suspect accountant is stealing
,

The call comes when you’re least expecting it. Your bank balance doesn’t match your records. A vendor invoice looks off. A refund appears that nobody in your office can explain. You pull the thread and suddenly you’re staring at something that looks very much like your accountant has been stealing from you.

This is not a rare scenario. Finance and accounting departments are involved in roughly 12% of all occupational fraud cases, making them the second highest risk business unit according to ACFE data. More sobering: the median loss from fraud committed by employees in financial roles is significantly higher than fraud committed by other staff, and 85% of perpetrators showed no prior disciplinary history meaning the person you trusted most gave you the fewest warning signs.

What you do in the first 48–72 hours after suspecting your accountant is stealing will determine whether you recover your money, build a legal case, or inadvertently destroy the evidence you need. Here is exactly what to do.

Step 1: Do Not Confront Secure Everything First

This is the hardest instruction for most business owners to follow, and the most important one: do not confront your accountant until you have secured your records and spoken to legal counsel.

Confrontation before evidence is locked down is one of the most common and costly mistakes owners make. The moment a fraudster suspects they’re under scrutiny, they have a window to delete files, alter records, move money, or build a cover story. That window closes the instant you say nothing and act quickly to preserve your records.

Your first move is to lock down access:

  • Change passwords to accounting software, banking portals, and any financial platforms the accountant controls but do so carefully and simultaneously to avoid alerting them
  • Preserve your accounting files, bank statements, payroll records, vendor invoices, and email records in their current state do not allow anyone to delete or edit transactions
  • Freeze deletion rights in your accounting system if your software supports it
  • Download and save electronic bank statements directly from your bank’s portal, independent of any records your accountant may have maintained

The principle here is simple: a thief can lie, but records leave fingerprints. Your job in the first hours is to protect those fingerprints. Comprehensive guidance on what to do before confronting a suspected employee walks through this in more detail.

Step 2: Consult an Attorney Before You Do Anything Else

Before you investigate, fire anyone, or contact law enforcement, speak with an attorney ideally one experienced in business litigation or white collar crime. This is not bureaucratic caution. It protects you from multiple simultaneous risks:

  • Attorney client privilege can shield your investigation communications and findings from disclosure if the case goes to litigation
  • An attorney can advise whether to engage forensic professionals under privilege, which strengthens the legal protection over their work product
  • Wrongful termination exposure is real if you fire your accountant before the facts are established acting on suspicion without documentation creates legal risk
  • Your attorney can guide whether and when to contact law enforcement, which affects how any criminal case proceeds

This step happens before the investigation formally begins, not after. The sequence matters legally.

Step 3: Hire a Forensic Accountant to Investigate

Once counsel is in place, the next step is bringing in a forensic accountant a specialist trained to examine financial records for evidence of fraud, trace stolen funds, and document findings in a format usable in court.

This is not the same as having your regular CPA take another look. Forensic accountants apply investigative techniques transaction analysis, pattern detection, timeline reconstruction to determine exactly what happened, how much was taken, and over what period. Their findings become the evidentiary foundation for any civil or criminal action.

What a forensic accountant does in an embezzlement investigation:

  • Reviews accounting records, bank statements, and transaction histories in granular detail
  • Identifies patterns consistent with fraud: duplicate payments, vendor anomalies, unauthorized transfers, falsified expense reports
  • Traces where stolen funds went and whether recovery is possible
  • Assists in preserving digital evidence and may coordinate with computer forensic specialists
  • Produces a formal report usable by law enforcement and in court proceedings

Understanding what a forensic accounting investigation actually looks like step by step can help you set realistic expectations about timeline and process.

Step 4: Understand What You’re Actually Looking For

When you suspect your accountant is stealing, it’s tempting to search for “the smoking gun.” In practice, fraud evidence is usually a pattern not a single transaction. Forensic investigators are trained to find these patterns in financial data that looks normal at first glance.

The most common schemes used by accountants and bookkeepers in positions of trust include:

  • Check tampering: altering payee information on legitimate checks or creating unauthorized checks
  • Billing fraud: creating fictitious vendor invoices or inflating legitimate ones
  • Payroll manipulation: adjusting salaries, adding ghost employees, or falsifying hours
  • Skimming: intercepting cash or payments before they’re recorded
  • Expense reimbursement fraud: submitting false or inflated expense claims

Bank statements carry more evidence than most business owners realize transaction sequences, payee patterns, and timing anomalies can all reveal manipulation that would be invisible to a casual review. Similarly, expense report fraud is among the schemes most consistently exploited by employees with financial access.

The 2024 ACFE report found that fraud perpetrators who had been with their organization for more than six years caused significantly higher losses than shorter tenured employees in part because established trust translates into reduced oversight. If your accountant is long tenured, that’s a risk factor, not a protection.

Step 5: Make the Decision on Termination and Law Enforcement Carefully

Once your forensic investigation has documented what occurred, two decisions require deliberate handling: whether to terminate, and whether to involve law enforcement.

On termination: You can fire someone for embezzlement without going to the police, but the process must be done correctly. Termination before the investigation is complete risks destroying evidence or creating wrongful termination exposure. Termination after documented findings, with legal counsel present, is a very different situation. Your attorney should guide both the timing and the language used.

On law enforcement: Reporting to law enforcement is not always the first step or the best one, depending on your goals. Civil recovery (suing to reclaim stolen funds) and criminal prosecution are separate tracks with different standards of proof and different timelines. Many business owners pursue civil action first or simultaneously because criminal prosecution doesn’t guarantee you’ll recover your money. For a clear breakdown, see our guide on your legal options for recovering money from an embezzling employee.

