Employee Theft in Oklahoma: What to Do When You Discover It

The bookkeeper has been with you for twelve years. You trusted her completely. Now your accountant is showing you how the numbers don't add up—and they haven't added up for a long time. The amount missing is significant. You're angry, you're betrayed, and you're about to make decisions that matter. This is not the time to act on impulse.

Employee theft is one of the most disorienting experiences a business owner can face. The violation of trust compounds the financial loss. The urge to confront, fire, call the police, and sue—all at once—is understandable but often counterproductive.

The First 48 Hours

What you do immediately after discovery shapes your options for everything that follows.

Secure the evidence before alerting the employee. Suspend routine deletion for relevant email, accounting data, access logs, messages, video, and paper records. Preserve original devices and files when possible; document who collected each item, when, and how. An ordinary copy may omit metadata, and an unplanned search can alter the very evidence you need. For a serious loss, use a qualified forensic professional rather than experimenting on the employee's computer or account.

Limit who knows about the situation. Every additional person increases the risk of premature disclosure, whether intentional or accidental. Until you've secured evidence and made decisions about how to proceed, keep the circle small.

Get legal counsel involved early. The decisions you're about to make—about termination, criminal referral, civil claims, and communication—have legal implications you may not anticipate. The cost of early counsel is small compared to the cost of mistakes.

Control access without destroying evidence. You may need to disable credentials, payment authority, remote access, or facility access before an interview, but coordinate that step so logs, cloud data, and company devices remain intact. Do not access private accounts or personal devices without a clear legal basis. Then plan any interview or confrontation around a defined investigation, not anger.

Understanding What You're Dealing With

Employee theft comes in many forms, and the approach differs depending on what happened.

Cash theft—skimming, register manipulation, deposit diversions—is often discoverable through forensic accounting but may have limited documentation.

Vendor fraud—fake vendors, kickbacks, overbilling—involves paper trails that can be traced but may implicate third parties.

Expense fraud—falsified expense reports, personal purchases on company cards—leaves records but often involves smaller individual amounts over longer periods.

Inventory theft—merchandise walking out the door—may be harder to prove to specific individuals without surveillance.

Time theft—falsified timesheets, buddy punching—is common but often treated differently than theft of money or property.

Understanding the type and scope of the theft helps determine your approach. Some situations warrant aggressive pursuit; others may be better handled through termination and improved controls.

Criminal Versus Civil

Reporting suspected theft to law enforcement and pursuing civil recovery are separate decisions. A business may consider both, either, or neither, but insurance policies, professional rules, contracts, government-funding terms, or industry regulations can require notice or limit that choice.

Criminal prosecution is handled by the state. The business is a witness and victim, not the party controlling charges or any plea. A conviction may result in a restitution order, but an order does not guarantee timely or complete payment.

Civil recovery is your lawsuit for damages. You control it, but you bear the costs. Civil judgments require collection—and employees who steal are often judgment-proof, meaning they don't have assets to pay.

Do not use a threatened criminal report—or a promise not to report—as a collection tactic. A repayment discussion, civil settlement, insurance claim, and law-enforcement referral should be evaluated on their own lawful terms. Prosecutors control the criminal case, and private repayment does not guarantee how charges or sentencing will be handled.

Others prefer to handle the matter privately—termination, civil claim, and move on—to avoid the publicity and disruption of criminal proceedings. This is a legitimate choice but may feel unsatisfying if the theft was significant.

Under Oklahoma law, employee theft may fit embezzlement under 21 O.S. § 1451, which covers fraudulent appropriation, conversion, use, or concealment of property that was lawfully obtained or entrusted. Effective January 1, 2026, enrolled HB 2104 reorganized the penalty structure: less than $1,000 is misdemeanor embezzlement; $1,000 to less than $2,500 is a Class D3 felony; $2,500 to less than $15,000 is a Class D1 felony; and $15,000 or more is a Class C2 felony. The conduct date matters because older acts may fall under an earlier version.

Value, Aggregation, and Restitution

The current embezzlement statute matters because employee-theft cases often involve repeated small transactions instead of one obvious taking. Oklahoma law allows a series of embezzlement acts to be aggregated when they are part of a recurring plan, scheme, or continuing course of conduct. That can change a case from a misdemeanor-level incident into a felony-level investigation.

The revised felony tiers expressly call for restitution under Oklahoma's criminal restitution statute. Restitution can help, but it is not the same as collection and may not capture every claimed business loss. A business should separately evaluate crime insurance, fidelity bonds, third-party responsibility, vendor exposure, and viable civil remedies while avoiding double recovery.

Recovery Sources

Before assuming you'll recover from the employee, consider what other recovery sources exist.

Fidelity bonds or crime insurance may cover employee theft. Review your policies promptly—reporting deadlines may be short. Coverage limits, deductibles, and proof requirements vary.

If the evidence shows knowing participation by a vendor or another third party, claims may extend beyond the employee. Liability depends on what each participant did, the property involved, and the available cause of action—not simply who has deeper pockets.

