The most costly element of employee theft is not the amount stolen on a single day. It is the months that pass before anyone recognizes that theft is occurring at all. According to the Association of Certified Fraud Examiners’ 2024 Report to the Nations, the median occupational fraud scheme runs for 12 months before detection. During that window, losses accumulate, evidence degrades, and the legal complexity of the eventual investigation grows. California employers who understand the signs of employee theft are positioned to act earlier, investigate more effectively, and limit both financial and legal exposure.
This article identifies the behavioral, financial, and operational red flags that signal potential internal theft, explains why each indicator matters under California employment law, and outlines when a pattern of warning signs warrants moving from observation to formal investigation.
Most employers want to believe in their workforce. That inclination toward trust is not a weakness. It is appropriate and necessary for any functioning organization. The problem arises when trust prevents managers from registering observable anomalies that, taken together, indicate something is wrong.
The ACFE reports that 85 percent of workplace fraudsters display at least one behavioral red flag before their conduct is discovered. The issue is not that warning signs are absent. They are rationalized away, dismissed as coincidence, or avoided because confronting them feels invasive. In the investigation context, this tendency has a name: confirmation bias. Managers filter observations through the assumption that a trusted employee would not steal, which causes them to discount the very data that would prompt appropriate inquiry.
Over more than 20 years conducting workplace investigations in California, Kathie Allen of Allen Morris Investigations has observed this pattern consistently. In nearly every employee theft case she has been retained to investigate, someone in the organization noticed something early: an unexplained cash shortage, a change in an employee’s demeanor, an anomaly in a report. They did not act because the signal did not seem conclusive on its own. The purpose of recognizing red flags is not to accuse anyone. It is to know when a pattern has formed that justifies a closer, structured look.
An employee who begins displaying financial indicators significantly above their salary level (a new luxury vehicle, designer purchases, an expensive vacation) without a corresponding promotion, raise, inheritance, or other identifiable income source warrants attention. This red flag, cited in the ACFE’s fraud research as one of the most reliable behavioral indicators, does not constitute evidence. It constitutes a question that deserves an answer.
The key is change. An employee who has always lived modestly and then makes a conspicuous shift is different from an employee who has consistently had outside income. Context matters, and no single observation should be treated as proof of anything.
Employees engaged in ongoing theft schemes often become territorial about specific processes. They resist cross-training colleagues, refuse to let others cover their responsibilities, or find reasons to delay or avoid mandatory vacations. This behavior is not accidental. Schemes that require daily maintenance collapse when someone else performs the same function for even a brief period. Organizations that mandate vacation time and cross-training as standard practice expose long-running fraud that would otherwise remain invisible.
An employee who routinely arrives significantly earlier or stays significantly later than their role requires, particularly one who works in relative isolation, may be using that unsupervised time to access accounts, remove inventory, or manipulate records. This is particularly relevant in accounting, finance, and inventory management roles where access to systems is unrestricted during off-hours.
When a manager asks a standard question about a transaction, a variance, or a process, and the employee responds with deflection, irritation, or excessive justification, that response pattern is worth noting. Employees who are not engaged in misconduct generally answer procedural questions without emotional investment. Those who are concealing something often treat routine inquiry as a threat.
Unreconciled bank statements, duplicate payments to vendors, unexplained credits or refunds, invoices from vendors that cannot be verified, or consistent variances between expected and actual cash totals are among the most objective indicators available. One unexplained discrepancy may be an error. A pattern of them is a red flag that demands investigation.
Kathie Allen has noted in her investigation work that financial discrepancies are frequently the entry point into a case. An accounts payable clerk running a report notices something that does not add up, brings it to management, and what follows is the discovery of a scheme that had been operating for months or years. Financial controls and regular audits are not merely administrative hygiene. They are the infrastructure that makes detection possible.
Shrinkage that cannot be attributed to customer theft, damage, or vendor discrepancy, particularly when shortages correlate with specific employees, shifts, or locations, is a reliable operational signal. Employers in retail, food service, manufacturing, and distribution should track shrinkage with enough granularity to identify whether patterns align with specific personnel schedules.
When a vendor states that invoices have not been paid despite the company’s records showing payment, or when a customer reports making a payment that does not appear on the company’s books, the explanation may be that funds are being intercepted before they reach the intended account. These third-party signals are particularly valuable because they originate outside the organization and are therefore harder for an internal actor to suppress.
