The invoice does not add up. A vendor nobody recognizes has been paid for months. An employee’s lifestyle suddenly outpaces their salary. The moment you realize fraud may be happening inside your own organization is disorienting, and what you do in the first 48 hours after discovering fraud can determine whether you recover your losses or watch the evidence disappear.

Here is why the clock matters. According to the ACFE’s 2024 Report to the Nations, the typical organization loses about 5 percent of its annual revenue to occupational fraud, and the median scheme runs for a full 12 months before anyone catches it. The global median loss now sits at $145,000 per case. By the time you notice, damage is already done, but panic and missteps make it worse. This field guide walks you through the first 48 hours after discovering fraud with the calm, methodical approach that actually protects your business.

Hour Zero: Stop, Breathe, and Do Not Confront

Your instinct will be to march down the hall and demand answers. Resist it. Confronting a suspect in the first 48 hours after discovering fraud is one of the most damaging moves you can make. It tips them off, invites destruction of evidence, and can expose you to legal liability if your suspicion turns out to be wrong.

Instead, in these first hours:

• Say nothing to the suspected individual and limit who else knows
• Avoid making accusations verbally, in email, or in writing
• Resist the urge to “fix” the problem by quietly moving money or reversing entries
• Keep your normal routine so nothing looks unusual

Discretion is not about protecting the wrongdoer. It is about protecting your ability to build a case that holds up later.

Preserve the Evidence Before It Vanishes

Fraud evidence is fragile. Digital records get deleted, documents go missing, and access logs get overwritten. Preserving evidence is the single most important task in the first 48 hours after discovering fraud, and it must happen before anyone suspects they are being watched.

Focus on these steps:

• Secure digital access. Work with IT or a trusted third party to preserve emails, files, and system logs. Do not delete or alter anything yourself.
• Do not tamper. Handle original documents as little as possible and never annotate them.
• Document what you found. Write down how and when you discovered the issue, in a private record kept separate from company systems.
• Restrict, do not alert. If you must limit a suspect’s access, do it through routine-looking IT policy rather than an obvious lockout.

Evidence handled sloppily can be ruled inadmissible. Our breakdown of what holds up in court versus what gets thrown out explains why chain of custody matters from the very first hour.

Call the Right People, in the Right Order

Who you call in the first 48 hours after discovering fraud shapes everything that follows. The wrong first phone call can waive privilege or compromise the investigation.

Generally, your early outreach should include:

• Legal counsel first. Looping in an attorney early can protect communications under privilege and guide your next moves.
• A qualified forensic investigator. Forensic specialists trace assets, analyze ledgers, and produce regulator-ready documentation your internal team usually cannot.
• Your insurance carrier. If you carry fidelity or crime coverage, notice deadlines may be tight, so check your policy quickly.

Not sure whether to call a lawyer or a forensic accountant first? Our guide on forensic accountant vs. lawyer breaks down who does what. And if you are still unsure whether what you found even rises to fraud, do you need a fraud investigator or a better bookkeeper is a useful reality check.

Contain the Damage Without Destroying the Case

There is a delicate balance in the first 48 hours after discovering fraud between stopping ongoing losses and preserving your investigation. Move too aggressively and you alert the suspect. Move too slowly and the bleeding continues.

Reasonable containment steps in the first 48 hours after discovering fraud include reviewing and tightening authorization on outgoing payments, quietly adding a second set of eyes to financial approvals, and monitoring the affected accounts closely. What you should not do is broadcast changes, launch an obvious internal purge, or start interviewing witnesses without professional guidance. Remember that more than half of fraud cases trace back to weak or overridden internal controls, so containment is also your first look at where your defenses failed.

Build Your Documentation Trail

Everything you do in the first 48 hours after discovering fraud should be documented contemporaneously. Investigators and courts give enormous weight to records created in real time, because memory fades and details blur.

Keep a private, dated log that captures what you observed, when you observed it, who you contacted, and what actions you took. Store it securely and separately from the systems the suspect can access. This record becomes the backbone of a professional investigation and demonstrates that you acted responsibly. For a sense of what comes next, our week-by-week fraud investigation timeline shows how these first hours feed into a full forensic process, and the embezzlement red-flag checklist helps you spot related schemes you may have missed.

Move Fast, But Move Smart

The first 48 hours after discovering fraud are not about solving the case yourself. They are about protecting evidence, preserving your legal options, and bringing in the right professionals before missteps close doors you cannot reopen. Tips remain the number one way fraud gets caught, accounting for 43 percent of detections, which means your instinct to act was right. Now channel it wisely.

If you suspect fraud in your organization, do not go it alone. The investigators at Fraud & Order help business owners, counsel, and compliance teams turn that first alarming discovery into a clear, evidence-based path forward. Reach out for a confidential consultation, and let experience guide your next move.

Frequently Asked Questions

Should I confront the person I suspect of fraud?

No. Confronting a suspect early almost always backfires by tipping them off and prompting evidence destruction. Stay discreet, preserve what you have found, and let legal counsel and investigators guide any conversations that follow.

What is the very first thing I should do after discovering fraud?

Do not alter anything and do not accuse anyone. Quietly preserve evidence, write down how and when you discovered the issue, and contact legal counsel before taking further action. Acting deliberately in the first 48 hours protects both your case and your business.

Do I need to call the police right away?

Not necessarily first. Many organizations start with legal counsel and a forensic investigator to assess the situation and preserve evidence before deciding whether and when to involve law enforcement. An attorney can help you navigate reporting obligations specific to your industry.

How much does occupational fraud typically cost a business?

The ACFE estimates organizations lose roughly 5 percent of annual revenue to fraud, with a global median loss of $145,000 per case. Smaller businesses are often hit hardest because they tend to have weaker internal controls and fewer resources to absorb the loss.

Can I investigate the fraud myself to save money?

It is risky. Untrained handling of evidence can render it inadmissible and expose you to liability. A qualified forensic investigator produces documentation built to withstand regulator and courtroom scrutiny, which is difficult to recreate after the fact.

How can Fraud & Order help in the first 48 hours?

Fraud & Order provides confidential, around-the-clock intake and works alongside your counsel and internal teams to preserve evidence, trace assets, and build regulator-ready reports. Early involvement gives you the best chance of protecting evidence and recovering losses.

References

Association of Certified Fraud Examiners. (2024). Occupational Fraud 2024: A Report to the Nations. https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2024/2024-report-to-the-nations.pdf

Federal Bureau of Investigation. (2025). White-Collar Crime. https://www.fbi.gov/investigate/white-collar-crime

U.S. Department of Justice. (2024). Fraud Section. https://www.justice.gov/criminal/criminal-fraud

Federal Trade Commission. (2025). Report Fraud. https://reportfraud.ftc.gov/

American Institute of Certified Public Accountants. (2024). Forensic and Valuation Services. https://www.aicpa-cima.com/topic/forensic-valuation

Institute of Internal Auditors. (2024). Fraud and the Internal Auditor. https://www.theiia.org/en/content/guidance/

U.S. Small Business Administration. (2024). Protect your business from fraud and scams. https://www.sba.gov/business-guide/manage-your-business/prevent-fraud-scams

Cybersecurity and Infrastructure Security Agency. (2025). Preserving evidence and reporting cyber incidents. https://www.cisa.gov/report

Disclaimer: This content is for informational and educational purposes only and does not constitute legal, financial, or professional advice, nor does reading it create a client relationship. Every fraud situation is unique, so consult qualified legal, accounting, and investigative professionals before acting on any specific matter. For questions about FraudOrder services, visit https://fraudorder.co/