Employee Fraud Investigations: Evidence and Recovery

How Employee Fraud Usually Comes to Light

Employee fraud detection often starts with a tip, an unexplained reconciliation difference or a change noticed while the employee is absent. A substitute bookkeeper may find that balances cannot be reconciled or that supporting records are missing. These signals justify investigation, but they do not establish who took money.

The Association of Certified Fraud Examiners (ACFE) reports that tips uncovered 43% of cases in its 2026 Report to the Nations. Internal audit uncovered 15%, while external audit detected 2%. An annual external audit therefore cannot replace day-to-day checks or a way for staff to report concerns.

Asset misappropriation is the theft or misuse of an employer’s money or other assets. The investigation asks what left the business, who benefited and how the employee concealed it.

Corruption involves an employee abusing their position for a benefit, such as a kickback from a supplier. The business may receive goods, yet pay an inflated amount because the employee compromised the purchasing decision.

Financial statement fraud involves deliberate misstatements or omissions in the business’s financial reports. It can conceal poor performance or losses without producing a direct transfer into the employee’s account. These categories can overlap within one matter.

Asset Misappropriation and Cash Skimming

Asset misappropriation is the most common category of occupational fraud in the ACFE study, appearing in 90% of its 2026 cases. Staff with access to receipts or payment systems can divert assets during ordinary work. The transaction may look routine until someone compares it with the underlying authority.

Cash skimming is taking a customer’s payment before it enters the business’s accounting records. A missing sale can leave no receivable to investigate, so the bank statements alone may understate the takings that ought to exist.

Compare cash deposits with till reports, receipt sequences and other independent sales records. Allow for the cash float, authorised refunds and deposit timing. Repeated deposit shortfalls that remain after those adjustments identify amounts requiring an explanation.

If the employee suppresses the sales record too, use another source such as orders fulfilled or customer receipts. Money recorded correctly and stolen afterwards is a different mechanism. Keep that distinction clear when calculating the loss.

Evidence to Secure in the First Days

Preserve the employer’s original records before confronting the employee or changing systems that could overwrite evidence. The preservation set needs to cover both the money movement and the person’s ability to authorise it.

• Obtain business bank statements for every relevant account, including closed accounts. Retain payment confirmations.
• Preserve accounting-file backups and the current file, with supplier details, journals and supporting invoices.
• Export user activity logs, approval records and bank-access logs while they remain available.
• Secure business-owned devices and relevant business email through authorised collection, preserving original files and metadata.
• Retain payroll records, expense approvals, cash records and the policies governing the disputed payments.

Record who collected each item and where the original is held. Work from copies so later analysis does not change the preserved record. Coordinate collection with the lawyer where privilege or access rights affect the material.

The employee’s personal bank statements require a lawful route. Written consent can identify the accounts and periods to be supplied. In court proceedings, a properly directed subpoena can require an employee or bank to produce relevant existing statements.

Production does not automatically permit unrestricted use. The court’s general federal law subpoena guidance distinguishes production, permission to inspect and use for the case. Use the rules of the court hearing the employer’s claim.

A freezing-order application can also seek ancillary disclosure of assets and supporting account information. The NSW practice note on freezing orders addresses asset disclosure. The order’s terms determine what must be supplied. A restraint alone does not produce every statement.

The financial investigation and the workplace misconduct investigation run side by side.

Reading Bank Statements of the Employee

Isolate every credit from the employer, then compare it with the net salary and other payments the employee was entitled to receive. Match the employer’s outgoing amount and payment reference to the employee’s incoming entry. Keep unmatched payments separate until their destination is established.

Prepare a financial-year schedule showing total employer credits, verified salary, authorised reimbursements and other supported payments. The remaining amount is the unexplained employer-funded balance. Record reversals and money returned separately so the same loss is not counted twice.

A matching receipt proves that money reached the account. To establish misappropriation, connect it with the missing approval, false supporting record or other evidence showing why the payment was unauthorised. Where payments run through wages, investigate the payroll fraud evidence alongside that schedule.

Compare spending with the employee’s legitimate funds available over the same period. Include opening savings, loans, asset-sale proceeds and transfers between their own accounts before drawing an inference from spending above declared income.

Large lifestyle purchases, gambling payments or crypto purchases can support an inference about the use of stolen funds when the timing follows unauthorised employer credits. Spending alone does not prove theft. Trace the disputed receipts into the expenditure and distinguish cash withdrawals from evidence of their eventual use.

