Signs of Embezzlement in a Small Business: The Monthly Checks That Catch It
On this page
The most reliable signs of embezzlement in a small business are in the records, not in anyone's mood: a vendor nobody can describe, a payee whose bank details changed without a ticket, payroll that doesn't tie to the roster, or credits and write-offs that nobody approved. Behavior can tip you off, but it is a late and noisy signal. The owner's job is a short monthly review that makes those record-level signs visible within weeks instead of years.
That's the position this article takes. You don't need a forensic audit to protect a $3M firm. You need about 45 minutes a month, done by you, from documents your bookkeeper can't edit before you see them.
What the 2026 fraud data says about small firms
The Association of Certified Fraud Examiners (ACFE) publishes the largest recurring study of occupational fraud. Its Occupational Fraud 2026: A Report to the Nations covers 2,402 cases from 143 countries and territories. These are cases investigated by fraud examiners, so they skew toward frauds that were caught and were large enough to investigate. Read the figures as patterns, not as your odds.
Four findings matter for an owner-run business:
- Organizations with fewer than 100 employees had the highest median loss of any size band, $126,000, narrowly ahead of the largest organizations at $123,000. The ACFE itself notes that median losses didn't vary much by size. The difference is what the loss does: $126,000 is a far bigger share of a $3M firm's revenue than of a multinational's.
- The typical fraud ran 12 months before detection. Frauds caught in the first six months had a median loss of $40,000, while those running 7 to 12 months had a median loss of $100,000.
- Billing schemes showed up in 28% of small-organization cases, compared with 18% at organizations with 100 or more employees. Check and payment tampering showed up in 18% of small-organization cases versus 8% at larger ones.
- Lack of internal controls was the primary weakness in 33% of cases, override of existing controls in 19%, and lack of management review in 18%.
Put those together and the problem is clear. Small firms are hit by schemes that run through the payables and payment process, and the damage roughly scales with how long nobody looks.
Why behavior is the weakest alarm
The ACFE found that perpetrators showed at least one behavioral red flag in 84% of cases, and living beyond their means was the most common one, at 39%. That sounds useful until you try to act on it.
You can't fire a controller because she bought a boat. And the same report found that 16% of frauds happened with no behavioral red flag observed at all. Behavior is worth noticing. A refusal to take vacation, a bookkeeper who insists on opening the mail, or one employee who is unusually close to a vendor should prompt a closer look at the records. But the records are where you find out.
Here's the Bennett rule: treat behavior as a reason to run the checks early, never as a substitute for running them.
The six monthly checks that catch it
Each check below targets a scheme the ACFE data says is common in small organizations. Run them in this order. The first two take the longest the first month and get fast after that.
| Check | What you pull | What it catches | Time |
|---|---|---|---|
| 1. Bank statement scan | The bank's own PDF or portal view, not the bookkeeping export | Payments to unfamiliar payees, checks out of sequence, transfers to personal accounts | 10 min |
| 2. New and changed vendors | Vendor master change log for the month | Shell vendors, bank-detail changes, vendors sharing an employee's address | 10 min |
| 3. Payroll register to roster | Payroll register vs. your own headcount list | Ghost employees, unauthorized raises, extra off-cycle runs | 5 min |
| 4. Credit memos and write-offs | AR adjustments, credit memos, bad-debt entries | Skimmed receipts hidden as write-offs | 5 min |
| 5. Card and reimbursement detail | Card statements for every holder | Personal spending coded to supplies, meals, or software | 10 min |
| 6. Payroll tax deposits | EFTPS payment history | A payroll provider or employee diverting tax deposits | 5 min |
Check 1: Read the bank statement before the bookkeeper does
This is the single highest-value habit. Have statements delivered to you, or log into the bank portal yourself. Scan every payee over a threshold you pick (say, $1,000) and every check image. You aren't reconciling. You're asking one question per line: do I know who this is?
Check 2: Review every vendor added or changed
A billing scheme needs somewhere to send the money. That's usually a new vendor or an existing vendor whose remittance details were quietly changed. Ask your accounting system for the change log. If it can't produce one, that's a finding by itself. Compare new vendor addresses and bank accounts against your employee file.
Check 3: Tie payroll to people you can name
Count the people on the register. Compare it with the people you know work for you. Look for off-cycle runs and rate changes you didn't approve. Payroll schemes appeared in 13% of small-organization cases in the ACFE study.
Check 4: Look at what was written off
Skimming (taking customer receipts before they're recorded) shows up in 17% of small-organization cases versus 6% at larger firms. It often hides behind a credit memo or a "client dispute" write-off. Sort the month's adjustments by who entered them.
Check 5: Read the card detail, not the summary
Category totals hide personal spending well. The line detail doesn't. Expense reimbursement schemes appeared in 19% of small-organization cases in the ACFE study, against 10% at larger ones, so this check isn't a formality. Ten minutes across every cardholder is enough.
