Caught Red-handed: What to Do About Employee Fraud

No one wants to be the victim of employee fraud. But for small business owners, the chances of employee fraud are high. In fact, two-thirds of small businesses in the U.S. are victims of employee theft. The good news? You don’t have to be a victim.

Understanding what employee fraud is can help you prevent it before it even happens. Read on for a definition of employee fraud, signs to be on the lookout for, and employee fraud examples.

What is employee fraud?

Employee fraud is a form of employee misconduct that occurs when an employee defrauds their employer. There are many different types of employee fraud. This may include:

  • Stealing items or data
  • Manipulating accounts
  • Committing payroll or accounting fraud

But, who commits employee fraud? In many cases, employees who commit fraud are knowledgeable and in a unique position to know a business’s weak points. And, employers can generally trust these employees … until they’re caught red-handed, of course. 

How employee fraud affects small businesses

To some, employee fraud and theft can seem minor. For example, an employee may take an extra break or bring home some office supplies. Other forms of employee fraud, like embezzlement or kickbacks, are more severe. 

Whether it’s a large amount of money or a box of staples here and there, employee fraud always hurts your business’s bottom line. And in the end, even those staples add up.

Signs of employee fraud include: 1. Working long or extra hours. 2. Living beyond their means. 3. Working in a position to commit fraud. 4. Hiding job-related duties or concerns. 5. Receiving whistle-blower tips.

Signs of employee fraud

Employee fraud can be difficult to detect because there are so many types of fraud to worry about. To make matters worse, employee fraud tactics can be complex. 

If you are suspicious about employee fraud and don’t know where to start, here are a few signs that an employee may be committing fraud:

  1. Working long or extra hours. Typically, an employee involved in fraud will work late or when others are out of the office so they don’t have to worry about oversight.
  2. Living beyond their means. If you have an employee that suddenly starts living beyond their means, this may be a sign of illicit income. 
  3. Working in a position to commit fraud. While this isn’t a sign of fraud in and of itself, fraud is often committed by employees with special access to accounts, vendors, or assets. 
  4. Hiding job-related duties or income. If any employee is committing fraud, they’re likely to be secretive about their duties and compensation. 
  5. Receiving whistleblower tips. Despite your best efforts, you’ll never be able to see everything that happens in your business. Whistleblowers often have inside knowledge of fraudulent activity and can see employee actions that may go under your radar. 

Employee fraud examples

So, what counts as employee fraud? Employee fraud comes in all shapes and sizes. It can involve huge sums of money or just a few dollars. Fraud can also happen during a single day or take place over several years. Because employee fraud and theft are sometimes hard to notice, we’ve made a list of common employee fraud schemes to keep in mind. 

Common types of employee fraud can include:

  1. Theft
  2. Account fraud
  3. Vendor fraud

1. Theft

Theft is a broad term that can include your business assets, employee benefits, and wages. Employee theft happens when an employee takes something that doesn’t rightfully belong to them.

Employee theft can include:

  • Misuse of company assets
  • Sales skimming

Misuse of company assets

Taking office supplies is a good example of an employee misusing company assets. When polled, 58% of employees admitted to stealing office supplies from work. It may seem innocent to some, but stealing office supplies adds up. But, stealing office supplies isn’t the only misuse of company assets you have to worry about. 

Misuse of company assets can also include:

  • Taking the company vehicle for personal use
  • Using a company credit card to cover personal expenses
  • Renting out or selling company tools or hardware

To prevent misuse of company assets, keep a closer eye on them. Here are two things to try to help prevent the misuse of company assets:

  • Use log books to monitor which employees use specific assets
  • Consider limiting access to assets to specific employees for set periods of time 

Skimming sales

Skimming sales is when an employee takes money from a business before they enter it into an accounting system. Skimming is an off-book fraud because the employee doesn’t account for the money in your business’s books, making it difficult to catch. Employees don’t have to hide this type of fraud because it involves no paperwork. 

Employees may skim sales through:

  • In-store sales
  • After-hours sales
  • Off-site sales
In-store sales

The most common form of sales skimming can take place right under your nose. Employees can skim sales in-store during regular hours by taking money from a customer and not completing the sale properly. 

