Employee Theft and Embezzlement: How to Spot It, What Not to Do, and How to Recover the Money

It starts with a feeling. The stock does not add up, the till is short, or a new supplier is receiving payments and nobody remembers ordering from them. Then comes the thought no employer wants to have: someone on the inside. One of the people you trusted. What you do in the first days after the suspicion arises will, quite often, determine whether you manage to prove the theft and recover the money.

The difference between employee theft and embezzlement

Employee theft usually means taking something tangible: goods, equipment, cash from the till. Israeli law treats theft by an employee as a more serious offense than ordinary theft, because of the breach of trust.

Embezzlement is the misuse of authority or access the employee was given: transferring funds to themselves, inflating expenses, fictitious suppliers, or steering deals to parties linked to them. Embezzlement is harder to detect, because it is hidden within activity that looks normal.

In practice, the legal distinction matters less than the practical question: what exactly happened, for how long and on what scale.

Common methods

At the till and with cash

Sales that are not recorded, fictitious cancellations, refunds to customers who do not exist, or "loans" from the till that never come back.

In stock and the warehouse

Taking goods out without a record, selling "on the side" to customers or other shops, reporting wastage or damage that did not happen, and collusion with a driver or supplier.

In supplier payments

A fictitious supplier set up by the employee, a real supplier who overcharges and pays part back to the employee, or a change to the bank account details of an existing supplier.

In payroll and expenses

Fictitious employees on the payroll, overtime that was not worked, and inflated or duplicate expense receipts.

At senior level

A manager who steers deals to a company linked to them, sells company assets at a low price to a close associate, or takes the company's business opportunities for themselves.

With information

An employee who copies the client list, price lists or technical information before leaving for a competitor. This is not always theft of money, but the damage can be greater.

Warning signs not to ignore

In the data:

• A persistent gap between stock and sales, or between revenue and activity.
• A rise in cancellations, refunds or wastage, for a particular employee or on a particular shift.
• A new supplier nobody knows, with an address, phone number or bank account linked to an employee.
• Invoices in round amounts, or just below the threshold that requires approval.

In behavior:

• An employee who never takes leave, and will not let anyone else cover their role.
• An employee who insists on handling a particular area alone, and resists oversight.
• A lifestyle that does not match the salary.
• An unusually close relationship with a particular supplier or customer.

No single sign proves anything on its own. Several signs together are a reason to look into it.

What not to do when a suspicion arises

Do not confront the employee

An early confrontation, before there is evidence, gives the employee time to delete files, make documents disappear, align their story with accomplices and move money. In most cases, after such a confrontation it is no longer possible to prove the scale of the theft.

Do not tell too many people

Every additional person who knows is a risk of a leak. Sometimes the person stealing is not acting alone, and you do not know who else is involved.

Do not search the employee's private phone or accounts

Even if the phone is sitting on the desk, and even if the password is known. Intruding into an employee's private material may be an offense, and may render the evidence inadmissible. Reviewing company computers and mailboxes is also subject to rules, and it is recommended to do so only after legal advice.

Do not deduct from the salary on your own initiative

Israeli law strictly limits deductions from an employee's salary. Deducting on your own initiative may turn you into the defendant.

Do not dismiss immediately, without a hearing

In Israel, an employee must be given a hearing before dismissal. Dismissal without a hearing may expose you to paying compensation, even when the employee really did steal.

What to do

1. Preserve what you have: reports, system transactions, invoices, footage from cameras that are already lawfully installed, and stock records. Before they are deleted automatically or manually.
2. Consult a lawyer familiar with employment law and criminal law, before any step involving the employee.
3. Check your insurance policies. Some businesses have insurance that covers employee embezzlement. There is usually an obligation to notify the insurer within a certain time from when the suspicion was discovered.
4. Establish the facts quietly: what happened, since when, on what scale and who is involved. This is the stage at which an investigator comes in.
5. Decide on the next step only when you have the full picture: a hearing, a demand for repayment, a claim or a police complaint.

How to recover the money

• A repayment settlement: in many cases, when the employee is shown an organized evidence file, they prefer to repay the money and sign a settlement rather than face a claim and a complaint. Such a settlement should be made through a lawyer, and without threats.
• A civil claim: for repayment of the money and compensation for the damage. Where there is a concern that the employee will move the money out of reach, a temporary attachment can be requested.
• A police complaint: a decision best made with your lawyer. A complaint does not necessarily bring the money back, but sometimes it is the right step.
• An insurance claim: if there is a suitable policy, and you reported in time.

When the money has already been moved into assets or to other people, it has to be traced. We wrote about this in our guide on locating a debtor's bank accounts.

How to prevent the next time

• Separation of duties: whoever orders does not approve, and whoever approves does not pay.
• Mandatory leave and rotation: when someone else covers for the employee, things come to light.
• Checking new suppliers before the first payment, including comparison with employee details.
• Surprise stock counts, not only at fixed times.
• A background check before appointment to a sensitive role, within the limits of the law.
• An anonymous reporting channel for employees. Many embezzlements are uncovered thanks to another employee who noticed.

When you need a private investigator

When there is a suspicion, but you have no way to look into it from the inside without exposing the investigation. When there is reason to think several employees are acting together. When the theft has been going on for a long time, and you need to understand its full scale. Or when it involves a senior employee with access to all the systems.

A licensed private investigator establishes the facts quietly: analyzes documents and data, maps the links between the employee and suppliers and customers, carries out observation within the law, and in appropriate cases places an undercover investigator in the organization. The result is an evidence file on which your lawyer can base a hearing, a demand for repayment, a claim or a complaint. For an example of an investigation into a senior employee who was charged with harming the companies he worked for, read our article on the information security manager.

The information in this section is general and is not legal advice. Every case is assessed on its own facts.

In case of any discrepancy, the Hebrew version prevails.