Check 6: Confirm payroll taxes actually reached the IRS
The IRS's guidance on outsourcing payroll duties is blunt: the employer remains ultimately responsible for depositing federal employment taxes even when a third party handles them. The IRS recommends that employers register for their own EFTPS PIN and periodically verify the payments. A missed deposit you never see becomes a penalty you pay.
Ran the six checks and found a payee nobody can explain, or a vendor change with no paper behind it? A Leak Check on unexplained payments helps you size how much cash is moving outside a controlled process before you decide whether this is a coding error or a call to your attorney.
A hypothetical: how $6,300 a month disappears
This example is hypothetical, built from realistic numbers.
A $4.2M marketing agency has a bookkeeper who has full access to accounting, the bank portal, and vendor setup. The owner reviews the P&L monthly and the balance sheet quarterly.
In March, a new print vendor is added (call it Vendor A). It bills about $6,300 a month, which happens to match the $6,300 median monthly loss, or "velocity," the 2026 ACFE report gives for billing schemes. The invoices are coded to "Production Costs," a line that runs $38,000 to $45,000 a month anyway.
| Test | Owner sees on the P&L | Owner would see on the six checks |
|---|---|---|
| Production costs | Up 15%, within normal range | New vendor added in March with no purchase order |
| Gross margin | Down about 1.8 points ($6,300 on $350,000 of monthly revenue) | Vendor address matches a P.O. box near the bookkeeper's home |
| Cash | Still within a normal band | ACH payee name doesn't match the invoice letterhead |
After 12 months the agency has paid $75,600. The P&L never looked wrong enough to trigger a question. The vendor change log would have shown it in the first month.
That's the point. A P&L tells you whether the business is profitable. It was never designed to tell you who got paid.
What changes when you find something
Don't confront anyone on the first odd line. Most anomalies have boring explanations: a vendor that changed banks legitimately, a refund that was coded badly. Ask for the supporting document the way you would for anything else.
If the answer doesn't hold up:
- Preserve the records. Export the vendor history, bank detail, and user access logs before anyone else touches them.
- Restrict access quietly. Remove the person's ability to add vendors or release payments without announcing why.
- Call your attorney and your insurance broker. Employee dishonesty coverage often has notice requirements, so check the policy.
- Bring in a forensic accountant if the amount is material. Your regular bookkeeper shouldn't investigate a colleague.
Then fix the control gap that let it happen. The ACFE found that 80% of victim organizations modified their anti-fraud controls after the fraud. The cheaper path is doing that first.
Where this fits with your finance team
These checks aren't a substitute for a working control design. They are the owner's layer on top of it. If one person can add a vendor, approve an invoice, and release the payment, the checks will catch fraud later than a better split of duties would have stopped it. Bennett's broader take on internal controls for growing businesses covers the design side, and bookkeeper red flags covers the competence side, which is a different problem from dishonesty.
When the owner's review starts taking more than an hour, or the firm has grown past a single bookkeeper, that's usually the point to add oversight. A fractional CFO can own the monthly review, set approval thresholds, and keep the vendor file clean without adding a full-time hire.
Your next step is one calendar block. Pick the business day after your bank statement closes, put 45 minutes on it, and run checks 1 and 2 this month. If either produces a name you don't recognize, preserve the records first, then use a Leak Check to work out which of your payment paths has only one set of eyes on it.
Frequently asked questions
Can an outside CPA's year-end tax work catch embezzlement?
Rarely. Tax preparation works from the books as recorded and isn't designed to test whether payees are legitimate. A shell vendor coded to a normal expense line looks deductible, not suspicious.
Which employees are most likely to embezzle from a small company?
The ACFE data points to access and tenure more than job title. Anyone who can both create a payee and release a payment has the means. That is why the checks focus on access to vendor setup and payment release rather than on personalities.
How much does small-business embezzlement typically cost?
In the ACFE 2026 Report to the Nations, organizations with fewer than 100 employees had a median loss of $126,000, narrowly the highest of any size band (the largest organizations were at $123,000). These are investigated cases, so treat the figure as a pattern rather than a prediction, and remember the same dollar loss hits a small firm's revenue far harder.
Should I tell staff that I review the bank statements myself?
Yes. Visible owner review raises the perceived chance of detection, which is part of what makes it work. You don't need to announce what you look for, only that someone outside the bookkeeping process looks every month.
Is a bookkeeper who refuses vacation a sign of fraud?
It's a reason to look, not proof. Some people simply don't take time off. Use it as a trigger to run the vendor and bank checks early, and consider requiring a week away during which someone else handles payables.
What should I do first if I suspect someone is stealing?
Preserve records and restrict access quietly before saying anything. Export vendor history, bank detail, and user logs, then speak with your attorney and insurance broker before confronting the person.
Does employee theft insurance cover embezzlement losses?
Employee dishonesty or crime coverage may, but policies carry limits, exclusions, and notice deadlines. Read the policy and notify the broker promptly once you have reason to believe a loss occurred.
How long does the monthly owner review take once it's routine?
About 45 minutes in this framework. The bank scan and vendor change review take longest the first month and shrink once you know your normal payees.