How Do You Know If Employee Theft Is Actually Happening?

The scale of the problem

Employee theft costs UK businesses an estimated £190 million per year, according to the Centre for Retail Research. But that figure only covers retail. When you include office environments, warehouses, construction sites and professional services, the real number is significantly higher.

Most employee theft goes undetected for months or years. The Association of Certified Fraud Examiners found that the median duration of occupational fraud is 12 months before discovery. By that point, the financial damage can be severe, and the evidence trail is often cold.

The challenge for business owners and managers is distinguishing between genuine concern and paranoia. Not every stock discrepancy is theft. Not every late-working employee is cooking the books. But ignoring consistent patterns is how small losses become catastrophic ones.

Warning signs you should not ignore

No single indicator proves theft. But clusters of these behaviours, especially when they appear together or intensify over time, warrant closer attention.

Financial irregularities

Unexplained stock shortages that do not correlate with sales figures. Cash register discrepancies that only occur on certain shifts. Invoices from suppliers you do not recognise. Write-offs or refunds that spike when specific employees are on duty. Expenses claims that seem high for the work described.

These patterns often emerge slowly. A warehouse losing £200 of stock per month barely registers. Over three years, that is £7,200, and in practice the real figure is usually much higher than what the records show because the person stealing knows which items are tracked and which are not.

Look for patterns in the timing and type of discrepancy. If stock losses increase during particular shifts, or if refunds cluster around specific tills or terminals, you have a starting point for investigation.

Behavioural changes

An employee who suddenly becomes defensive about their work area or processes. Someone who insists on handling certain tasks alone and resists delegation or oversight. Working unusual hours, particularly staying late or arriving early when the office is empty. Reluctance to take holidays (because their system depends on their presence).

None of these are conclusive on their own. Good employees sometimes prefer to work alone. But when defensive behaviour coincides with financial anomalies, the correlation deserves investigation.

Pay particular attention to employees who resist process changes or new systems. Fraudsters often build their methods around specific system weaknesses. When those systems change, their method breaks, which is why they push back against improvements that everyone else welcomes.

Lifestyle indicators

This is sensitive territory, and you should be cautious about drawing conclusions. But an employee whose visible spending seems significantly out of step with their salary, particularly if the change is recent, may be supplementing their income through the business.

We have investigated cases where warehouse staff were driving cars that cost more than their annual salary. In one case, a logistics coordinator had been diverting goods to a friend’s business for over two years before the pattern was spotted. The total losses exceeded £140,000.

System and access anomalies

Employees accessing systems or records outside their normal role. Unusual patterns in EPOS data. Stock movements that do not match delivery schedules. CCTV gaps that coincide with stock losses. These technical indicators often provide the first objective evidence that something is wrong.

Modern point-of-sale and inventory systems generate detailed audit trails. If you are not reviewing those logs regularly, you are missing one of the most reliable detection tools available. Many businesses install these systems but never use the reporting features that would flag anomalies.

What not to do

The temptation when you suspect theft is to confront the employee immediately. This is almost always a mistake, for several reasons.

You may be wrong

Accusations of theft are serious. If you are wrong, you face potential claims for constructive dismissal, defamation, or discrimination. Even if you are right, a premature confrontation gives the employee time to destroy evidence, coordinate stories with accomplices, or resign before you have built a proper case.

You need evidence, not suspicion

Employment tribunals and criminal courts require evidence, not hunches. A proper investigation documents the what, when, how and how much. Without this, you may know theft occurred but be unable to prove it or recover losses.

We have seen cases where employers knew exactly who was stealing but could not act because they had no documented evidence. The employee continued to steal for months while the employer tried to catch them through informal observation. A structured investigation would have produced admissible evidence within days.

Internal investigations have limits

Your HR team can conduct a disciplinary investigation, but they may lack the skills or tools for covert evidence gathering. They also have an existing relationship with the suspect, which creates both bias risks and the possibility that the investigation is compromised through office talk.

There is also the question of objectivity. An internal investigator may unconsciously seek to confirm or deny the suspicion rather than following the evidence wherever it leads. External investigators have no stake in the outcome beyond presenting the facts.

How professional investigators handle it

A corporate investigation by a firm like UKPI typically follows a structured process designed to build a clear, evidential picture without alerting the suspect.

Scoping and risk assessment

We start by understanding what you know, what you suspect, and what evidence already exists. This includes reviewing financial records, access logs, CCTV footage and any anomalies your team has identified. We assess the likely scale of the problem and agree a proportionate investigation plan.