Employees committing in-store skimming take a customer’s money, open the till, and offer change if needed. This is where it can get tricky. An employee skimming sales at the register may either pocket the money directly or keep it in the till to take out later. 

If you’re worried about in-store sales skimming, here are three things to try:

  1. Make sure employees don’t share the till. When employees share tills it can be difficult to pinpoint who is skimming sales. When you stop till sharing, you can isolate specific employees and keep a closer eye on their habits at the register.
  2. Keep an eye on suspicious employees. Sometimes simply working next to an employee suspected of sales skimming is enough to prevent this type of employee fraud. And if your presence doesn’t stop the employee, it may help you catch them. Pay close attention to cash transactions.
  3. Conduct a till audit. To conduct a till audit, take the till from the cash register when the employee is using it. Count the amount of cash in the till and compare the till’s balance with the receipts. If the balances don’t match, you may have an employee trying to skim sales. 
After-hours sales

After-hours sales skimming works like an in-store skimming scheme. Because this type of fraud is easiest when there is little to no oversight at the register, an employee may keep your store open past normal hours to operate without oversight. Watch out for skimming sales after hours if the employee is working a late-night shift or has kept the business open after hours.

To spot after-hours sales, keep track of your point of sales (POS) system. If an employee consistently closes your POS late (e.g., a long time after store hours), you may have a case of after-hours skimming on your hands. 

You may also want to track employee hours to see if specific employees clock out late on certain days. Even if the employee closes the POS on time, an employee that stays late regularly could be a sign of after-hours sales taking place. 

Off-site sales

Off-site sales are particularly vulnerable to fraud because they are generally less supervised. 

Catching sales skimming that takes place off-site can be difficult. Keep track of your inventory before and after the off-site sale and compare it with receipts. If the receipts and inventory sold don’t match up, this might be because of sales skimming.  

2. Account fraud

If you notice that your books are suddenly disorganized or confusing, there’s a chance that someone is using your accounts to steal money from your company. And if you aren’t paying close attention, this type of employee fraud can go on for years. 


Embezzlement occurs when employees abuse their position and knowledge within the company to misdirect money. The employee that commits embezzlement could be an administrator, accountant, or someone else that holds a trusted position. 

Embezzlement can include:

  • Fake vendor payments
  • Padding expense reports
Fake vendor payments

With fake vendor payments, an employee creates fake invoices for goods or services that were never sold. Fake vendor payments often include manipulating your business’s books.

To help prove a vendor is legitimate, ask for their federal tax identification number, compare vendor information to employee information, and keep a close eye on your books.

Padding expense reports

If your employees often travel for work, they may try to pad their expense reports. Padding usually involves an exchange between another party. For example, an employee covers another person’s meal in exchange for cash. When the employee returns to work, they’ll ask for a meal reimbursement and keep the cash.

To spot padding, look over receipts for any suspicious activity, like multiple meals for one person.

Accounts payable fraud

Accounts payable (AP) fraud often goes on for years because it is difficult to detect. Employees that commit AP fraud have a high degree of knowledge when it comes to the AP processes of your business. 

AP fraud can include:

  • Pay and return scheme
  • Personal-purchase schemes
  • Vendor master file fraud
Pay and return schemes

Pay and return schemes happen when an employee overpays a vendor and asks for a refund. The employee then takes the refund and uses it for their own purposes. 

There are a variety of pay and return schemes. For example, an employee may send two checks to a vendor and ask the vendor to return one. Or, the employee may purposefully pay the wrong vendor and ask them to return the check. When the employee receives the return payment, they keep it.

To catch pay and return schemes, touch base with your vendors and keep all payments on your radar.

Personal-purchase schemes

Personal-purchase schemes involve employees creating purchase orders and payments for goods or services for their personal use. Employees may keep the goods for themselves, return them for cash, or sell them. 

To spot personal-purchase schemes, keep an eye out for unfamiliar invoice delivery addresses and look for merchandise that never arrives.

