# Signs of Embezzlement in a Small Business

- Author: PreciseBankFlow (https://www.precisebankflow.com)
- Published: 2025-08-27
- Updated: 2025-08-27
- Category: Embezzlement and fraud schemes
- Canonical: https://www.precisebankflow.com/blog/signs-of-embezzlement

> Signs of embezzlement in a small business: behavior, records and bank activity that point to theft, and which warning signs are often harmless.
The signs of embezzlement fall into three groups: how the person handling money behaves, what changes in the books, and what appears in the bank. One sign alone is weak, because most have an innocent cause. Several signs that point at the same person and the same accounts are worth testing against bank statements and source documents.

## What are the earliest signs of embezzlement in a small business?

The earliest signs of embezzlement are usually about access, not money. An employee resists sharing a task, delays a month-end close, or asks for bank statements to come to them. These signs appear before losses are large enough to notice in the profit figures, because control of the records comes first and the theft follows.

Early signs worth noting:

- **Statements rerouted.** Bank or card statements change to electronic delivery to one person, or paper statements stop reaching the owner.
- **Reconciliations late or missing.** The bank reconciliation is always "nearly done" or is produced only when asked.
- **New authority requested.** The employee asks to become a bank signer, gets online banking access with payment rights, or adds themselves as an administrator.
- **A small odd payment.** One payment to an unfamiliar payee, often small, as a test of whether anyone looks.

A reconciliation is the control most often missing when theft goes on for years. The explainer on [what bank reconciliation actually proves](/blog/what-reconciliation-in-bank-accounts-means) sets out what a finished one should show, which helps an owner judge whether the version they receive is real work.

## Behavior signs of embezzlement around the person who handles money

Behavior signs of embezzlement are changes in how the person who handles money works and reacts. The pattern that matters is control: refusing vacation, refusing help, getting defensive when routine questions are asked, and keeping documents where only they can reach them. Lifestyle changes matter less than control, because lifestyle has many explanations.

Behavior that deserves attention:

- **No time off.** The employee never takes a full week away, or works remotely through every vacation.
- **Guarding a task.** They object when someone else offers to open the mail, post a deposit or run payroll.
- **Defensive answers.** Ordinary questions about a payment draw irritation or a long, shifting explanation.
- **Unusual hours.** Work done early, late or on weekends when no one else is in the office, especially around month end.
- **Close ties to a vendor.** A personal relationship with a supplier that others did not know about.
- **Financial pressure.** Known debt, a gambling problem or a family crisis, which supplies motive but proves nothing.
- **Lifestyle above income.** New cars, travel or spending that a salary does not explain.

These signs should change how closely you look at the records, not how you treat the person. Many loyal employees guard their work because they take pride in it.

## Record signs of embezzlement in the books and reports

Record signs of embezzlement are changes in the accounting data that hide money leaving. Theft has to be recorded somewhere, so it shows as growing expense accounts, adjusting entries without support, missing documents and reports that do not tie to each other. The person committing the theft often controls these records, which is why the signs are subtle.

Signs in the books:

- **Expense lines growing faster than sales.** Supplies, repairs or "miscellaneous" rise year over year with no change in activity.
- **Journal entries without support.** Manual entries to cash, receivables or suspense, made by the bookkeeper and approved by no one.
- **Voids and credits.** More voided checks, more credit memos and more customer write-offs than usual.
- **Missing or copied documents.** Invoices that are photocopies, lack a vendor address or are numbered in sequence across months.
- **A receivables aging that shifts.** Reliable customers suddenly appear late, which can mean receipts are being diverted.
- **Inventory or margin drift.** Gross margin falls without a pricing reason.

Bookkeepers commit many small-business embezzlements because they hold both the money and the records. The guide to [how bookkeeper embezzlement is carried out and hidden](/blog/bookkeeper-embezzlement) walks through the usual methods.

## Bank activity signs of embezzlement on the statements

Bank activity signs of embezzlement are payees, amounts and timing on the actual statements that the books do not explain. The bank statement is the record least easy for an insider to change, so it is the best place to test what the ledger says. Read it as the bank printed it, not as a report from the accounting system.

