To catch a thief at work without creating a bigger legal problem than the theft itself, build a documented evidence file first — quietly, methodically, and within the rules on surveillance and questioning — and only then move to interviews, suspension, termination, or a police report. A rushed accusation without proof can expose your business to defamation, false imprisonment, or wrongful-termination claims that cost more than what was stolen.
Start With Documentation Before You Act
The moment you suspect something is missing, write three things down: when the item was last confirmed present, when you noticed it was gone, and every person with physical access to the area during that window. Pull badge-swipe logs, sign-in sheets, and electronic access records right away. Digital logs often sit on short retention cycles and can be overwritten within days.
Describe what was taken in as much detail as you can: serial numbers, cash denominations, lot numbers from shipping manifests, model numbers. Put all of this in a written incident report the same day. Notes made at or near the time of an event carry far more weight in court than testimony recalled weeks later. If your company has a standard HR incident form, use it. If not, a dated memo with the facts above does the same work. What you want is a contemporaneous record — one created while events are still fresh — that can anchor everything you do next.
Preserve Evidence So It Holds Up Later
Any physical evidence you collect needs a clear chain of custody or it may be worthless in court. Chain of custody means you can account for who handled the item, when, and how it was stored at every step. The National Institute of Justice recommends logging where the item was found (with a photograph if possible), packaging it so its condition is preserved, and making a log entry each time anyone handles it.1National Institute of Justice. A Chain of Custody: The Typical Checklist
When evidence passes from one person to another — say, from a manager to HR to an outside investigator — each handoff should be receipted in writing. The Department of Labor’s guidance on evidence preservation emphasizes that whoever holds the evidence must be able to confirm it has not been altered or tampered with since it was collected.2U.S. Department of Labor. Collection and Preservation of Evidence Digital evidence — camera footage, access logs, email records — should be copied to a separate, write-protected drive and documented the same way.
Use Surveillance and Records Within Legal Limits
Cameras and computer logs often produce the most objective evidence, but federal and state law limits how you can collect them. Getting this wrong makes the evidence unusable and creates its own liability.
Video in Common Areas
Employers can generally record video in open work areas — sales floors, warehouses, loading docks — where employees have a reduced expectation of privacy. Courts have consistently prohibited surveillance in restrooms, locker rooms, and similar private spaces. If cameras are already installed in common areas with visible signage, footage from them is typically usable. Installing hidden cameras specifically to catch a suspect raises additional legal risk. Talk to an attorney before doing that.
Audio Recording
Audio is treated much more strictly than video. Under 18 U.S.C. § 2511, intentionally intercepting an oral communication without proper authorization is a federal offense that can bring civil liability or criminal penalties.3Office of the Law Revision Counsel. 18 USC 2511 – Interception and Disclosure of Wire, Oral, or Electronic Communications Prohibited Some states allow recording when one party consents; roughly a dozen require all parties to consent. Check your state’s rule before you record any investigative interview.
Computers, Email, and Networks
The same federal statute excludes equipment furnished by a communications provider and used in the ordinary course of business from what counts as a prohibited interception device.4Office of the Law Revision Counsel. 18 USC 2510 – Definitions In practice, employers can typically monitor activity on company-owned computers, email accounts, and networks, especially when an acceptable-use policy tells employees monitoring may occur. Matching computer-login timestamps against badge-entry data helps show which employee was at a specific terminal when a suspicious transaction went through.
A Boundary on Union Activity
If your workplace has union employees or ongoing organizing activity, surveillance aimed at protected activity violates the National Labor Relations Act. The NLRB prohibits employers from spying on, photographing, or videotaping employees engaged in union or other protected group activity.5National Labor Relations Board. Interfering with Employee Rights (Section 7 and 8(a)(1)) Routine security cameras in areas supervisors normally frequent are generally fine. Redirecting one to monitor a union meeting is not. Keep the investigation focused on the theft.
Run a Financial or Inventory Audit to Narrow Suspects
A physical count of every item in a storage area or on a sales floor, compared with what your records say should be there, tells you how much has actually disappeared. The gap — often called shrinkage — is your loss. Reviewing shipping manifests, purchase orders, and receiving logs narrows down whether the loss happened at receiving, in storage, or at the point of sale.
Cash theft at a register tends to show up as an unusual number of voided transactions, no-sale register openings, or refunds without a corresponding return. Petty-cash shortages and inflated reimbursement requests follow the same pattern in a subtler form: money moves out without a legitimate paper trail. Match the employees who processed specific transactions against the timing of the losses and the pool of suspects usually shrinks fast.
Look at Who Controls Multiple Steps
One of the fastest ways to see how the theft is happening is to map which employees control more than one step in a financial process. Fraud is far easier to commit, and to conceal, when the same person can authorize a payment, process it, and reconcile the account. Standard internal-control frameworks separate four functions: custody of assets, recording of transactions, authorization, and reconciliation. No single employee should hold all four in any financial cycle.
Common overlaps to check:
- In cash receipting, the same person collecting payments and reconciling bank deposits can short a deposit and cover the gap in the ledger.
- In accounts payable, an employee who can both create new vendors and process payments can set up a fictitious company and route checks to it.
- In payroll, someone who processes timesheets and can also edit the employee master file can create ghost employees or redirect direct deposits.
