Short answer: Internal fraud rarely looks dramatic. The common warning signs are an employee who won't take leave, who guards their work, whose lifestyle outpaces their salary, and a cluster of small accounting irregularities that never quite resolve. Any one can be innocent; several together deserve a closer look.
Occupational fraud is usually committed by long-serving, trusted staff — the person you would least suspect. That trust is exactly what makes it work, and it is why the signs are so easy to explain away.
Behavioural red flags
- Never takes leave. A scheme often needs constant tending. An employee who refuses holidays or works through illness may be avoiding the moment someone else covers their desk.
- Guards their role. Reluctance to hand over tasks, share logins, or be audited — dressed up as diligence — can be control of the very process being abused.
- Lifestyle beyond the salary. New car, renovations, holidays that don't square with the pay. Rarely proof on its own, but a common thread.
- Unusually close to a supplier. A vendor relationship that feels personal, or a supplier only one staff member ever deals with.
Financial and process red flags
- Suppliers you can't verify. Vendors with no website, a PO box, or bank details that were changed recently.
- Round-number or just-under-limit payments. Amounts that sit neatly below the level that would need a second approval.
- Duplicate or slightly altered invoices. The same invoice paid twice, or numbers that don't match the goods received.
- Rising costs with no explanation. Margins slipping while volume holds steady.
- Missing or “lost” documentation. Records that can never be produced when queried.
Why one red flag is not proof
Every sign above has an innocent explanation. Plenty of dedicated employees hate taking leave and plenty of people come into money honestly. The danger runs both ways: ignore a genuine pattern and the loss compounds; accuse someone on a single flag and you may be facing a defamation or unfair dismissal problem of your own. What matters is the cluster, and what the records show when someone looks properly.
What to do if several boxes are ticked
Don't act on the checklist alone, and don't confront anyone yet. Preserve the relevant records, keep the concern to a very small group, and get an independent view of the numbers before you form a conclusion. The point of quiet, early examination is to either clear the person or establish the facts on evidence that will still stand up later. See our guide on how to investigate suspected employee fraud without tipping them off.
Frequently asked questions
What is the most common sign of employee fraud?
Reluctance to take leave or to let anyone else touch the work is one of the most reliable behavioural indicators, because many schemes require the person to be present to keep them hidden.
How common is internal fraud in small business?
Smaller businesses are disproportionately affected, largely because they have fewer separation-of-duties controls — one trusted person often raises, approves and pays. That concentration of control is the vulnerability.
Can I accuse an employee based on red flags alone?
No. Red flags justify a careful look, not an accusation. Acting without evidence risks the fraud continuing and exposes you to legal claims. Establish the facts first.
This article is general information, not legal advice. If a few of these are ringing true, it's worth a quiet, confidential conversation before you do anything. Get in touch.