Your Most Trusted Employee Has the Bank Token: 6 Rules to Stop Embezzlement Before It Runs for Years

In December 2009, American Express contacted Michael Koss, chief executive of the Milwaukee headphones maker that carries his family's name. The message was simple and devastating: his vice president of finance was paying down her personal card with large wire transfers from a Koss bank account.

By the time the case reached a federal judge, the number was $34 million, taken over 12 years. Sue Sachdeva had bought so many clothes and so much jewelry that she rented storage units for the overflow, and many items still had their tags on. The company restated its financials, and Michael Koss told the court it had to cut employee pay and profit sharing. Annual audits had not caught it. A credit card company did.

Embezzlement rarely comes from a stranger. It comes from the person you stopped checking because you trust them. That is why the usual defense, "I know my people," is not a defense at all. It is the condition the fraud needs.

The numbers from the Association of Certified Fraud Examiners' Occupational Fraud 2026: A Report to the Nations, based on 2,402 cases in 143 countries, are worth reading slowly:

• Organizations lose an estimated 5% of annual revenue to occupational fraud.
• The median case costs $104,000 and runs 12 months before anyone notices.
• Frauds caught in the first six months have a median loss of $40,000. The 5% that run past five years have a median loss of $1.115 million.
• More than half of cases trace back to missing internal controls or to someone overriding them.

Our group has been in business since 1890 and runs eight active businesses today. If you operate that long and that widely, you stop asking whether someone will try this and start asking how quickly you would find out. Here are the six rules I would apply to any private or family company that wants the answer to be "quickly."

Rule 1: Control the exits, not just the front door

Koss had an approval rule. Invoices of $5,000 or more needed the CEO's sign-off. It sounds reasonable, and it protected almost nothing, because according to the SEC, Sachdeva and a colleague processed large wire transfers and cashier's checks outside the accounts payable system entirely.

A control that covers one payment channel simply moves the fraud to the next one. So list every way money can leave your company: bank wires, online transfers, checks, company cards, payroll, petty cash, refunds, and payment apps. Then ask who can use each one and who else sees it.

Next, split the four keys so that no single person holds them all:

• Authorize: who decides this payment should happen.
• Pay: who actually releases the money.
• Record: who books it in the ledger.
• Reconcile: who checks the books against the bank.

Nick Leeson could bring down Barings because he ran both the trading desk and the back office. We covered that case in our piece on who can sign what in a delegation of authority matrix.

Rule 2: Get the bank statements straight from the bank

Most owners read financial reports prepared by the same person who could be hiding something in them.

The cheap fix takes ten minutes a month. Give yourself or a trusted owner read-only online access to every bank account and go through the raw statements yourself. You are looking for payees you do not recognize, round-number transfers, and accounts you did not know existed.

The person who can move money should never be the person who reconciles the account. If your finance team is two people, have them split it. If it is one person, the owner or an outside accountant does the reconciliation and sees the original statement, not a printout or a summary.

Rule 3: Make everyone in finance take two weeks off

Rita Crundwell was comptroller of Dixon, Illinois, for nearly three decades. Over about two decades she stole $53.7 million from the small city, money that went largely into a champion horse-breeding operation. She explained budget shortfalls by saying the state was late with its payments, and people believed her.

It unraveled during her extended absence in the fall of 2011. City clerk Kathe Swanson, filling in as comptroller, came across a bank account she had never heard of and the checks written on it. What has been described as the largest municipal fraud in U.S. history ended because somebody else finally sat in the chair.

Most ongoing schemes need daily maintenance, and a person who never takes vacation may be doing exactly that. Require two consecutive weeks away for everyone who touches money, and have another person actually do the job while they are gone: open the mail, run the reconciliation, and answer the vendors.

The ACFE found that companies with job rotation or mandatory vacation policies had a median loss 49% lower than those without. Yet only 8% of organizations with fewer than 100 employees had them, against 32% of larger ones.

Rule 4: Audit by surprise, and start with the vendor list

Your annual audit is announced, scheduled and built to test whether the financial statements are materially right. It is not designed to find a theft, and anyone planning one knows exactly when it comes.

Surprise audits are different. In the ACFE data, they were associated with a median loss of $74,000 versus $149,000 without them, and detection in 8 months rather than 16. Only 16% of small organizations use them, compared with 52% of larger ones, which is exactly why a small company is such an easy target.

You do not need a forensic team. Pick one or two checks each quarter, unannounced:

• Compare vendor bank accounts and addresses against employee records.
• Look for vendors added recently with no contract and no purchase order.
• Sample ten expense reports and trace them to the original receipts.
• Confirm that everyone on payroll actually works there.

