I would add here is that these schemes, when operated by someone in a senior role — a finance director, a payroll manager, an HR director — tend to sustain themselves for longer and at higher value than equivalent schemes operated by junior employees, precisely because the seniority provides cover.
In one investigation we were instructed on, a finance director had been using three methods simultaneously over a four-year period: a retained ghost employee on the payroll, systematic expense fraud involving personal expenditure coded to client accounts, and a small set of fictitious vendor payments processed through a subsidiary with weaker controls. No individual scheme was large enough to surface through routine review. Together they had generated just over £290,000 in fraudulent payments before a change of auditor prompted the enquiry that brought us in.
Misuse of Authority and Corporate Funds
At the director and senior executive level, embezzlement frequently takes the form of the misuse of authority rather than the direct theft of cash. Unauthorised remuneration — salary adjustments, bonuses, pension contributions, or benefits approved by the executive themselves without proper governance — is the most common presentation. Closely related is the misuse of discretionary budgets, corporate credit facilities, or investment accounts for personal purposes that are dressed in the language of legitimate business activity.
These cases are legally complex because they sit at the intersection of employment law, company law, and criminal law. A director who pays themselves more than they are authorised to receive is not simply a thief in the ordinary sense. They are in breach of their fiduciary duties, potentially in breach of their service agreement, and — depending on the nature and scale of the conduct — may have committed a criminal offence. The investigation needs to establish not just what happened but within what authority framework it happened, because that determines which legal routes are available.
Identifying Red Flags of Embezzlement
The warning signs of embezzlement overlap considerably with the broader indicators of employee and director fraud that I have described across this series. What follows are the patterns that, in the context of a suspected embezzlement, I find most significant.
- An employee with authority over financial transactions who manages those transactions end-to-end, from initiation to payment, without independent oversight at any stage.
- Payments to vendors or counterparties that cannot be independently verified as legitimate businesses, or whose registered details bear similarities to the personal details of the approving employee.
- Financial variances that are consistently in the same direction, in the same accounts or cost centres, across multiple periods — a pattern more consistent with deliberate manipulation than with ordinary business variation.
- An employee who consistently avoids taking annual leave, resists handing over responsibilities, or becomes noticeably anxious when a system change or audit process is proposed that would introduce new scrutiny over their area.
- Lifestyle indicators that are materially inconsistent with the employee’s disclosed remuneration, particularly where the improvement is recent and cannot be explained by known personal circumstances.
- Unexplained discrepancies between the financial records and the operational picture — assets that appear on the balance sheet but cannot be physically accounted for, inventory movements with no corresponding business record, client receipts that do not appear in the bank account as expected.
- An employee who manages key external relationships — with banks, suppliers, clients, or professional advisers — personally and exclusively, without involving colleagues or allowing others to develop independent contact.
- Audit queries or management letter points that are resolved through the provision of documentation rather than through genuine commercial verification, and that recur in similar form in subsequent periods.
What I consistently observe is that these indicators are often visible in retrospect, once an investigation is underway. The challenge is recognising them as indicators in real time, within an environment where the individual concerned carries authority and where challenging their conduct requires both access to the relevant information and the willingness to act on what it reveals. That combination — access plus willingness — is what an independent investigation provides.
Evidence Gathering in Embezzlement Investigations
Embezzlement investigations are, fundamentally, exercises in evidence construction. The outcome of any subsequent proceedings — disciplinary, civil, or criminal — will depend not just on what the evidence shows, but on whether it was gathered in a manner that withstands scrutiny. That consideration shapes every decision about how evidence is collected, handled, and presented.
The investigative approach I take in embezzlement cases combines several distinct disciplines, deployed in the combination that each case requires.
Financial data analysis: a systematic review of the transaction records, payment histories, payroll data, expense submissions, and accounting entries relevant to the concern. The analysis looks for anomalies against the expected baseline for this organisation and this function: duplicate payments, threshold structuring, fictitious vendor indicators, unexplained variances, and patterns that are directionally consistent across multiple periods. The data review is always the starting point. It tells me where to focus the rest of the investigation.
Forensic digital evidence collection: email archives, financial system audit trails, document metadata, access logs, and device activity records are collected using forensic imaging processes that preserve evidential integrity and maintain a documented chain of custody. Digital evidence in embezzlement cases is frequently the most direct source of intent: communications that reference the arrangement, access events that establish who made specific changes, document metadata that reveals when a record was created or altered. People are generally less aware of what the digital record contains than they should be.
Corporate and counterparty intelligence: in cases involving fictitious vendors, connected entities, or the diversion of funds through external structures, a detailed investigation of the corporate identities and beneficial ownership behind the relevant counterparties. Companies House records, overseas registry searches, property data, and open source intelligence are used to establish the connections that the transaction documentation is designed to obscure. In the majority of embezzlement cases I have investigated, the connection between the perpetrator and the fraudulent recipient was visible in publicly available information. It simply had not been looked for.
Asset tracing: where funds have been diverted or assets misappropriated, forensic tracing of the flow of value to identify its current location, the entities or accounts through which it has passed, and the recoverable assets available to support a civil claim or proceeds of crime application. Asset tracing is most valuable when it begins promptly — before funds are further dispersed and before the perpetrator becomes aware that an investigation is underway.