Check your insurance. Many businesses carry fidelity bonds or employee dishonesty coverage that may cover losses from accountant fraud. Review your policy before assuming the loss is unrecoverable, and notify your insurer according to the policy’s reporting requirements.

Step 6: Rebuild Your Controls After the Fact

Once the immediate situation is addressed, you have a second, equally important job: making sure it can’t happen again. Accountant fraud almost always exploits specific control gaps sole access to financial accounts, no independent review of transactions, or an absence of reconciliation oversight.

The time to identify and close those gaps is immediately after an incident, when the vulnerabilities are visible. A forensic accountant can assist with internal control recommendations as part of their engagement. You might also want to understand the hidden costs of embezzlement beyond the direct financial loss reputational damage, operational disruption, and the cost of rebuilding trust all add up.

For prevention going forward, our post on 10 red flags your accountant might be embezzling gives a practical framework for ongoing monitoring.

Conclusion: Act Methodically, Not Emotionally

Finding out your accountant has been stealing is a deeply personal betrayal on top of a financial crisis. The instinct to act immediately and decisively is understandable but the right response in this situation is methodical, not reactive.

Secure your records. Call an attorney. Engage a forensic accountant. Document everything. And make decisions about termination and law enforcement only once you have the facts established and legal counsel guiding the process. The business owners who recover most effectively are the ones who treat this as an investigation, not a confrontation and who build the controls afterward to ensure it doesn’t happen twice.

Frequently Asked Questions

1. How do I know if my accountant is actually stealing or if there’s just an accounting error? Patterns matter more than individual transactions. Errors tend to be random; fraud tends to show consistent patterns the same vendor repeatedly overpaid, transfers to new accounts without business justification, or expenses just below approval thresholds. A forensic accountant can distinguish between innocent errors and deliberate manipulation by examining the full transaction history rather than isolated entries.

2. Should I confront my accountant directly first? No. Confrontation before evidence is secured is one of the most damaging mistakes a business owner can make. An alerted fraudster has a window to delete records, alter transactions, or move funds before you’ve documented anything. Secure your records and consult an attorney first every time.

3. How long do embezzlement schemes typically go undetected? Longer than most owners expect. According to ACFE data, the median duration of occupational fraud before detection is around 12 months, and accountant level fraud with minimal oversight can run significantly longer. See our guide on how long embezzlement can go undetected for more detail.

4. Can I recover the money that was stolen? Possibly and often more than people realize. Recovery options include civil lawsuits against the perpetrator, claims under fidelity bonds or employee dishonesty insurance policies, and criminal restitution orders if the case results in a conviction. How much you can realistically recover depends on whether assets can be traced, the fraudster’s financial position, and how quickly you act to preserve evidence.

5. Do I have to report accountant theft to the police? You’re generally not legally required to report employee theft to law enforcement, though some industries have regulatory reporting obligations. The decision involves trade offs: criminal prosecution can result in restitution orders but doesn’t guarantee financial recovery, while civil action may offer faster access to damages. Your attorney can help you evaluate which path or combination fits your situation.

6. What evidence do I need to prove my accountant stole from me? The strongest cases combine financial records (bank statements, accounting files, invoices, payroll records) with documentation of the patterns those records reveal. Direct evidence like a check made out to the accountant’s personal account is ideal but not always available. Courts have consistently recognized that circumstantial financial evidence can prove embezzlement, and forensic accountants are trained to build that case. See our post on how to prove embezzlement without direct evidence for a step by step breakdown.

References

  1. Association of Certified Fraud Examiners (ACFE). (2024). Occupational Fraud 2024: A Report to the Nations. https://www.acfe.com/about the acfe/newsroom for media/press releases/press release detail?s=2024 Report to the Nations
  2. GRF CPAs & Advisors. (2024). ACFE Study Finds Median Losses from Occupational Fraud Increasing. https://www.grfcpa.com/resource/acfe study occupational fraud/
  3. Embroker. (2025). 70+ Employee Theft Statistics for 2025. https://www.embroker.com/blog/employee theft statistics/
  4. Fuller Landau LLP. (2025). When You Suspect Fraud: How a Forensic Accountant Can Help. https://fullerllp.com/blog/forensic accounting/you suspect fraud how a forensic accountant can help with your investigation/
  5. StoneTurn. (2025). Forensic Accounting Skills in Investigations. https://stoneturn.com/insight/forensic accounting in investigations/
  6. CFO Share. (2022). What Are the Three Procedures of Forensic Accounting? https://cfoshare.org/blog/what are the three procedures of forensic accounting
  7. Hovland Forensic & Financial. (2025). Forensic Accounting: The Ultimate Guide. https://hovlandforensic.com/forensic accounting the ultimate guide/
  8. Marketing Scoop. (2024). 17 Employee Theft Statistics You Don’t Want to Miss. https://www.marketingscoop.com/blog/17 employee theft statistics you dont want to miss in 2024/
  9. Bookkeeping and Accounting Inc. (2026). Forensic Accounting Fraud Investigation: A Guide for SMBs. https://www.bookkeepingandaccountinginc.com/forensic accounting fraud investigation/
  10. Federal Bureau of Investigation (FBI). (2024). Financial Crimes   Fraud and Embezzlement. https://www.fbi.gov/investigate/white collar crime

Disclaimer: This article is provided for informational and educational purposes only. It does not constitute legal, financial, or professional advice, and no client or professional relationship is created by reading it. Laws governing fraud, evidence preservation, and employment vary by jurisdiction. Always consult a qualified attorney, forensic accountant, or licensed professional for guidance specific to your situation. For questions about FraudOrder services, visit https://fraudorder.co/