An employee theft insurance claim asks a crime or fidelity insurer to pay for money an employee stole. The proof of loss has to show who took it, each stolen payment with its date and amount, where the money went, and that the loss and its discovery fall within the policy's terms. Bank records carry most of that proof.
What does an employee theft insurance claim have to establish?
An employee theft insurance claim has to establish that a covered person caused the loss, the amount of the loss, how it happened, and that it fits inside the policy's coverage period and conditions. The insurer pays on what is proved, not on what is suspected. A claim built on documents moves faster than one built on estimates.
Read the policy before building anything. The definitions decide most of the claim. Look for the meaning of "employee," which may or may not include contractors, temporary staff or officers. Look for how the policy defines a loss, which events trigger coverage, the deductible, the limit per occurrence, and the deadlines for notice and for filing the proof of loss. Write those deadlines on the first page of the file.
The four elements, in plain terms
- Who. The person who took the money was a covered employee at the time.
- How much. Each stolen payment, listed and supported.
- How. The scheme, explained in a way an adjuster can follow.
- When. The dates of the thefts and the date of discovery, measured against the policy.
Why the employer often knows less than it thinks
Employers discover theft at one point, often a single forged check or an angry vendor. The full scheme is usually bigger and older. A claim filed on the first number found will often be too small, and amending it later invites questions. Finish the investigation first if the deadlines allow it.
Building the proof of loss for an employee theft claim from bank records
A proof of loss built from bank records lists every stolen payment as its own line, with the date, the account it left, the amount, where it went and the document that shows it. The adjuster will test each line, so each line has to stand up alone. Totals with no detail behind them get reduced.
Steps to build it
- Fix the scope. List every bank account, card and payment account the employee could touch. The method for keeping many accounts straight is in how to reconcile multiple bank accounts at month-end.
- Get complete records. Statements, check images, ACH detail and online banking logs for each account, for the whole period the employee had access.
- Find the scheme's signature. A fake vendor, altered payees, extra payroll, or transfers to the employee's own account. Each scheme leaves a recognizable pattern.
- Search for every instance. Once the pattern is known, search the full record set for it, not just the months where it was first spotted.
- Support each line. Attach the statement page, the check image or the transfer record.
- Subtract recoveries. Repayments and seized funds come off the gross loss.
A worked proof of loss, with example values
The schedule below is an example. The employee, payees and amounts are invented.
| Date | Account | Method | Payee or destination | Amount | Source document |
|---|---|---|---|---|---|
| 2024-03-08 | Operating, ending 2207 | ACH | J Harlow Consulting (no contract on file) | 4,850.00 | March statement p. 2; ACH detail |
| 2024-04-12 | Operating, ending 2207 | ACH | J Harlow Consulting | 3,920.00 | April statement p. 3; ACH detail |
| 2024-06-21 | Operating, ending 2207 | Check 1184 | Payee altered from a utility to the employee | 2,600.00 | Check image front and back |
| 2024-09-30 | Operating, ending 2207 | ACH | J Harlow Consulting | 5,400.00 | September statement p. 2; ACH detail |
| 2025-01-17 | Payroll, ending 5530 | Direct deposit | Extra pay run to the employee | 1,780.00 | Payroll register; January statement |
| Gross loss | 18,550.00 | ||||
| Less repayment received 2025-03-02 | (2,000.00) | Deposit record | |||
| Loss before deductible | 16,550.00 |
How the deductible applies, and whether these thefts count as one occurrence or several, depends on the policy wording. Show the loss before the deductible and let the policy terms do the rest.
Discovery dates and policy periods in an employee theft claim
The discovery date is when the employer first knew, or should have known, about the theft. The policy period is the time during which the policy covers losses. Some crime policies cover losses discovered during the period, wherever the theft happened, and others cover losses sustained during the period. Which kind you have changes what can be claimed.