This phase is critical. A poorly scoped investigation wastes money and may miss the real problem. We have been called in to investigate suspected warehouse theft only to discover that the real issue was procurement fraud by a different person entirely. Starting with a thorough assessment avoids these mistakes.

Covert investigation

Depending on the case, this might include surveillance of the employee’s activities during and outside work hours, analysis of financial patterns, review of company systems and records, and discreet enquiries with suppliers or customers. All activity is conducted within legal boundaries and documented to evidential standards.

Surveillance is particularly useful for cases involving physical theft (goods leaving premises) or collusion with external parties. We document the what, when, where and who of every relevant event, building a timeline that demonstrates the scale and method of the theft.

Reporting and recommendations

You receive a detailed report covering all findings, supported by evidence. We advise on next steps, which might include disciplinary proceedings, referral to the police, civil recovery action, or improvements to internal controls. If the case proceeds to court or tribunal, our investigators can provide witness testimony.

Legal considerations

Investigating an employee is legally permissible, but you must stay within the law. The key boundaries include data protection (you cannot install covert cameras in private areas), proportionality (the investigation must be proportionate to the suspected offence), and employment law (the employee retains their rights throughout).

Professional investigators understand these boundaries. DIY investigations by managers who install hidden cameras in toilets or access personal email accounts create legal liability for the employer, even if theft is proven. The evidence may be excluded from proceedings, and the employer may face counter-claims.

Pursuing recovery

When theft is confirmed, you have several options for recovering losses. Criminal prosecution through the police may result in a compensation order. Civil recovery allows you to sue the employee directly for the amount stolen. Some businesses use civil recovery specialists who negotiate repayment plans with the employee, often as an alternative to prosecution.

Your investigation report is the foundation for all of these options. Without documented evidence of what was taken, when, and how, recovery becomes difficult regardless of which route you choose. This is another reason why professional investigation, with its emphasis on evidential standards, pays for itself in the long run.

Prevention is cheaper than investigation

the best approach combines good internal controls with a willingness to investigate when things look wrong. Separation of duties so that no single person controls an entire process from order to payment. Regular stock audits with random timing. Access controls on financial systems. Clear expense policies with proper approval processes. An anonymous reporting mechanism for staff concerns.

These measures do not eliminate theft, but they make it harder to sustain and easier to detect early. The businesses that suffer the worst losses are almost always those with weak controls and a culture of trust that nobody tests.

When to call a professional

If you are seeing consistent patterns that your internal checks cannot explain, it is time to get professional help. The cost of a targeted investigation is almost always less than the cost of continued theft, and the evidence gathered gives you options, whether that is disciplinary action, criminal prosecution, or civil recovery.

Do not wait until you are certain. Certainty is what the investigation produces. What you need to justify starting an investigation is reasonable suspicion supported by objective indicators. If the numbers do not add up and the explanations do not convince you, that is enough.

The real cost of employee theft

The financial loss from the theft itself is often just the beginning. When employee theft is discovered, particularly if it has been ongoing, the consequences cascade through the business.

Management time is diverted from productive work to dealing with the investigation, disciplinary process, and aftermath. Staff morale suffers, particularly if the thief was well-liked or in a trusted position. Customers and suppliers may lose confidence if they learn about the theft. Insurance premiums may increase. And the cost of recruiting and training a replacement adds further expense.

There is also the question of systemic damage. If one employee has been stealing for months or years, what does that say about your controls? Often, addressing the theft means addressing the weaknesses that allowed it, which can involve major process changes, system upgrades, or restructuring of responsibilities.

For smaller businesses, the impact can be existential. A trusted employee who has been diverting funds over several years can drain a small business of its working capital. We have seen cases where the theft was not discovered until the business was in financial difficulty, and by then the recovery options were limited.

This is why early detection matters so much. The sooner you identify and stop the theft, the less damage it does. And the sooner you investigate, the better the evidence is likely to be.

Remember that most employees are honest. Investigation is not about assuming the worst of your workforce. It is about protecting your business, your honest employees, and your livelihood when the evidence suggests that something is genuinely wrong. Acting on that evidence is a responsibility, not an overreaction.

UKPI has conducted corporate investigations across the UK since 1997. We hold IAAR and UK-PSA accreditations and our investigators have backgrounds in law enforcement, corporate security and financial investigation. Call 0800 043 1754 for a confidential discussion.