What to Do When an Employee Is Stealing or Committing Fra…

Finding out an employee has been stealing from you, money, client data, company photos, or billing for services never rendered, is one of the most disorienting things that happens to a small business owner. The instinct is to confront them immediately. That instinct is usually wrong.

How you handle the next 48 hours shapes everything, whether you can recover anything, whether your termination is defensible, whether they can make a claim against you, and whether you have the documentation to pursue legal remedies.

This guide walks through the process for business owners.

Step One: Preserve the Evidence Before You Do Anything Else

Before you confront the employee, before you tell anyone else on your team, before you change access passwords, preserve what you have.

Physical evidence, Secure cash handling records, logs, or surveillance footage. Don’t let anyone handle the cash drawer or access the records until you have copies.

Digital evidence, Take screenshots. Export transaction records. Download log files. Save emails. Note what access the employee has before you change it.

Surveillance footage, Download relevant footage immediately. Many systems overwrite on a rolling basis.

Third-party records, If fraud involves insurance billing, client transactions, or vendor relationships, contact relevant parties for records before the employee can interfere. A healthcare practice discovered an employee had been billing insurance for services that were never rendered, the evidence was in insurance company records and the practice management system. All of it needed to be preserved before termination.

Step Two: Consult an Attorney Before Confronting

Before the termination conversation, you need to know:

• Whether the conduct clearly supports termination for cause
• Whether any protected activity could complicate the termination (open workers’ comp claim, recent complaint, etc.)
• Whether you have a civil recovery option (theft, conversion of property, breach of fiduciary duty)
• Whether law enforcement involvement makes sense
• Whether there’s a counterclaim risk

A retail food service business discovered an employee caught on camera accessing the cash register and computer without authorization, then walking off when confronted. That employee had a history of prior legal claims. Knowing that context before the termination meeting is worth something.

Step Three: Terminate Cleanly

Once evidence is documented and you’ve thought through the legal picture:

• Have a witness present
• State clearly that employment is being terminated effective immediately
• State the reason simply: “We have documented evidence of [specific conduct].”
• Don’t debate or negotiate
• Collect company property if it can be done without confrontation
• Don’t threaten criminal prosecution in the meeting, that’s for your attorney

Document the termination meeting contemporaneously: who was present, what was said, what property was collected, what time the employee left.

Step Four: Revoke Access Immediately

• Revoke all system access (email, POS, scheduling, banking, cloud storage)
• Change passwords the employee may have known
• Revoke access to third-party platforms (insurance portals, vendor accounts, social media)
• Change locks or access codes if applicable

Step Five: Address the Property and IP Problem

Proprietary photos, marketing assets, and internal methods should be treated as company property. If a former employee uses those materials in a competing business, a cease and desist letter is usually the first step.

Client lists and contact records may qualify for trade secret protection when you have treated them as confidential through access controls, confidentiality agreements, and documented internal safeguards.

Step Six: Address Financial Recovery

Criminal reporting. Many forms of employee theft or fraud can be reported to law enforcement. A criminal case may also support restitution.

Civil recovery. Depending on the facts, you may have claims for conversion, fraud, or breach of duty. The practical question is whether recovery is collectible.

Insurance. Some policies include employee dishonesty or crime coverage. Notify your carrier promptly if you suspect a covered loss.

Billing fraud recovery. If false billing occurred, early corrective action and repayment planning can reduce downstream enforcement risk.

Final Paycheck: Theft Doesn’t Change the Timeline

Even when termination is for cause, final-pay rules still apply. You generally cannot withhold earned wages as leverage for suspected theft or unreturned property.

Pursue recovery through separate legal channels while complying with wage-payment deadlines.

Protecting Yourself From a Counterclaim

Unemployment claims. You will need documentation showing willful misconduct, dishonesty, or deliberate rule violations.

Wage claims. Pay earned wages on time even in serious misconduct cases. Creating a separate wage violation weakens your position.

Free Resource

Browse our Small Business Employment Resources →

Covers termination procedures, documentation basics, final-pay compliance, and when to get legal help before you act.

When Something Has Gone Wrong

Surge Business Law represents employers. For acute situations, a same-day consultation is often worth scheduling. Our Momentum Membership gives you ongoing access for $95/month.

Schedule a consultation →