Ask most executives how they expect to catch an embezzler and they will describe an audit: a sharp-eyed accountant, an unexplainable variance, a paper trail unraveling under scrutiny.

The data says otherwise. The ACFE’s Occupational Fraud 2026: A Report to the Nations analyzed 2,402 real cases across 143 countries representing more than $3.4 billion in losses. Tips remain the leading detection method at 43% of cases, nearly three times the next method, internal audit, at 15%. More than half of those tips came from employees.

Meanwhile the median loss per case sits at $104,000, the average scheme runs roughly 12 months before anyone notices, and organizations lose an estimated 5% of annual revenue to occupational fraud.

The uncomfortable conclusion: your most effective embezzlement detection mechanism is probably a person who noticed something, not a system that flagged something. Here is what the evidence says about how theft actually surfaces.

Tips Beat Technology, and It Is Not Close

For the fourteenth consecutive edition of the ACFE study, tips led every other embezzlement detection method. The channels have shifted, though, and organizations running a 2015 playbook are losing signal.

Current tip mechanisms break down roughly as follows:

• Web-based and online reporting now leads at about 46% of tips
• Email accounts for roughly 34%
• Telephone hotlines have fallen to about 23% and keep declining

That last figure deserves attention from any compliance officer whose whistleblower program is a phone number on a breakroom poster. The channel your people actually use has changed.

The gap by organization size is starker. Roughly 85% of large organizations maintain an established whistleblowing mechanism; only about 25% of small businesses do. The ACFE flags this as concerning given how central tips are to embezzlement detection. Small organizations also suffer the highest median losses of any size category, because they combine concentrated financial duties with the weakest reporting infrastructure.

The Behavioral Signals That Precede Discovery

Before a tip gets filed, someone usually notices something. The 2026 report found 84% of perpetrators displayed at least one behavioral red flag before detection, and those displaying flags caused higher median losses than those who did not.

Recurring signals, consistent across nearly two decades of ACFE data:

• Living beyond apparent means. The most frequently documented red flag in every edition since 2008.
• Known financial difficulties. Debt, divorce, medical costs, or gambling pressure.
• Unusually close vendor or customer relationships, especially when an employee insists on owning a specific account.
• Resistance to oversight or shared duties. Refusing reassignment, declining help, guarding processes.
• Control issues around information. Reluctance to let anyone else touch the books.

A critical caveat: these are risk indicators, not evidence. Plenty of employees carry financial stress and steal nothing. Treating a red flag as an accusation creates legal exposure and destroys morale. The correct response is heightened, documented, proportionate review. We covered this pattern in the five red flags that appeared in almost every fraud case we have worked.

The Structural Triggers That Force Exposure

Behavioral signals raise suspicion. Structural events force discovery. In practice, embezzlement detection happens when something disrupts the perpetrator’s exclusive control over a process.

The most common triggers:

1. Mandatory time off. When someone else touches the files, reconciliations that were never performed become obvious. Schemes needing daily maintenance cannot survive a two-week absence.
2. Personnel change. A new controller, a retirement, an acquisition. Fresh eyes without institutional deference ask the questions nobody else asked.
3. Independent reconciliation. Bank and vendor reconciliations performed outside daily operations. The highest-yield control we see, and how the scheme in the bookkeeper’s “mistake” that turned out to be theft came apart.
4. Vendor or customer complaints. A supplier calling about an invoice your ledger shows as paid is a serious signal.
5. Data analytics exceptions. Duplicate payments, round-dollar transactions, vendor addresses matching employee addresses, payments just under approval thresholds. One duplicate payment unraveled a six-figure fraud ring in a matter we worked.
6. Surprise audits. Predictable audit calendars are easy to work around. Unannounced reviews are not.

Notice how many are organizational habits rather than technology purchases. Effective embezzlement detection is mostly a design problem.

Why Trusted Employees Are the Blind Spot

The profile runs against intuition. The 2026 report found longer-tenured, college-educated employees are more likely to commit workplace fraud, and the distribution has shifted: employees and managers each accounted for 41% of cases, owners and executives 16%. Prior ACFE research consistently found roughly 87% of perpetrators had no prior fraud charges or convictions.

This is why background checks alone are weak embezzlement detection. Most perpetrators are first-time offenders whose screening came back clean because there was nothing to find. Tenure and trust created the access, and trust is not a control. It is the absence of one.

One more relationship worth internalizing: schemes caught early produce substantially lower losses than those running for years. Shortening your detection window is financially equivalent to preventing part of the loss outright.

