You just confirmed your worst fear: a trusted employee has been stealing from you. Maybe it was an accountant quietly redirecting payments. Maybe it was a manager running a ghost payroll scheme. Whatever the method, the damage is real ,and your first instinct is probably to call the police and fire them on the spot.
Stop. Take a breath. What you do in the next 48–72 hours can make the difference between recovering a meaningful portion of your losses and walking away with nothing.
Here’s the brutal truth about embezzlement: businesses recover an average of only 39% of stolen funds through settlements, restitution, or insurance claims. And in cases averaging $357,650 in losses, that recovery gap is devastating. The good news is that organizations that move strategically ,not emotionally ,consistently do better. This guide breaks down every legal option available to you and how to use them in sequence.
Step One: Secure Evidence Before You Do Anything Else
Before you confront the employee, call law enforcement, or consult HR, you need to protect your evidence. This is the single most common mistake organizations make ,they act fast and destroy their own case.
The moment a suspect realizes they’re under scrutiny, they may delete files, shred documents, move money, or alert co-conspirators. Your first move is to quietly preserve everything:
- Freeze their system access discreetly if possible ,or document everything before touching it
- Preserve digital records: emails, accounting files, expense reports, bank reconciliations
- Pull external bank statements and compare them against internal records
- Engage a forensic accountant to establish the scope of loss without tipping off the suspect
A thorough, documented investigation is the foundation of every recovery strategy. Without it, you have allegations. With it, you have leverage. Read our guide on what evidence fraud investigators actually look for to understand exactly what you’ll need to build a solid case.
Option 1: Civil Lawsuit ,Your Most Direct Path to Recovery
Filing a civil lawsuit against your former employee is often the most effective route to recover money from an embezzling employee. Unlike criminal proceedings ,which are controlled by prosecutors and the government ,a civil case is your case. You control it.
Key advantages of the civil route:
- Lower burden of proof: You only need to prove liability by a “preponderance of the evidence” (more likely than not), not “beyond a reasonable doubt”
- Broader remedies: You can pursue the full amount stolen, plus damages, attorney’s fees, and in some states, treble damages (triple the loss)
- Asset-targeting tools: Courts can issue temporary restraining orders (TROs) and writs of attachment to freeze or seize the employee’s assets before they disappear
- Parallel track: You can pursue a civil lawsuit simultaneously with criminal charges
Timing is critical. Courts have granted emergency injunctions within hours when credible evidence of embezzlement exists and assets are at imminent risk of dissipation. Every day you wait is a day a defendant can drain bank accounts, transfer property, or move assets offshore.
If the employee is convicted criminally ,or pleads guilty ,that conviction is typically admissible in your civil case and can significantly strengthen your position. The criminal court does the heavy lifting on proof; you step in for the financial recovery.
Option 2: Criminal Prosecution and Court-Ordered Restitution
Reporting the theft to law enforcement is not just about justice ,it can be a financial recovery tool, and sometimes the most powerful one available.
When an embezzler is convicted of a crime, courts in virtually every U.S. jurisdiction are required to consider ,and often order ,criminal restitution: a court-ordered directive that the convicted individual repay the victim for their losses.
Why criminal restitution matters:
- Restitution orders are typically non-dischargeable in bankruptcy, meaning the employee can’t wipe out the debt by filing for bankruptcy protection ,a critical advantage over civil judgments
- On the federal side, the DOJ’s Financial Litigation Unit can continue collecting on restitution orders years down the road and remit funds directly to the victim, effectively doing the collection work for you
- A criminal filing creates a public record that deters future misconduct within your organization
The challenge: criminal prosecution is slow. It is not uncommon for a case to take 18–36 months to resolve, by which time the defendant’s assets may already be gone. That’s why experienced attorneys recommend initiating civil action simultaneously ,don’t rely on criminal restitution as your primary recovery strategy.
If you’re unsure whether your situation warrants criminal reporting, our breakdown on when to hire a private fraud investigator vs. a lawyer can help you think through the decision.
Option 3: Negotiate a Restitution Agreement Directly
Before going to court ,and sometimes instead of it ,there’s a third path that many organizations overlook: confronting the employee privately with the evidence and negotiating a direct restitution agreement.
This strategy works best when:
- You have overwhelming, well-documented evidence
- The employee has assets and the financial capacity to repay
- You want to avoid the cost, time, and publicity of litigation
- Speed matters more than maximum recovery
Here’s the psychology behind it: most embezzlers are not career criminals. They’re ordinary people who exploited an opportunity. The prospect of a criminal record, public disgrace, and incarceration is terrifying to them in a way it isn’t to hardened offenders. With the right legal team presenting the evidence professionally ,not accusatorially ,many embezzlers will agree to repay rather than face prosecution.
One important caveat: this process must be handled carefully by legal counsel. Done wrong, it can expose your company to claims of coercion, false imprisonment, or defamation. Done right, it can produce a legally enforceable restitution agreement, sometimes with immediate payment, and without the cost of litigation.
Make sure to review how to prove embezzlement without direct evidence ,having airtight documentation before any confrontation is non-negotiable.
Option 4: File an Insurance Claim Under Your Fidelity Bond or Crime Policy
Many organizations don’t realize they may already be covered. Fidelity bonds (also called employee dishonesty bonds or crime insurance policies) are specifically designed to reimburse employers for losses caused by employee theft or embezzlement.
What to do immediately:
- Pull your commercial crime or fidelity bond policy and identify the coverage limits
- Notify your insurer in writing as soon as possible ,most policies have strict reporting windows (often 60–90 days from discovery)
- Preserve all financial documentation; insurers will conduct their own investigation before paying a claim
- Engage a public adjuster or attorney experienced in crime claims if the insurer disputes the amount
Insurance claims won’t make you whole on their own ,policy limits vary widely, and insurers will scrutinize every detail ,but they can provide immediate liquidity while civil and criminal proceedings move forward.