If an outside professional had a contractual or professional duty to detect or report the problem and breached it, a separate claim or coverage source may exist. An accountant is not automatically responsible merely because an employee concealed a theft.

The employee's own resources are usually limited. Many employees who steal from their employers do not have collectible assets. Lawsuits produce judgments; judgments require collection; collection from people without money is frustrating.

The Termination Decision

An employer generally does not have to wait for a criminal conviction before making an employment decision, but the decision should rest on a documented, good-faith investigation. Oklahoma's at-will rule still has limits, including contracts, protected activity, discrimination law, and public-policy claims. Apply the same investigation and discipline standards used in comparable cases.

But how you terminate matters. If you publish an unsupported theft accusation, defamation claims may follow. If the investigation or termination treats similarly situated employees differently, discrimination issues may arise. Oklahoma sets an exceptionally high, extreme-and-outrageous threshold for intentional infliction of emotional distress; ordinary embarrassment or a harsh termination usually is not enough, but coercive or truly extreme conduct creates avoidable risk.

Use a truthful, documented, and consistently applied reason. Do not invent a policy violation or assume that giving no reason is always safer; either approach can look pretextual if the records tell a different story. Counsel should review the investigation, protected-activity history, contract or handbook language, final-pay obligations, and who will communicate the decision. A clear employee handbook helps only when the employer follows it consistently.

Exit procedures should include recovery of company property and prompt control of systems, payment authority, and facilities. Preserve account data and access logs before deleting or reassigning anything. Keep communications limited to people with a business need to know, and do not overstate confidentiality obligations that do not exist. If the employee may file for unemployment, be prepared—an employer's guide to unemployment claims can help with that separate process.

In some cases, the employee who stole may try to reframe the termination as retaliation for some protected activity — a discrimination complaint, a wage claim, or a safety report. Understanding how wrongful termination claims work in Oklahoma helps you structure the termination in a way that's defensible regardless of what the former employee alleges.

Preventing the Next Time

After managing the immediate crisis, evaluate how it happened and how to prevent recurrence.

Separation of duties is the most fundamental control. No single employee should control both the creation and review of financial transactions. The bookkeeper who writes checks shouldn't reconcile bank statements.

Regular audits—internal or external—create detection risk that deters theft and catches it earlier when it occurs.

Mandatory vacations require someone else to perform duties, often revealing irregularities the regular employee had concealed.

Background checks at hiring can reveal prior problems—though many employee thieves have clean records until they don't.

Hotlines and reporting mechanisms give other employees a way to report concerns without confronting the suspected individual directly.

None of these are perfect. Determined employees can circumvent controls, especially when they have trust and access. But making theft harder to commit and easier to detect changes the risk calculus.

Frequently Asked Questions

Should I confront the employee directly when I discover theft?

Generally, no. Confronting the employee before securing evidence can result in destruction of records, coordinated stories with accomplices, or even threats. Consult an attorney first, preserve evidence, and let the investigation guide when and how to address the employee.

Can I recover stolen money through a civil lawsuit?

Potentially. Conversion, breach of fiduciary duty, fraud, contract, or other claims may fit, but the elements and defenses depend on the property and relationship. A judgment is valuable only to the extent it can be collected. Punitive damages and attorney's fees are not automatic, and criminal restitution does not guarantee complete recovery.

Should I file a police report for employee theft?

It depends on the evidence, risk of ongoing loss, reporting duties, insurance terms, and whether delay could harm the investigation. Preserve what you can without altering evidence, then coordinate the referral with counsel and any forensic accountant. Do not delay merely to build a perfect internal case, and do not interfere with witnesses or evidence after law enforcement becomes involved.

How can I prevent employee theft in the future?

Key controls include separation of duties (no one person controls both creation and review of transactions), regular audits, mandatory vacations, background checks at hiring, and anonymous reporting hotlines.

What is the felony threshold for employee theft in Oklahoma?

For conduct governed by Oklahoma's revised 2026 penalty structure, embezzlement of property worth $1,000 or more is felony-level embezzlement. The felony classes increase at $2,500 and $15,000. Older conduct may be governed by prior penalty rules, and repeated transactions may be aggregated when they are part of a continuing plan, so the total loss calculation matters.

Can I fire an employee I suspect of theft without proof?

An employer generally need not prove the criminal case beyond a reasonable doubt before making a lawful employment decision. But investigate in good faith, account for contracts and protected activity, treat comparable employees consistently, and use a truthful reason supported by the record. Repeating an unsupported criminal accusation can create defamation risk.

Should I involve law enforcement or handle it internally?

That depends on the amount, the evidence, ongoing access, insurance and reporting duties, and potential harm to others. The state controls any criminal case; the business controls its employment and civil decisions within the law. Internal handling is not guaranteed to remain private, and law enforcement should not be used as settlement leverage. Counsel can coordinate the sequence without compromising evidence or coverage.

---

This article was materially updated on July 13, 2026, using the current Oklahoma Statutes and enrolled HB 2104. It is for general information only and is not legal advice.