FinTrace saves forensic accountants and investigators hours of statement review by consolidating large PDF bundles into a searchable Excel ledger and a readable findings report. Suspicious transactions are clearly flagged, and each finding cites its source PDF filename and page. This puts the supporting evidence at hand while the professional develops the loss schedule and recovery case.

Recovery Options for the Employer

The employer can pursue civil recovery, claim under fidelity cover or seek compensation through criminal proceedings. Each route has a different trigger, and the same transaction schedule can support more than one route.

Route	What It Can Recover	What Decides the Route
Civil claim	A money judgment for the established loss, or relief concerning identifiable property or proceeds	The cause of action, evidence of liability and available assets
Fidelity insurance	Loss covered by the employer’s employee-dishonesty policy	Policy wording, notification requirements, exclusions and the proved loss
Criminal compensation	Compensation for loss caused by the offence under the relevant state law	The criminal outcome, statutory conditions and evidence connecting the loss to the offence

A civil debt claim fits money that is legally repayable. An equitable claim may address a breach of fiduciary duty or identifiable proceeds, depending on the employee’s role and the property traced. The lawyer must select the claim from the facts, rather than treating every employee as a fiduciary.

Notify the fidelity insurer under the actual policy and preserve its evidence requirements. Coordinate settlements and recovery steps with the insurer where its consent or recovery rights apply. Insurance payment and later recovery must be accounted for together.

In NSW, section 97 of the Victims Rights and Support Act 2013 permits compensation for loss following conviction. The Judicial Commission’s sentencing guidance explains the power and restrictions. It requires a connection between the offence and the claimed loss.

In Victoria, section 86 of the Sentencing Act 1991 permits compensation for property loss after a finding of guilt or conviction. The application must be made as soon as practicable. Compensation is not automatic payment, so the employee’s assets still affect actual recovery.

Consider an urgent freezing order where evidence shows a danger that asset dealings will frustrate a judgment. Under NSW freezing-order principles, the applicant needs a judgment or good arguable case and evidence of that danger. Act before warning the employee where giving notice could prompt the feared transfer, subject to the lawyer’s assessment of the application.

A penalty-unit figure measures a possible criminal fine, independently of the employer’s loss. In a hypothetical NSW offence calculation, assume the applicable provision specifies 100 units and the offence attracts a $110 unit value. The arithmetic is 100 × $110 = $11,000. The NSW Judicial Commission’s fines guidance identifies section 17 of the Crimes (Sentencing Procedure) Act 1999 as the unit-value provision.

Use the provision and unit value applicable to the offence date. The assumed 100 units do not state the penalty for every employee-fraud offence. The calculation neither predicts the sentence nor estimates the employer’s civil recovery. A fine is distinct from compensation payable to the employer.

Employee Fraud Prevention After the Loss

Employee fraud prevention starts by closing the control failure that allowed the proven scheme to continue. Assign each change to a person who can check whether it works.

Separate creating a supplier, approving an invoice and releasing its payment. Require independent verification of bank-detail changes through a known contact. Remove former staff access and use individual logins so activity remains attributable.

Have someone outside the payment process complete a monthly bank reconciliation. That person needs the bank statements directly and must resolve differences against source records, including unexplained journals. For cash skimming, compare deposits with independent sales evidence as well as the accounting ledger.

Keep a confidential reporting route and arrange cover during leave so another person performs the usual checks. Revisit the transactions that escaped detection after the new controls operate. The test is whether the same unauthorised payment or missing cash deposit would now be stopped or identified promptly.

Cash Skimming Before Sales Are Recorded

Cash skimming diverts a receipt before the business records it. Theft of cash already entered in the books is cash larceny under the ACFE classification. That difference determines which records can establish the expected receipt.

Compare point-of-sale entries and voids with till totals, deposit slips and the bank’s cash credits. Match stock movements and fulfilled orders to sales records. Customer receipts or delivery records can establish that a sale occurred when the employee also suppressed the point-of-sale entry.

A missing bank receipt alone does not establish skimming. Identify the independent record showing what the business expected to receive, then allow for credit sales, refunds and deposits made later. Separate cash retained as an authorised float from cash due for banking. A shortfall that remains after these checks needs evidence connecting the missing receipt to the employee before it becomes an allegation of theft.