# How Embezzlement Is Discovered, Usually by Accident

- Author: PreciseBankFlow (https://www.precisebankflow.com)
- Published: 2025-03-30
- Updated: 2025-03-30
- Category: Embezzlement and fraud schemes
- Canonical: https://www.precisebankflow.com/blog/how-embezzlement-is-discovered

> How embezzlement is discovered in practice: tips, absences, vendor calls and bank notices, and why reconciliations reviewed by the owner find it sooner.
Embezzlement is usually discovered by something outside the scheme: a coworker's tip, a vendor calling about an unpaid bill, a bank notice opened by the wrong person, or the thief's absence leaving their work to someone else. Formal checks find it less often, but a bank reconciliation the owner reviews against the bank's own statement finds it sooner.

## How is embezzlement discovered most often?

Embezzlement is most often discovered when a person notices something that does not fit, rather than by a scheduled control. A colleague sees a payment to an odd payee, a customer insists they paid, or someone opens mail meant for the bookkeeper. The scheme is built to survive routine checks, so the break usually comes from an outside event.

That pattern has a practical lesson. If discovery depends on chance, the business should make those chances more frequent: more people who can see the bank activity, more ways to report a concern, and fewer documents that only one person ever opens.

The routes below are an example of how cases come to light and what each one should prompt you to check next.

| Discovery route | The first signal | What to check next |
| --- | --- | --- |
| A tip | A coworker, vendor or relative says something is wrong | The bank statements for the payee or period named |
| An absence | The cover person finds unexplained items | The reconciliation's old open items and the vendor list |
| A vendor or customer call | A supplier says it was not paid, or a customer says it did | Cleared check images and the customer's receivable history |
| A bank notice | A returned item, overdraft or fraud alert | Deposit and withdrawal detail around the notice date |
| An owner review | A payee or transfer on the statement the owner does not recognise | The ledger entry for that line and who recorded it |

## Embezzlement discovered during an absence or a staff change

Embezzlement is often discovered when the person doing it is away or leaves, because most schemes need daily maintenance. When someone else opens the mail, answers vendors and prepares the reconciliation, the concealment stops and the evidence is in front of a new reader. A resignation, a sick leave or a holiday can each be the moment.

The Federal Reserve made this point for banks in [supervisory letter SR 96-37 on required absences](https://www.federalreserve.gov/boarddocs/srletters/1996/sr9637.htm), which says most frauds or embezzlements require the continual presence of the wrongdoer. It asks banks to keep staff in sensitive roles away from their duties for at least two consecutive weeks. A small business can use the same logic without a formal rule.

The signs a cover person usually finds are ordinary on their face: a deposit in transit that never arrives, a vendor nobody can explain, a request from the absent employee to leave a particular task for their return. Each is worth writing down, without accusing anyone, and raising with the owner.

## Vendor calls, customer complaints and bank notices that expose embezzlement

Outside parties expose embezzlement because their records do not depend on the thief. A vendor knows whether it was paid. A customer knows whether it paid. A bank knows what cleared, what bounced and what looked suspicious. When one of them contacts the business and reaches someone other than the person hiding the theft, the story stops matching.

Contacts that deserve a closer look:

- **A supplier past-due notice** for an invoice the books show as paid, which may mean the check went elsewhere.
- **A customer who says they paid** an invoice still open in receivables, a classic sign that receipts are being taken and covered with later payments.
- **A returned deposit notice**, such as a check deposited twice by mobile capture; [mobile deposit fraud](/blog/mobile-deposit-fraud) explains how a duplicate deposit appears and is reversed.
- **An overdraft or low-balance alert** on an account the owner thought was well funded.
- **An auditor's bank confirmation** that does not agree with the balance in the books. A [bank confirmation request](/blog/bank-confirmation-request) goes straight from the auditor to the bank and back, so a statement altered inside the business cannot change the answer.

The common thread is routing. These contacts help only if they reach someone independent. Have bank alerts and vendor statements copied to the owner, not only to the bookkeeper.

## Why does an owner-reviewed reconciliation discover embezzlement sooner?

An owner-reviewed reconciliation discovers embezzlement sooner because the owner compares the books with the bank's own statement, which the bookkeeper cannot edit. A reconciliation prepared and reviewed by the same person proves only that they can make two numbers agree. When the owner reads the statement, the payees and transfers are seen by someone with no reason to hide them.

What the owner sees that a self-reviewed reconciliation hides:

- **Payees on the bank statement**, rather than the vendor names typed into the ledger.
- **Reconciling items that never clear**, such as a deposit in transit carried for three months.
- **Check images** showing a payee or endorsement that does not fit the ledger entry.
- **Transfers to accounts the owner does not recognise.**

The review only works if the owner gets the statement directly, through their own online banking login or by mail to them. A habit of a few minutes a month is enough to catch many schemes early; a routine for it is in [the owner's monthly review of bank statements](/blog/owner-review-of-bank-statements). A statement that has been checked to foot by [PreciseBankFlow](/get-started), with duplicates and check number gaps listed, gives the owner a short exception list to read alongside it.

## The first day after embezzlement is discovered

The first day after embezzlement is discovered decides how much evidence survives. Secure copies of the books and bank records, cut the suspect's access to the bank and the accounting system, and speak to counsel before confronting anyone. A hasty accusation gives the person time to delete records or move money.

The mistakes to avoid on that first day:

- **Confronting the suspect** before the records are copied.
- **Telling too many people**, which spreads the news to the suspect within hours.
- **Fixing the books** by reversing entries before someone has documented them.
- **Ignoring the bank.** Ask the bank about its reporting deadlines for unauthorised items, because a late claim can lose a recovery.

A full sequence for the days that follow, from preserving records to deciding whether to report, is in [what to do if you suspect embezzlement](/blog/what-to-do-if-you-suspect-embezzlement).