Financial records, inventory logs, expense reports, or time records that are habitually incomplete, inconsistently maintained, or subject to unexplained revision are operational red flags. In an investigation, documentation gaps are often the most significant finding. They indicate either that records are being manipulated or that controls are insufficient to detect manipulation.
Recognizing warning signs is the first step. The second step, acting on them, carries legal obligations that California employers cannot afford to mishandle.
California Labor Code sections 221 through 224 prohibit employers from withholding wages from employees on the basis of suspected theft, regardless of how strong the evidence appears. Taking a deduction from an employee’s paycheck before an investigation is complete and a determination has been made is a wage and hour violation, not a remedy.
Additionally, accusing an employee of theft, whether verbally, in writing, or through termination language, before a proper investigation has been conducted exposes the employer to defamation liability if the allegation cannot be substantiated. The California Supreme Court and lower courts have recognized claims arising from premature or unfounded theft accusations made in the employment context.
The appropriate sequence is: observe, document, consult legal counsel, and investigate. Red flags are not conclusions. They are the threshold that justifies a structured, confidential inquiry conducted by a qualified and neutral investigator.
How many red flags should an employer observe before opening an investigation?
There is no fixed threshold. A single, highly specific financial discrepancy such as a payment that cannot be traced to any legitimate transaction may be sufficient. A cluster of behavioral signals without a financial anomaly may warrant monitoring before formal inquiry begins. The standard is whether a reasonable person, aware of all observations, would conclude that an investigation is warranted.
Can an employer monitor an employee suspected of theft without their knowledge?
California law imposes significant restrictions on workplace monitoring. Employers may generally monitor activity on company-owned systems with appropriate notice. Covert surveillance of employees requires careful legal analysis, particularly regarding Cal. Penal Code section 637.7 and related statutes. Employers should consult legal counsel before implementing any monitoring program targeted at a specific individual.
Does a tip from another employee count as sufficient basis to investigate?
Tips are the most common detection method for occupational fraud. The ACFE reports that 43 percent of cases are initially surfaced through employee tips. A credible, specific tip is a legitimate basis for opening a preliminary inquiry, though it does not constitute evidence of the underlying conduct.
What is the risk of doing nothing when warning signs are present?
The primary risks are continued financial loss, evidentiary degradation (records may be altered or destroyed), and potential liability if the employer is later found to have had notice of misconduct and failed to act. California courts have recognized employer liability for failure to investigate known misconduct in certain contexts.
When should an employer involve an outside investigator?
External investigation is appropriate when the suspected individual is in a position of authority, when internal HR has a conflict of interest, when the potential financial exposure is significant, or when the matter may result in termination or legal action. A licensed California private investigator with workplace investigation experience brings both neutrality and legal defensibility to the process.
The signs of employee theft are rarely dramatic. They accumulate: a behavioral shift here, a financial variance there, a third-party complaint that does not quite fit the official record. California employers who learn to recognize these signals early, document what they observe, and engage qualified professionals when a pattern emerges are measurably better positioned than those who wait for certainty before acting.
If you have observed warning signs that concern you and are unsure whether an investigation is warranted, Allen Morris Investigations provides confidential consultations for employers throughout Orange County and California. Contact us to discuss your situation with a licensed, neutral workplace investigator.
For a complete step-by-step guide to the investigation process itself, read our practical guide to investigating employee theft.
About Kathie Allen
Kathie Allen is a licensed California Private Investigator (PI 27033) with over 20 years of experience conducting workplace investigations throughout Orange County and California. She is an Association of Workplace Investigators (AWI) trained investigator and Certified Title IX Investigator specializing in harassment, discrimination, employee misconduct, and Title IX compliance investigations for businesses, schools, and organizations.
Contact Allen Morris Investigations:
• Phone: 949-573-4624
• Email: Kathie@allenmorrispi.com
• Website: https://allenmorrispi.com
Schedule a consultation or learn more at Allen Morris Investigations.
Your email address will not be published. Required fields are marked *
Comment *
Name *
Email *
Website
Save my name, email, and website in this browser for the next time I comment.
Post Comment
Δ
