Employee theft is one of the most consistent and costly categories of loss that businesses face. It is committed by people who already have access — to cash, to stock, to systems, to data — and who have exploited that access while remaining, in most respects, trusted members of the team. By the time the signs become obvious, the theft has usually been running long enough to represent a material loss.
The indicators described in this article are drawn from the investigations we conduct across a range of sectors and business types. They are not proof of theft. They are the patterns that, in our experience, precede a confirmed investigation finding more often than coincidence would explain. Taken individually, each can have an innocent explanation. Taken together, or where they cluster around the same individual, function, or time period, they warrant investigation.
What Is Employee Theft?
Employee theft is the deliberate taking or misappropriation of an employer’s assets by a person employed by that employer. It encompasses a wide range of conduct: the physical theft of cash, stock, equipment, or intellectual property; the manipulation of financial systems to generate unauthorised payments; the misuse of expense accounts or purchasing authority; and the theft of commercially sensitive data.
What distinguishes employee theft from other forms of asset loss is the access granted by the employment relationship. The employee does not need to breach a perimeter or deceive a security system. They are already inside. They know how the systems work, where the controls are weakest, and — in many cases — who the most infrequent scrutiniser of their area is. That insider knowledge is what allows employee theft to run for as long as it does before it is identified.
The ACFE’s research consistently identifies asset misappropriation — the category that includes most forms of employee theft — as the most prevalent form of occupational fraud, accounting for approximately 86% of cases. The median loss per scheme is significant and the median duration before detection is over twelve months. These are not rare, small, or quickly resolved events.
Financial Warning Signs
Financial irregularities are often the first category of warning sign to become visible, because they leave a record — in the accounts, in the transaction logs, in the reconciliation that doesn’t balance. The following patterns are the ones most likely to indicate employee theft with a financial dimension.
- Cash receipts that are consistently lower than expected for a given level of trading activity, particularly where the shortfall is regular and follows a pattern — the same shift, the same till, the same reconciliation period.
- Unexplained variances between recorded sales and banked cash, particularly where those variances are small enough not to trigger an automatic alert but consistent enough to accumulate to a material total over time.
- Expense claims that are disproportionate to the employee’s role, that contain items that cannot be verified against business activity, or that arrive at unusually regular intervals suggesting construction rather than genuine incurrence.
- Supplier invoices from vendors that cannot be verified as genuine businesses, that arrive at regular intervals for consistent amounts, or whose banking details share characteristics with the personal details of the employee approving payment.
- Petty cash discrepancies that are explained away as administrative errors but that consistently occur in the same direction and under the same person’s management.
- Payroll anomalies: payments to employees who have left, salaries or hours that do not reflect approved rates, or one-off payments that cannot be traced to an authorised instruction.
Behavioural Warning Signs
Behavioural indicators are softer than financial ones, and individually they are more likely to have innocent explanations. Their value is contextual: a cluster of behavioural indicators around the same individual, or a behavioural change that coincides with an anomaly in the financial or inventory data, warrants attention.
Lifestyle inconsistency: a material and unexplained improvement in an employee’s lifestyle — new high-value vehicle, significant personal expenditure, frequent references to financial activities inconsistent with their declared salary — is a consistent indicator in employee theft cases. Individually, there may be an innocent explanation. Combined with financial anomalies or inventory discrepancies, it becomes significant.
Reluctance to take leave: an employee who resists annual leave, insists on covering their own responsibilities during any absence, or becomes visibly anxious when asked to hand over duties temporarily may be maintaining a scheme that requires their ongoing presence to conceal. This is one of the most reliable behavioural indicators in sustained theft cases.
Excessive protectiveness of their area: unusual defensiveness about a specific system, process, supplier relationship, or storage area — resistance to audits, reluctance to allow colleagues access, or hostility to oversight that is disproportionate to the nature of the work — is a pattern that recurs in theft investigations.
Working outside normal hours without clear operational reason: consistently arriving significantly earlier or staying later than their role requires, particularly where the additional presence is in the area from which the suspected theft is occurring.
Close personal relationships with specific suppliers or customers: particularly where those relationships are managed personally and exclusively, where the employee resists involving colleagues, and where the commercial terms with those counterparties are unusually favourable or unusually difficult to verify.
Inventory Discrepancies
For businesses that hold physical stock — retail, warehousing, manufacturing, hospitality, healthcare supplies — inventory discrepancies are one of the most direct indicators of employee theft. The challenge is distinguishing between theft and other causes of inventory loss: damage, supplier short-delivery, administrative error, and customer theft all produce shrinkage, and separating internal theft from these other causes requires investigation rather than assumption.
The patterns most likely to indicate internal theft rather than other causes of inventory loss are:
- Shrinkage that is concentrated in specific product categories, particularly high-value or easily resellable items, rather than spread evenly across the stock profile.
- Losses that follow a consistent pattern — the same shift, the same location, the same reconciliation cycle — rather than occurring randomly across time and location.
- Discrepancies that correlate with specific employees: identified through analysis of shift patterns against loss periods, access records against missing stock, or process data against known anomalies.
- Stock count variances that appear and are then ‘corrected’ by write-offs or administrative adjustments, without a documented legitimate reason for the adjustment.
- Deliveries that are consistently signed off as complete by the same individual but that produce repeated discrepancies when the received stock is counted independently.
Digital Theft Indicators
The theft of data, intellectual property, commercially sensitive information, and digital assets is an increasingly significant category of employee theft, and one whose indicators are different from those associated with physical or financial theft.
Unusual system access patterns: access to systems, files, or data that falls outside the employee’s normal work pattern — late-night access, access from unusual devices or locations, or access to data categories not relevant to their role — is the most reliable early indicator of digital theft.
Large file transfers or downloads: particularly to external storage devices, personal email accounts, or cloud storage services. Modern IT systems log these events; the question is whether anyone is reviewing those logs with investigative intent.
Excessive printing: in data-sensitive environments, employees who print large volumes of material that is not relevant to their current assignments may be creating physical copies of data they intend to take.
Sudden increased interest in competitor or client data: searches for or downloads of client lists, pricing data, strategic documents, or other commercially sensitive material in the period before an employee resigns is a consistent pattern in data theft cases.
Working on personal devices using company systems: employees who regularly use personal devices to access company systems — particularly in environments where this is not a normal work practice — may be creating copies of data that do not pass through the organisation’s logging or monitoring infrastructure.
When to Launch an Investigation
The decision to launch a formal investigation should be made when a concern has reached a threshold of credibility — when the available indicators, considered together, provide a reasonable basis for believing that theft may have occurred — rather than when certainty has been achieved. By the time certainty is available, the loss has usually been extended and the evidence has often been compromised.
The most consequential mistakes at this stage are informal management and premature confrontation. Handling a theft concern informally — through a quiet conversation with the employee, or through an unstructured management review of the relevant area — can destroy evidence, allow the employee to prepare their account, and expose the organisation to unfair dismissal risk if the matter subsequently proceeds to a disciplinary hearing. A premature confrontation based on suspicion rather than evidence produces the same problems.
A properly structured investigation — conducted by someone independent of the area under scrutiny, following a defined process, gathering and preserving evidence before any overt step is taken — is the approach that preserves the organisation’s legal options and produces findings that will hold up when tested. The investment in getting the process right at the outset is almost always smaller than the cost of correcting a mishandled investigation later.
Concerned about employee theft? Contact iSpy Detectives for confidential workplace investigation support.