Employee Theft: What to Do When You Discover It

The bookkeeper has been with you for twelve years. You trusted her completely. Now your accountant is showing you how the numbers don't add up—and they haven't added up for a long time. The amount missing is significant. You're angry, you're betrayed, and you're about to make decisions that matter. This is not the time to act on impulse.

Employee theft is one of the most disorienting experiences a business owner can face. The violation of trust compounds the financial loss. The urge to confront, fire, call the police, and sue—all at once—is understandable but often counterproductive.

The First 48 Hours

What you do immediately after discovery shapes your options for everything that follows.

Secure the evidence before alerting the employee. Pull records, preserve emails, copy files, secure video footage. If the employee learns they're under suspicion before you've gathered what you need, critical evidence may disappear.

Limit who knows about the situation. Every additional person increases the risk of premature disclosure, whether intentional or accidental. Until you've secured evidence and made decisions about how to proceed, keep the circle small.

Get legal counsel involved early. The decisions you're about to make—about termination, criminal referral, civil claims, and communication—have legal implications you may not anticipate. The cost of early counsel is small compared to the cost of mistakes.

Don't confront the employee until you're ready. What feels like necessary confrontation may actually be counterproductive. You want the evidence secured, your approach planned, and your options understood before you take action.

Understanding What You're Dealing With

Employee theft comes in many forms, and the approach differs depending on what happened.

Cash theft—skimming, register manipulation, deposit diversions—is often discoverable through forensic accounting but may have limited documentation.

Vendor fraud—fake vendors, kickbacks, overbilling—involves paper trails that can be traced but may implicate third parties.

Expense fraud—falsified expense reports, personal purchases on company cards—leaves records but often involves smaller individual amounts over longer periods.

Inventory theft—merchandise walking out the door—may be harder to prove to specific individuals without surveillance.

Time theft—falsified timesheets, buddy punching—is common but often treated differently than theft of money or property.

Understanding the type and scope of the theft helps determine your approach. Some situations warrant aggressive pursuit; others may be better handled through termination and improved controls.

Criminal Versus Civil

Reporting theft to police and pursuing civil recovery are separate decisions. You can do both, either, or neither.

Criminal prosecution is handled by the state. You're a witness and victim, not a party controlling the case. The prosecutor decides whether to charge and what plea to accept. Criminal conviction doesn't automatically produce financial recovery for you.

Civil recovery is your lawsuit for damages. You control it, but you bear the costs. Civil judgments require collection—and employees who steal are often judgment-proof, meaning they don't have assets to pay.

Some business owners pursue criminal prosecution to create leverage for civil recovery. An employee facing felony charges may be more motivated to repay. But this approach has limits: prosecutors don't appreciate their cases being used as collection tools, and the employee's cooperation in repayment doesn't guarantee favorable treatment in criminal court.

Others prefer to handle the matter privately—termination, civil claim, and move on—to avoid the publicity and disruption of criminal proceedings. This is a legitimate choice but may feel unsatisfying if the theft was significant.

Under Oklahoma law, employee theft may be prosecuted as embezzlement under 21 O.S. § 1451, which specifically addresses the fraudulent conversion of property by those entrusted with it. The penalties vary by amount — theft of property worth more than $500 is a felony, and amounts exceeding $25,000 carry sentences of up to eight years in prison. These criminal consequences can create significant leverage, but they also mean the situation is serious enough to warrant careful legal strategy from the outset.

Recovery Sources

Before assuming you'll recover from the employee, consider what other recovery sources exist.

Fidelity bonds or crime insurance may cover employee theft. Review your policies promptly—reporting deadlines may be short. Coverage limits, deductibles, and proof requirements vary.

If the theft involved collusion with vendors or customers, those third parties may have deeper pockets than your former employee. Conspiracy and conversion claims can reach beyond the individual.

If professionals—accountants, bookkeepers—failed to detect theft that proper procedures would have caught, professional liability coverage might apply. This is fact-specific and relationship-dependent.

The employee's own resources are usually limited. People who steal from their employers typically aren't sitting on assets. Lawsuits produce judgments; judgments require collection; collection from people without money is frustrating.

The Termination Decision

You can fire an employee suspected of theft. You don't need a criminal conviction or even certainty. Oklahoma is an at-will employment state; you can terminate for any lawful reason or no reason.

But how you terminate matters. If you accuse someone of theft and you're wrong—or you can't prove it—defamation claims can follow. If the investigation or termination process treats similarly-situated employees differently, discrimination claims become possible. And if you conduct the termination in a way that's humiliating or coercive, you may face claims for intentional infliction of emotional distress.

The safest approach is often to terminate for documented policy violations or simply without stated cause, rather than explicitly accusing the employee of criminal conduct. You accomplish the same result with less legal risk. This is a situation where having a clear employee handbook with well-drafted policies pays dividends — terminating for "violation of company financial policies" is far safer than terminating for "stealing from the company."

Exit procedures should include recovery of company property, disabling access to systems and facilities, and reminders about confidentiality obligations. The departing employee should not continue to have access to anything. If the employee may file for unemployment, be prepared — an employer's guide to unemployment claims can help you navigate that process correctly.

In some cases, the employee who stole may try to reframe the termination as retaliation for some protected activity — a discrimination complaint, a wage claim, or a safety report. Understanding how wrongful termination claims work in Oklahoma helps you structure the termination in a way that's defensible regardless of what the former employee alleges.

Preventing the Next Time

After managing the immediate crisis, evaluate how it happened and how to prevent recurrence.

Separation of duties is the most fundamental control. No single employee should control both the creation and review of financial transactions. The bookkeeper who writes checks shouldn't reconcile bank statements.

Regular audits—internal or external—create detection risk that deters theft and catches it earlier when it occurs.

Mandatory vacations require someone else to perform duties, often revealing irregularities the regular employee had concealed.

Background checks at hiring can reveal prior problems—though many employee thieves have clean records until they don't.

Hotlines and reporting mechanisms give other employees a way to report concerns without confronting the suspected individual directly.

None of these are perfect. Determined employees can circumvent controls, especially when they have trust and access. But making theft harder to commit and easier to detect changes the risk calculus.

Frequently Asked Questions

Should I confront the employee directly when I discover theft?

Generally, no. Confronting the employee before securing evidence can result in destruction of records, coordinated stories with accomplices, or even threats. Consult an attorney first, preserve evidence, and let the investigation guide when and how to address the employee.

Can I recover stolen money through a civil lawsuit?

Yes. Civil recovery through conversion, breach of fiduciary duty, and fraud claims can help you recover the amount stolen plus potentially attorney's fees and punitive damages. Criminal prosecution alone doesn't guarantee financial recovery.

Should I file a police report for employee theft?

Often yes, but timing matters. Filing too early can complicate your ability to complete an internal investigation. Consult an attorney about the optimal sequence — whether to complete your internal investigation first or file simultaneously.

How can I prevent employee theft in the future?

Key controls include separation of duties (no one person controls both creation and review of transactions), regular audits, mandatory vacations, background checks at hiring, and anonymous reporting hotlines.

---

This article is for general information only and is not legal advice.