If your organization doesn’t currently have a fidelity bond, that’s a gap to close after this incident. The premium is modest compared to the exposure.
Option 5: Pursue Third-Party Liability (Banks, Accountants, Vendors)
In more complex embezzlement cases, the employee didn’t act alone ,or they were enabled by inadequate oversight from a third party. This opens additional recovery avenues:
- Banks: If a bank failed to flag obviously suspicious activity or honored fraudulent instruments improperly, you may have a claim against the financial institution
- Accounting firms: If an outside auditor failed to detect a fraud that reasonable audit procedures should have caught, a professional negligence claim may be available
- Vendors and co-conspirators: If a vendor knowingly participated in the scheme ,a common pattern in billing fraud ,they can be named as defendants in your civil action
These claims are complex and require experienced legal counsel, but they can dramatically expand your total recovery, particularly in larger cases. Understanding the mechanics of how fraud investigators trace financial records is essential before pursuing third-party liability.
Your Recovery Checklist: The First 72 Hours
| Action | Why It Matters |
|---|---|
| Preserve all digital and paper evidence | Prevents destruction; forms the foundation of every legal strategy |
| Engage a forensic accountant | Quantifies the loss; produces expert documentation |
| Consult an attorney before confronting the employee | Protects you from counterclaims; positions you for leverage |
| Notify your insurer in writing | Starts the claims clock; preserves your right to coverage |
| Assess the employee’s assets | Determines which recovery paths are worth pursuing |
| Consider filing for a TRO or writ of attachment | Freezes assets before they disappear |
If you’re earlier in the process and still building your case, what to do if you suspect employee theft before confronting them is required reading before taking any action.
Frequently Asked Questions
Q: How quickly should I act after discovering embezzlement? The first 48–72 hours are critical. Assets can be moved, evidence can be destroyed, and co-conspirators can be alerted. Engage a forensic accountant and legal counsel immediately, secure all records, and do not confront the employee until you have legal guidance. Speed and discretion are your two biggest advantages.
Q: Can I fire the employee without involving the police? Yes. Termination is an employment decision separate from criminal reporting. Many organizations terminate first, investigate further, and then decide on criminal reporting based on the strength of evidence and recovery strategy. The full breakdown on firing someone for embezzlement without police involvement walks through this carefully.
Q: What if the employee has already spent the money? This is unfortunately common ,embezzlers often spend stolen funds as quickly as they take them. However, it doesn’t make recovery hopeless. Courts can still enter judgments that garnish future wages, place liens on property, or attach assets acquired after the theft. Criminal restitution orders, which cannot be discharged in bankruptcy, also remain enforceable indefinitely.
Q: Is it worth suing if the amount stolen was relatively small? It depends on the total cost of litigation versus recovery. For amounts below $10,000–$15,000, small claims court may be a more efficient option. For larger amounts, the calculus changes ,especially if a fidelity bond or co-conspirators are involved. A qualified attorney can help you analyze the cost-benefit quickly.
Q: How long does an embezzlement recovery case typically take? Civil cases typically resolve in 12–36 months depending on complexity, jurisdiction, and whether the defendant contests the claims. Criminal proceedings often run longer. Negotiated restitution agreements, when achievable, can produce results in weeks. For realistic timelines on fraud-related legal and investigative proceedings, see how long fraud investigations take.
Q: Can FraudOrder help with embezzlement investigations? Yes. FraudOrder provides professional fraud investigation support, including forensic document analysis, financial tracing, and investigative consulting ,all of which are foundational to building a successful recovery case. Visit fraudorder.co to discuss your situation confidentially.
References
- Association of Certified Fraud Examiners. (2024). Report to the Nations: Occupational Fraud and Abuse. https://www.acfe.com/report-to-the-nations/2024/
- U.S. Department of Justice. (2025). Fraud Section: Criminal Division. https://www.justice.gov/criminal/criminal-fraud
- FBI. (2024). White-Collar Crime: Embezzlement. https://www.fbi.gov/investigate/white-collar-crime
- Embroker. (2025). 70+ Employee Theft Statistics for 2025. https://www.embroker.com/blog/employee-theft-statistics/
- Axley Brynelson LLP. (2025). After Discovering Embezzlement, Have a Strategy for Obtaining Restitution. https://www.axley.com/publication_article/embezzlement-restitution/
- Bird Marella LLP / Daily Journal. (2025). From Discovery to Recovery: A Legal Roadmap for Employee Embezzlement Cases. https://www.dailyjournal.com/article/388400-from-discovery-to-recovery-a-legal-roadmap-for-employee-embezzlement-cases
- Stimmel Law. (2024). Embezzlement: The Tactics Allowing Successful Recovery. https://www.stimmel-law.com/en/articles/embezzlement-tactics-allowing-successful-recovery
- BDF Law Group. (2025). Litigation Can Help Companies Harmed by Employee Embezzlement. https://www.bdfgroup.com/blog/2025/01/litigation-can-help-companies-harmed-by-employee-embezzlement/
- FinancesOnline. (2025). 56 Relevant Employee Theft Statistics. https://financesonline.com/employee-theft-statistics/
- U.S. Chamber of Commerce Institute for Legal Reform. (2024). White-Collar Crime and Business Fraud Resources. https://www.instituteforlegalreform.com/
Disclaimer: This article is for informational and educational purposes only. It does not constitute legal, financial, or professional advice, and reading it does not create a client or attorney-client relationship. Every embezzlement situation is unique ,consult a qualified attorney, forensic accountant, or fraud investigation professional before taking action in your specific case. For questions about FraudOrder services, visit https://fraudorder.co/