Witness interviews: structured interviews with relevant witnesses — finance colleagues, operational staff, external contacts — conducted before the primary subject is approached. By the time I interview the individual under investigation, the financial analysis, the digital evidence review, and the corporate intelligence work have produced a complete evidential picture. The questions are specific. The subject’s account can be tested against what has already been established, rather than explored in the abstract.
Document and receipt examination: in cases involving falsified invoices, altered receipts, or fabricated approval records, forensic document examination — including metadata analysis, paper and print analysis, and the comparison of document formatting against known authentic examples — can establish the provenance and integrity of the supporting material. I have worked on embezzlement cases where documents presented as contemporaneous approval records were demonstrably created after the transactions they purported to authorise.
The principle that applies throughout is that methodology matters as much as content. Evidence that proves the embezzlement occurred is not useful if it was gathered carelessly, by someone without investigative independence, or in a way that creates its own legal exposure for the organisation. A finding that cannot withstand challenge is not a finding.
Recovery Options Following an Embezzlement Investigation
When an embezzlement investigation produces clear findings, the organisation has a range of recovery and enforcement options available to it. Which are appropriate depends on the nature of the conduct, the scale of the loss, the strength of the evidence, and what the organisation is primarily trying to achieve. These options are not mutually exclusive.
Civil Recovery
For most organisations, financial recovery is the primary objective, and civil proceedings are the most direct route to it. A civil claim for the proceeds of embezzlement — whether framed as a claim for conversion, money had and received, or breach of fiduciary duty where a director or senior officer is involved — operates on the balance of probabilities standard and moves on the claimant’s timeline rather than a prosecuting authority’s.
Where there is a risk that the perpetrator will dissipate their assets before judgment, an urgent application for a freezing injunction can be made, supported by the investigation findings. A well-documented investigation, produced quickly and to forensic standards, is the foundation on which that application rests. Speed matters here: a freezing injunction obtained while assets remain in place is considerably more valuable than one sought after they have been moved.
In cases involving a director, the civil remedies available include an account of profits — requiring the director to pay to the company any gain made from the breach of duty — as well as equitable compensation for the loss caused. These remedies operate alongside, and independently of, any criminal process.
Criminal Referral
Where the embezzlement is sufficiently serious, the evidence is robust, and the public interest in prosecution is clear, a criminal referral to the police or — in cases of significant scale or complexity — the Serious Fraud Office may be appropriate. Criminal proceedings under the Theft Act 1968 or the Fraud Act 2006 carry maximum sentences of seven to ten years and can result in confiscation orders under the Proceeds of Crime Act 2002 that pursue assets beyond what a civil claim might reach.
Criminal prosecution does not produce direct financial recovery for the victim organisation. The confiscation regime under POCA 2002 serves the Crown rather than the victim. However, a criminal referral can be combined with civil recovery proceedings, and the two can run in parallel with appropriate coordination between the legal teams managing each strand. I regularly assist organisations and their advisers in managing that coordination.
Proceeds of Crime Recovery
The civil recovery provisions of the Proceeds of Crime Act 2002 allow the recovery of assets representing the proceeds of unlawful conduct, independently of any criminal prosecution. Where a criminal conviction is not the primary objective, or where the criminal standard of proof is unlikely to be met despite strong civil evidence, civil recovery under POCA 2002 provides an additional mechanism. It is most relevant in cases where significant assets can be identified and traced to the embezzlement.
Regulatory Action
In regulated sectors — financial services, legal services, healthcare, accountancy — an embezzlement finding may have regulatory consequences that operate independently of civil and criminal proceedings. The FCA, the SRA, ICAEW, and other sector regulators have their own enforcement powers, including prohibition orders, financial penalties, and the withdrawal of authorisation. Where the embezzler holds a professional qualification, referral to the relevant professional body is also available. These avenues are most significant where the individual intends to continue in a professional capacity and where the regulatory sanction would carry its own deterrent or protective effect.
Internal Disciplinary Proceedings and Employment Claims
Regardless of whether civil or criminal proceedings are pursued, the employment relationship is almost always terminated following a confirmed embezzlement finding. That process needs to follow the ACAS Code and comply with the organisation’s disciplinary procedure, even where the evidence is clear and the outcome is not in doubt. A disciplinary process that is procedurally flawed — however strong the substantive case — creates tribunal exposure that is entirely avoidable with proper structure.
Where the embezzlement was facilitated by control failures that other employees were involved in or aware of, the investigation findings may also inform secondary disciplinary decisions. These need to be handled carefully and with legal advice, to avoid creating unfair dismissal exposure in relation to individuals whose culpability is less clear.
The decisions about which recovery routes to pursue, in what sequence, and on what timeline are ultimately legal decisions for the organisation’s advisers, made in the context of the specific findings. What an investigation provides is the factual and evidential foundation on which those decisions rest — and the quality of that foundation determines how many of the available routes remain genuinely accessible.
Concerned about embezzlement or the misappropriation of company funds? Speak to our corporate fraud specialists.