The person who steals from a business is almost never a stranger. It is the bookkeeper who has been there nine years, the office manager everyone trusts, the one person who volunteers to handle the bank reconciliation so no one else has to. That trust is the tool. It is also why the theft can run for years before anyone notices a thing.
By the time embezzlement surfaces, the money is spent and the question changes. It is no longer whether it happened. It is how much left, how it left, and whether any of it can be recovered. A forensic accountant works all of that, and the order matters, because you cannot recover a loss you have not documented.
Figuring out how the money left
Embezzlement schemes are more limited than they seem. Fake vendors set up to receive checks. Ghost employees on payroll. Personal charges run through the company card. Checks written to cash. Customer payments skimmed before they reach the bank. Each leaves a trail in the bank records, the canceled checks, and the accounting system's own audit log, which often records who entered what and when.
A total alone does little. What you need is a documented mechanism. This vendor was never a real company. These are the twenty-two checks that went to it. This is the personal account they were deposited into. A number without that story behind it is an estimate, and estimates do not get paid.
Building a number you can collect on
There are usually several routes to recovery: restitution ordered in a criminal case, a civil suit against the employee, a claim on a crime or fidelity insurance bond, and sometimes a claim against a bank or third party that let it happen. Every one of them demands proof. Insurers in particular will not write a check against a guess. They want the loss shown transaction by transaction, with the provable theft separated cleanly from what you merely suspect.
That separation is where a forensic accountant earns the fee. Overreaching on the number gets the whole claim doubted. A tight number that holds up is worth more than a big number that does not.
Closing the hole
The same review that finds the scheme also shows the weakness that allowed it. One person controlled both payments and the reconciliation. No one checked the vendor list. Bank statements went straight to the person doing the stealing. Fixing those gaps is how you avoid paying for the same lesson twice.
One practical note on timing. Records get purged, memories fade, and most crime insurance policies have a deadline to give notice of a claim. Waiting to be certain before you call anyone can quietly cost you the recovery. Act while the trail is warm.
It also helps to decide early what you are chasing: the money, the person, or both. A civil suit to claw back assets and a criminal referral to law enforcement run on different clocks and answer to different rules of proof. The documentation that supports one usually supports the other, so building it once, early, and building it well keeps every option open instead of forcing a choice before you have the facts.
Seeing red flags like these in your own numbers?
A confidential consultation costs nothing and tells you where you stand.
What it means for your matter
Most engagements are not Enron. But the pattern is the same at every scale: a diverted vendor payment, a related party that shouldn't exist, revenue booked before it was earned, a reserve fund that never quite reconciles. The methods used to expose a multibillion-dollar fraud are the same methods that expose a bookkeeper skimming from a small business or a managing agent taking kickbacks from a co-op.
If something in your financial picture doesn't add up, the earlier a forensic accountant looks, the more of the trail survives. Documents get lost, memories fade, and money moves. The record is easiest to reconstruct while it is still fresh.
Think something's wrong with your numbers?
Talk to a forensic accountant. It's confidential, and there's no obligation.