Why the date matters
On a discovery-type policy, a theft that started years earlier may still be covered if it was discovered while the policy was in force, subject to any retroactive date or other limits in the wording. On a loss-sustained policy, each theft has to fall inside a covered period, and thefts under an earlier policy may need to be claimed under that one. Check your own policy's definitions; do not assume.
Fixing the discovery date
Write down when the employer first learned something was wrong, who learned it and how. An email from a vendor, a bank's fraud alert, or a reconciliation that would not balance are all candidates. The insurer will ask whether earlier warning signs were ignored. If an unexplained difference sat on the bank reconciliation for six months, expect a question about why nobody followed it up.
Notice
Most policies require prompt notice to the insurer after discovery, and some set a specific deadline for the proof of loss. Give notice early, even before the amount is known. A late notice can cost more than an incomplete first estimate.
What will the adjuster test in an employee theft claim?
The adjuster will test whether each listed payment was really theft, whether the person was a covered employee, whether the amounts tie to bank records, and whether the dates fit the policy. Adjusters and their accountants pick lines at random, ask for the source, and look for items that might be legitimate business payments.
The lines they question first
- Payments to real vendors. If the claim includes payments to a vendor that did supply goods, expect a request for proof the goods were not delivered.
- Round estimates. A line like "cash skimming, estimated 20,000.00" with no daily records behind it will be challenged hard.
- Payroll items. Extra pay may have been approved by someone else, which turns theft into a management decision.
- Items before the employee's start date. These need a different explanation or have to come out.
Making the schedule easy to test
Number every line. Give every source document the same number. Provide the bank statements in their original form, not retyped. An adjuster who can verify five random lines in an afternoon tends to trust the rest. One who finds a single wrong amount will check all of them.
Completeness of the bank records
Adjusters also ask whether the record set is complete, because missing months could hide recoveries or offsets as well as more thefts. PreciseBankFlow checks that each statement foots and flags check-number gaps and possible duplicates, and its exception report can go to the adjuster with the claim. Firms can ask about early access.
Recoveries and offsets that reduce an employee theft claim
Recoveries and offsets are amounts the employer got back that reduce the net loss. Repayments from the employee, money frozen in the employee's accounts and restitution ordered by a court all count. Deduct them openly in the schedule, because the adjuster will find them anyway.
Money traced into the employee's accounts
If the stolen money went into the employee's own bank account, some of it may still be there. Tracing stolen funds through an account where they were mixed with the employee's own pay usually relies on a rule that limits the claim to the lowest balance the account reached after the theft. The method is explained in the lowest intermediate balance rule for tracing funds.
Money passed on to others
An employee may have moved stolen money to a spouse, relative or friend. If the employee later files for bankruptcy, a trustee may be able to recover some of those transfers for creditors, including the employer. Fraudulent transfer analysis in bankruptcy covers how those transfers are found and tested.
Subrogation
After paying, the insurer usually takes over the employer's right to recover from the employee. The employer should not settle with the employee or release them without the insurer's agreement, because that can damage the insurer's rights and the claim.
When an employee theft claim is filed too early or too narrow
An employee theft claim filed too early lists only the thefts found in the first weeks and misses the rest. One filed too narrow looks only at the account where the theft surfaced. Both lead to amended claims, and amended claims invite doubt. Balance the policy deadlines against the time needed to finish the work.
Signs the investigation is not done
- Only one scheme has been found, but the employee had access to several systems.
- The search covered the last year, but the employee worked there for five.
- Card statements, petty cash and payroll have not been reviewed.
- The employee's own bank records have not been requested.
When to ask for more time
If the deadline for the proof of loss is near and the investigation is not finished, ask the insurer in writing for an extension and explain why. Submit what you have as a preliminary figure, clearly labelled, with the remaining work listed. That is better than a final number that grows later.
When an expert helps
Larger or more complex losses often justify a forensic accountant. The adjuster may bring one too. An independent schedule, prepared to the same standard the adjuster will apply, shortens the back and forth.