What to Implement This Quarter

Practical steps, ordered by return on effort:

1. Stand up a web-based confidential reporting channel. Online reporting is now the dominant tip mechanism and tips detect 43% of fraud, making this the highest-yield embezzlement detection control available. Anonymous, and open to vendors and customers as well as staff.
2. Enforce mandatory time off of at least five consecutive business days for anyone with financial authority, duties genuinely reassigned.
3. Separate initiation, approval, and reconciliation. No individual controls all three for one transaction.
4. Assign monthly reconciliation to someone outside daily operations.
5. Run exception reports for duplicate payments, threshold-adjacent approvals, and vendor master file changes.
6. Schedule unannounced reviews at irregular intervals.
7. Document your escalation protocol before you need it. Who gets called, what gets preserved, who does not get told. Improvised responses destroy evidence and create liability.

Frequently Asked Questions

What is the most common way embezzlement gets discovered?

Tips, by a wide margin. The 2026 ACFE study attributes 43% of detection to tips, more than half from employees. Internal audit follows at 15%. An organization without an accessible reporting channel has disabled its most effective embezzlement detection tool.

Are behavioral red flags enough to justify an investigation?

No. Red flags indicate elevated risk, not wrongdoing, and treating them as proof creates defamation and employment law exposure. The appropriate response is enhanced review of transactions and documentation, conducted discreetly.

Why do small businesses get hit hardest?

Small organizations suffer the highest median losses because one person often handles multiple financial functions while only about a quarter maintain a whistleblower channel. Concentrated duties plus no reporting mechanism produces long embezzlement detection windows.

Should we confront the employee once we suspect theft?

Almost never as a first step. Premature confrontation triggers evidence destruction, account closures, and asset transfers. Preserve records and access logs first, consult counsel, and involve a qualified examiner before any interview.

Do we call law enforcement or a fraud examiner first?

Usually the examiner. Investigators preserve evidence properly, quantify losses to an evidentiary standard, and produce documentation that strengthens any later referral to law enforcement, insurers, or civil counsel.

Does insurance cover embezzlement losses?

Fidelity bonds and crime policies often do, but coverage typically requires prompt notice and documented proof of loss. Delayed reporting or informally handled investigations frequently complicate claims, another reason to formalize your response protocol in advance.

The Practical Takeaway

The evidence points somewhere uncomfortable for organizations that invested heavily in software and lightly in culture. The mechanism most likely to expose an embezzler is a colleague who noticed something and had a safe, easy way to say so.

Embezzlement detection is therefore only partly a technical problem. It is also a question of whether people believe reporting is safe, whether duties are separated enough that anomalies surface, and whether anyone ever reviews the work of your most trusted employee.

If you suspect fraud, or want an independent assessment of whether your controls would actually catch it, our team can help. Visit Fraud & Order for a confidential consultation, or review our approach to corporate embezzlement investigations.

References

1. Association of Certified Fraud Examiners. (2026). Occupational Fraud 2026: A Report to the Nations. https://www.acfe.com/fraud-resources/report-to-the-nations
2. Association of Certified Fraud Examiners. (2026). Key Findings: Occupational Fraud 2026. https://www.acfe.com/acfe-insights-blog/blog-detail?s=key-findings-report-to-the-nations-2026
3. Association of Certified Fraud Examiners. (2026). Press Release: 84% of Fraudsters Show at Least One Behavioral Red Flag. https://www.acfe.com/about-the-acfe/newsroom-for-media/press-releases/press-release-detail?s=occupational-fraud-2026-a-report-to-the-nations-pr
4. Association of Certified Fraud Examiners. The Six Most Common Behavioral Red Flags of Fraud. https://www.acfe.com/acfe-insights-blog/blog-detail?s=behavioral-red-flags-of-fraud
5. Federal Bureau of Investigation. White-Collar Crime. https://www.fbi.gov/investigate/white-collar-crime
6. U.S. Department of Justice. Justice News and Press Releases. https://www.justice.gov/news
7. Federal Trade Commission. Business Guidance. https://www.ftc.gov/business-guidance
8. The Institute of Internal Auditors. Fraud Resources and Guidance. https://www.theiia.org/
9. American Institute of CPAs. Forensic and Valuation Services. https://www.aicpa-cima.com/resources
10. U.S. Securities and Exchange Commission. Office of the Whistleblower. https://www.sec.gov/whistleblower

Disclaimer: This article is provided for general informational purposes only and does not constitute legal, financial, or professional advice. Reading it does not create a client relationship with FraudOrder. Every situation is unique, and organizations should consult qualified legal, financial, or fraud examination professionals before acting on any information presented here. For questions about FraudOrder services, visit https://fraudorder.co/