Short answer: If you suspect an employee is defrauding your business, do not confront them yet. Quietly preserve the records, keep the circle small, take advice before you act, and let a structured investigation establish what actually happened. Most of the expensive mistakes are made in the first 48 hours.

Most owners discover internal fraud by accident — a supplier query that doesn't add up, a duplicate invoice, a number that feels wrong. The instinct is to walk down the hall and ask. That instinct is almost always the wrong first move.

Why confronting them first is the costly mistake

The moment a dishonest employee knows they are suspected, three things happen quickly: records get deleted, stories get aligned, and money moves. You lose your one real advantage, which is that they don't yet know you're looking. A premature confrontation can also expose you to an unfair dismissal or defamation claim if the suspicion turns out to be wrong or simply unprovable.

Step 1 — Write down what you already know

Before you touch anything, record what prompted the concern, when, and what you have seen with your own eyes: dates, amounts, documents, names. This becomes the spine of the investigation and stops the story drifting as emotions rise.

Step 2 — Preserve the records, don't “investigate” them

Do not start forwarding emails to yourself, printing files, or logging into someone's accounts. Handled carelessly, that can taint the very evidence you will later need. Instead, make sure nothing is lost: suspend routine data purges, keep your backups, and secure access to the systems involved. If a device or account may hold the answer, it should be forensically preserved before anyone opens it — a document's history can show when it was created or altered, but only if the file hasn't been trampled first. This is where digital forensics earns its place.

Step 3 — Control access without raising alarm

You can reduce risk without tipping anyone off. Review approval limits, require a second signature on payments, or reassign duties as part of a normal-looking change. The aim is to stop further loss while the picture is still forming.

Step 4 — Bring in the right people early

Involve your accountant or an independent investigator before the trail goes cold, and speak to an employment lawyer before you take any step that affects the person's job. Independent examination matters because your own review, however honest, is the first thing a court or opposing lawyer will attack.

Step 5 — Decide what outcome you actually want

Recovery, dismissal, a police referral, or simply making it stop — the outcome you want shapes the evidence you need. A matter you might hand to police has a different standard than an internal disciplinary process, and a civil claim to recover the money has different requirements again. Knowing the destination keeps you from gathering the wrong things.

What not to do

  • Don't confront the employee on a hunch.
  • Don't access their personal accounts or devices.
  • Don't delete, move or “tidy up” any files.
  • Don't discuss it widely across the office.
  • Don't promise outcomes you can't yet support.

Frequently asked questions

Can I check an employee's work computer myself?

You can generally examine records on company-owned systems, but how you do it matters. Simply opening files changes their metadata and can weaken their value as evidence. If the device may be central to the matter, have it preserved properly before it is examined.

Should I go to the police or investigate privately first?

It depends on the outcome you want. Police handle criminal conduct but won't recover your money; a private investigation can build the evidence for both a police referral and a civil claim. Many businesses do both, in the right order. See private investigator or police.

How long does a fraud investigation take?

Anywhere from a couple of weeks to several months, depending on the volume of records and how many people are involved. A focused scope keeps it shorter and cheaper.

This article is general information, not legal advice. If you suspect something and aren't sure what to do next, the safest first move is a quiet conversation before you act. Start a confidential conversation.