If your review turns up one person who controlled multiple steps in the process where the loss occurred, that overlap is both the likely vulnerability and a strong lead on who to look at.
Interview Carefully to Avoid Turning the Theft Into a Lawsuit
An investigation conducted the wrong way can produce claims that dwarf the original theft. A few specific risks come up again and again.
False Imprisonment
If you physically block an employee from leaving an interview — locking the door, standing in the doorway, threatening consequences for leaving — the employee may have a false-imprisonment claim. The standard is intentional confinement without consent or legal authority, with the employee aware of it, and even a brief detention counts if freedom of movement was cut off in every direction with no reasonable means of safe escape. Say at the start of any interview that the employee is free to leave at any time, and mean it.
Defamation
Accusing an employee of theft, whether in a meeting, an email to other managers, or a reference call, can support a defamation claim if the accusation turns out to be false. In most states, a false statement that someone committed a crime is defamatory on its face, meaning the employee does not have to prove specific financial harm to recover damages. Truth is a complete defense, which is why the evidence file matters so much before anyone says the word “theft” out loud. Limit discussion of the investigation to people with a legitimate need to know: HR, legal counsel, and the decision-maker.
Weingarten Rights for Union Employees
If the suspected employee is represented by a union, they can request that a union representative be present during any investigative interview that could lead to discipline. The Supreme Court established this right in NLRB v. J. Weingarten, Inc., and it applies whenever the employee reasonably believes the interview may result in discipline and asks for representation.6National Labor Relations Board. Weingarten Rights Under current NLRB law, only union-represented employees have this right. If a represented employee asks, you must grant it, end the interview, or offer the employee the choice to continue without a representative. Going ahead over the objection is an unfair labor practice.
Other Claims to Watch
Aggressive interrogation — shouting, slurs, physical contact during a search — can create claims for intentional infliction of emotional distress or assault. Reporting an employee to police without a reasonable basis can lead to a malicious-prosecution claim if no charges are filed. Sharing personal details that surface during the investigation may be an invasion of privacy. Keep the process professional, factual, and confined to people who need to be involved.
Suspend First, Decide on Termination and Police Second
While the investigation is still open, paid administrative leave gets the suspected employee away from the assets in question without the added exposure that comes with termination. Because pay continues, a paid suspension is generally not treated as discipline, which limits the employee’s grounds to challenge it. Once the evidence confirms the theft, you can move to termination with the file behind the decision. Firing before the investigation is complete raises the risk of a wrongful-termination suit if the evidence turns out to be thinner than it first looked.
Whether workplace theft is charged as a misdemeanor or a felony depends on the value taken, and thresholds vary significantly by state, ranging from as low as $200 to as high as $2,500. Regardless of the amount, filing a police report creates an official record with a case number you will need for insurance, civil recovery, and any later legal proceedings. Many agencies accept reports through online portals; higher-value or complex cases often require an in-person meeting with a detective.
When you file, bring the whole package: incident report, surveillance footage, audit results, access logs, and chain-of-custody records. Detectives may follow up with witnesses and other employees. Outcomes range from probation or restitution for lower-value thefts to prison time at the felony level. A complete evidence file materially raises the chance the case moves forward.
Recover What You Lost
Commercial Crime Insurance
If your business carries a commercial crime policy, employee theft coverage is usually the core of it. It applies to losses of money, securities, and other property caused directly by dishonest acts of employees, including embezzlement, fraudulent vendor schemes, and outright theft of equipment. The most you can recover for a single loss is the policy’s limit, no matter how many employees were involved. File the claim promptly, using the police report case number and your documentation as support.
Civil Suit
You can also pursue the employee in civil court to recover the value of what was stolen. For smaller losses, small claims court is faster and cheaper; jurisdictional limits run from $2,500 to $25,000 depending on the state, with most between $5,000 and $10,000. Larger amounts go to a court of general jurisdiction. Civil cases use a preponderance-of-the-evidence standard, which is lower than the criminal beyond-a-reasonable-doubt standard, so a civil claim can succeed even if the criminal case does not end in a conviction. Keep the evidence file intact through any civil proceedings.
Tax Deduction
Business theft losses are generally deductible on your federal return. Unlike personal theft losses, which are now limited to federally declared disasters for most taxpayers, business theft losses face no such restriction, and are not subject to the $100-per-incident floor or the 10-percent-of-adjusted-gross-income reduction that applies to personal-use property.7Internal Revenue Service. Publication 547 (2025), Casualties, Disasters, and Thefts
To claim the deduction, you need to establish that you owned the property, that it was stolen, when you discovered the loss, and whether an insurance claim is pending with a reasonable chance of recovery.7Internal Revenue Service. Publication 547 (2025), Casualties, Disasters, and Thefts The deduction equals your adjusted basis in the stolen property, minus any salvage value and any insurance reimbursement you receive or expect to receive. Theft losses are deductible in the tax year you discover the theft, not the year it occurred. If an insurance claim is pending with a reasonable prospect of recovery, you must wait until you can tell with reasonable certainty whether you will be reimbursed before taking the deduction.8Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses For non-inventory business property, the loss is reported in Section B of IRS Form 4684, which feeds into Form 4797.9Internal Revenue Service. Form 4684, Casualties and Thefts For larger losses, a tax professional is worth the cost, because depreciation recapture and holding-period rules affect how the loss is classified.