Then run simple searches for duplicate invoices, payments just under an approval limit, and entries posted at odd hours. Proactive data monitoring was associated with a 53% lower median loss in the ACFE study, and a spreadsheet is enough to begin.

Rule 5: Give people somewhere safe to tell you

Tips detected 43% of the frauds in the ACFE study, nearly three times as many as the next most common method. And 55% of those tips came from employees, the people who have noticed something odd for months and do not know who to tell, especially if the person they suspect sits close to the owner.

A formal reporting channel matters here. Organizations that had one saw a median loss of $100,000 and a duration of 11 months, against $150,000 and 17 months without it. Only 24% of small organizations have a hotline, compared with 85% of larger ones.

A small company does not need to buy a software platform. An email address that goes to an outside lawyer or an independent board member, published to staff and to vendors, does the job. The channel must not route through finance or through anyone who reports to the people it is meant to watch.

Train your managers on the behavior too. The ACFE reports that 84% of fraudsters displayed at least one behavioral red flag. Living beyond their means (39%) and financial difficulties (29%) lead the list, followed by unusually close relationships with vendors or customers. None of that proves anything, but together with an unusual payment it is reason to look.

Rule 6: Treat every urgent payment request as a fraud until a voice confirms it

Not every theft comes from inside. In January 2016, an employee at FACC, the Austrian aerospace supplier, wired about €50 million after receiving an email that appeared to come from the CEO. The company later took a €41.9 million charge. The finance chief went first, and in May the supervisory board dismissed CEO Walter Stephan after 17 years in the job.

The attacker needed no password to the bank, only an employee who would act on an instruction that seemed to come from the top. Your own seniority is the weakness in this scheme, so remove it in writing.

Set three rules everyone knows:

• Any new wire instruction or change of vendor bank details is confirmed by phone, using a number already on file, never one from the email.
• Two people release any payment above a set limit, and no exception is possible for urgency or confidentiality.
• Nobody is ever punished for slowing down a payment the CEO asked for, including when the CEO really did ask.

Then check your insurance. Standard property cover often leaves employee theft out, and social engineering losses may need specific wording in a crime policy. Our guide to private company risk transfer explains how to look for those gaps.

Key Takeaways

• Trust is not a control. Long tenure and loyalty are what give a fraud its time. The ACFE found that frauds grow more costly the longer the perpetrator has been with the organization.
• Map every exit for cash. An approval rule on invoices means nothing if wires and cashier's checks bypass it.
• Read the bank's statements, not the summary. Read-only access costs nothing and takes minutes.
• Force the vacation and fill the chair. Hidden schemes often break the moment someone else does the job.
• Check by surprise. Small companies use surprise audits a third as often as larger ones and pay for it.
• Give people a route around finance. Tips find more fraud than any other method.
• Require a voice for every new payment instruction. No rank should be able to skip that step.

Frequently Asked Questions

What are the warning signs of employee embezzlement?

The most common are behavioral: an employee living beyond their means, visible financial difficulties, unusually close ties to a vendor, and resistance to sharing duties or taking time off. In the books, look for unfamiliar payees, late or disorganized reports, payments just below approval limits, and reconciliations that always seem to be nearly done.

How do you separate duties in a very small business?

Use the owner as the second set of eyes. When one bookkeeper has to handle most tasks, the owner should approve new vendors, hold or release payments above a set amount, and review the original bank statements each month. Mandatory time off then adds another check that costs almost nothing.

What should you do if you suspect an employee is stealing?

Do not confront them or announce an inquiry, because that is how records disappear. Quietly preserve bank records, emails and system logs, then call your lawyer and a forensic accountant before anything else. Notify your insurer early, since crime policies usually have strict notice deadlines, and take legal advice on suspending access and reporting to the police.

Does business insurance cover employee theft?

Not automatically. Employee theft usually requires crime or fidelity coverage, either as a separate policy or as an endorsement, and limits are often lower than owners assume. Check the policy for exclusions, for how long you have to discover and report the loss, and whether email impersonation fraud is included.

In Summary

Michael Koss learned about a 12-year theft from a credit card company. Dixon, Illinois, learned about a two-decade theft because an official was away and somebody else finally did her job. Both organizations could have found out years earlier with controls that cost almost nothing. Set them up now, while it is still a boring administrative task and not an emergency. The people you trust will be fine with it. Honest people usually are.

To see how a group that has been building businesses since 1890 thinks about long-term discipline, learn more about Manzanos Enterprises.