Activity to look for:

- **Payees you do not recognize.** A vendor name you have never heard of, or a familiar name with a slight spelling change.
- **Transfers to personal accounts.** Online transfers to an account at another bank, often labelled as a payroll advance or loan.
- **Round amounts.** Repeated payments of $500 or $2,000 where real bills would have cents.
- **Payments just under an approval limit.** Several at $4,900 when approval is needed above $5,000.
- **Checks to cash or to an employee.** Especially where the register shows a vendor for the same check number.
- **Cash withdrawals with no purpose.** ATM or counter withdrawals in a business that does not use cash.
- **Fees and overdrafts.** Unexpected overdraft charges in an account that should have had enough money.

### Compare the bank to the books

The strongest test is a direct comparison. Take the statement, not a copy of it supplied by the person under suspicion, and match each payment to the ledger. Any payment whose payee or amount differs from the ledger entry is an exception. Request the statement directly from the bank or download it yourself through online banking.

## Which embezzlement warning signs are often harmless?

Many embezzlement warning signs are harmless on their own. An employee who never takes leave may be understaffed. A lifestyle change may come from an inheritance or a spouse's job. Round payments may be retainers or deposits. The sign becomes meaningful only when it lines up with a record or bank exception tied to the same person.

Signs that usually have an innocent explanation:

- **Working late.** Common at month end and in busy seasons.
- **A new car or house.** Often financed, or funded by a partner's income.
- **Round-dollar transfers between the company's own accounts.** Normal cash management.
- **Late reconciliations.** Frequently a workload problem, especially in the first year of a new system.
- **A defensive manner.** Some people react badly to any question about their work.

The opposite mistake is also common: ignoring a sign because the person is trusted. Long service is part of why theft continues. An embezzler is almost always someone the owner trusted enough to give access. Trust is a reason to test quietly, not a reason to skip the test.

Volunteer organizations show this clearly. Treasurers of churches and clubs often serve for years without oversight, and the post on [how church embezzlement happens and how to prevent it](/blog/church-embezzlement) covers that setting.

## An embezzlement warning sign checklist for the owner's monthly review

An owner can check for most warning signs in under an hour a month. Look at original bank data yourself, ask about anything unfamiliar, and note what you saw. The checklist below groups the signs and marks how strong each is when it appears alone. Ratings are a guide, not a rule.

### Bank activity (review the statement yourself)

- [ ] Every payee name is known to me. *Strong if not.*
- [ ] No transfers to personal or unknown accounts. *Strong if present.*
- [ ] No checks to cash or to employees outside payroll. *Strong if present.*
- [ ] No cluster of payments just under an approval limit. *Moderate.*
- [ ] No unexpected overdraft or returned item fees. *Moderate.*

### Records (from the bookkeeper's reports)

- [ ] The bank reconciliation is finished and the adjusted balances agree. *Moderate if missing.*
- [ ] No journal entries to cash without a document behind them. *Strong if present.*
- [ ] Voids and credit memos are at their usual level. *Moderate.*
- [ ] Expense accounts track activity, not just time. *Weak alone.*

### Behavior (note, do not act on alone)

- [ ] The person with money duties took time off this quarter. *Weak alone.*
- [ ] Someone else did their tasks while they were away. *Moderate if refused.*
- [ ] Questions got a clear, checkable answer. *Weak alone.*

Two or more strong items in the same month, or a strong item that ties to a behavior sign, justify a closer test of the account. PreciseBankFlow can foot each statement and match it to the ledger, so the owner's hour goes to the exceptions instead of rebuilding the numbers.

## Mistake: confronting a suspected embezzler before securing the records

The most damaging mistake after spotting signs of embezzlement is to ask the suspected person about it straight away. A confrontation gives them time to destroy files, change passwords, alter records or prepare an explanation. Secure the bank statements, ledger backups and documents first, then decide who should ask the questions.

Protecting the evidence comes down to getting bank data and check images directly from the bank, copying the accounting file and mailbox where the employee cannot edit them, and quietly limiting payment rights. The order to do that in, and when to bring in a lawyer and your insurer, is set out in [the first 48 hours after you suspect embezzlement](/blog/what-to-do-if-you-suspect-embezzlement#what-to-do-first-if-you-suspect-embezzlement-the-first-48-hours).

For firms testing a client's statements after a tip, [PreciseBankFlow](/) produces an exception report with the source lines behind each difference.