Vendor master file fraud

Vendor master file fraud occurs when an employee manipulates or misuses the vendor master file. This can occur in two ways: 1. When an employee creates a sham vendor account or 2. When an employee uses an inactive vendor.

Here’s how these types of vendor master file fraud work:

  1. Employees create a sham vendor account and submit a fake invoice. In order to avoid suspicion, the first invoice is often for a small dollar amount. Once the invoice is approved, the employee can submit invoices for more significant amounts. 
  2. Employees use an inactive vendor. For this process to work employees change the vendor address to their own address after the invoice is approved. Once the employee receives the check meant to pay the vendor, they’ll go back into the master file and change the address back to the original vendor address to cover their tracks. 

To help prevent vendor master file fraud, regularly review reports in the master vendor file and separate the duties throughout your procure-to-pay process. 

Accounts receivable fraud

Account receivable (AR) fraud is often known as “lapping.” It occurs when an employee uses customer funds for personal use. To avoid being caught, employees overlap customer accounts, using one account to cover the stolen money from another. For example, an employee takes payment from Company A and covers the loss by moving payments from Company B to Company A.

Here are some things to look out for if you think an employee is committing accounts receivable fraud:

  • Excessive billing errors
  • Delays in posting customer payments
  • Customer complaints
  • Accounts receivable details that don’t match the general ledger

Want to impress your friends at a dinner party?

Get the latest payroll news delivered straight to your inbox.

Subscribe to Email List

3. Vendor fraud 

Vendor fraud is difficult to detect. There are two types of vendor fraud to keep in mind: kickbacks and bribery. Bribes are generally a one-time payment (e.g., a single cash payment or one-time gift). On the other hand, kickbacks are paid over a set period of time with multiple payments. 


A kickback is an illegal payment from a vendor to an employee to secure a contract. Kickback schemes usually target employees that have procurement, purchasing, or contract authority. 

So, what does this look like in action? Let’s say that a vendor convinces an employee with contract authority to participate in a kickback scheme. In exchange for securing the contract for the vendor, the vendor agrees to pay the employee a set amount of money (e.g., a percentage of the contract’s worth). 

Because of how a kickback scheme operates, you should be on the lookout for contracts with higher price tags than usual. The higher price is to help pay the employee for their help. If an employee seems to favor a specific vendor or approves contracts with unusual pricing, you may have a kickback scheme taking place. 


Like a kickback scheme, vendor bribery involves a vendor bribing an employee with unique power over vendor contracts. Unlike a kickback, bribery usually takes place all at once and doesn’t leave a paper trail. 

Bribes can include: 

  • Cash
  • Services
  • Information on competitors
  • Gifts

Like kickbacks, be on the lookout for employees favoring one vendor over the other. When an employee has a favorite vendor, it may be a sign of a bribery scheme. 

Detecting vendor fraud

Are you worried about vendor fraud? Vendor fraud can be difficult to uncover. But there are methods you can use to detect it, including SPQQD.

SPQQD is an acronym that stands for:

  • Selection. The improper selection of a contractor that favors a certain vendor.
  • Prices. The payment of unreasonably high prices to a vendor.
  • Quantity. The purchase of an excessive quantity of goods that benefits the vendor.
  • Quality. The acceptance of low-quality goods at a higher price.
  • Delivery. The delivery of items that don’t meet company specifications. 

Employees involved in vendor kickbacks or bribery schemes typically create the perfect situation for their vendor to win the contract. 

Employees may influence the vendor contract process by: 

  • Failing to advertise the request for contract bids
  • Creating pre-qualification procedures that purposefully exclude other qualified vendors
  • Drafting contract specifications that favor the vendor involved in the scheme
  • Changing bids after receipt or manipulating the scoring of bids
  • Asking for delays in the award process as the bribe or kickback scheme is fine-tuned

You’ve got enough on your plate as it is. Make your payroll process easier so you can get back to business. Patriot’s Full Service payroll makes the entire process so easy, you’ll look forward to payroll. Try it for free today!

span class=”smaller-text”>This is not intended as legal advice; for more information, please click here.

Stay up to date on the latest payroll tips and training

You may also be interested in:

Most popular blog categories