Detect employee theft by reconciling stock, cash and accounts regularly and watching for patterns: losses on certain shifts, overrides and voids, unusual vendor payments, and staff who avoid leave. When you suspect someone, preserve evidence quietly, run a fair internal inquiry, then report cognizable offences such as BNS s.306 or s.316 to police. Never accuse publicly without proof.
Key takeaways
- Patterns in data catch more insider theft than hunches; reconcile cash, stock and payments regularly.
- Preserve records and CCTV before anyone is confronted; evidence disappears fast once a suspect is alerted.
- Theft by an employee falls under BNS s.306; misusing entrusted money is criminal breach of trust, s.316.
- Dismissal for theft needs a fair process: charge sheet, chance to reply and an inquiry under your rules.
- Public accusations, detention or forced confessions can expose the employer to criminal and civil action.
What are the signs of employee theft and fraud?
Insider theft rarely announces itself. It shows up as small, repeated gaps that someone has learned to hide. Warning signs fall into two groups: what the numbers show and how people behave.
| Area | Signs in the records | Signs in behaviour |
|---|---|---|
| Cash and billing | Frequent voids, refunds or discounts by one user; cash short on certain shifts | Insists on closing the counter alone |
| Inventory and warehouse | Shrinkage concentrated in particular items or locations; stock adjustments without reason | Unusual presence after hours or on off days |
| Purchases and vendors | New vendors with addresses or bank accounts that match an employee; split invoices just under approval limits | Resists rotation or vendor audits |
| Payroll and expenses | Ghost employees, inflated overtime, duplicate or round-number expense claims | Lifestyle that does not fit the salary |
| Data and IP | Large downloads, forwarding to personal email, access outside role | Sudden resignation to join a competitor |
Treat these as reasons to look, not as proof. An employee who never takes leave may simply be dedicated, and a new car may have a family explanation. The aim is to find patterns that survive scrutiny.
How to detect employee theft before it grows
- Reconcile often. Daily cash tallies, weekly stock counts of high-value items, and monthly bank and vendor reconciliations by someone other than the person handling the money.
- Separate duties. The person who approves a vendor should not also pay it; the person who receives stock should not also adjust it.
- Read the exception reports your billing, ERP or accounting software already produces: overrides, voids, manual adjustments and after-hours log-ins.
- Enforce leave and rotation. Many frauds come to light when the person who conceals them is away for two weeks.
- Run surprise checks, documented and applied fairly to everyone.
- Offer a confidential reporting channel. Colleagues frequently know first.
How to handle suspected employee theft: step by step
- Keep the circle small. Tell only those who must know: an owner or director, HR and your lawyer. Leaks alert the suspect and can defame an innocent person.
- Preserve evidence first. Export CCTV for the relevant periods, take copies of POS and ERP logs, access logs, email and stock records, and secure company-owned laptops and phones. Note who did this and when.
- Quantify the loss. An internal audit or a forensic accountant can establish the amount, period and method. A clear figure matters for the police, insurers and any recovery suit.
- Restrict access quietly if the risk is ongoing, for example by changing approval rights, without announcing an accusation.
- Issue a charge sheet or show-cause notice setting out the specific allegations and giving the employee a fair chance to reply in writing.
- Hold an inquiry under your standing orders or HR policy, with an impartial inquiry officer, the right to see the evidence and to present a defence. Keep minutes.
- Decide on police and discipline separately, with legal advice. One does not have to wait for the other, but they must be consistent.
Where suspension is needed during the inquiry, follow your standing orders and applicable labour law, including any subsistence allowance. The Industrial Relations Code, 2020, in force from 21 November 2025, governs standing orders for larger industrial establishments; smaller businesses should rely on written HR policies and appointment terms.
Which laws apply to employee theft and fraud in India?
| Conduct | Provision | Note |
|---|---|---|
| Employee takes goods or cash in the employer's possession | BNS s.306, theft by clerk or servant (earlier IPC 381) | Up to 7 years and fine; cognizable |
| Employee misuses money or goods entrusted to them, such as a cashier or store-keeper | BNS s.316(4), criminal breach of trust by clerk or servant (earlier IPC 408) | Up to 7 years and fine |
| Fake invoices, inflated claims, deceiving the company into paying | BNS s.318, cheating | Often charged with forgery |
| Altering books or electronic accounts to defraud | BNS s.344, falsification of accounts (earlier IPC 477A) | Applies to clerks, officers and servants |
| Stealing data or accessing systems without authority | IT Act s.43 and s.66 | Also breach of contract and confidentiality terms |
The difference between theft and criminal breach of trust matters: theft is taking property without consent, while breach of trust is dishonestly misusing property that was handed over to the employee. Your lawyer will frame the complaint accordingly.
How to report employee theft to the police
File a written complaint at the police station with jurisdiction over the premises, describing the facts, the period, the amount and the evidence. Attach copies, not originals, of the audit findings, CCTV extracts with a note of time stamps and the relevant records. For a cognizable offence, the police must register an FIR, as the Supreme Court held in Lalita Kumari v. Government of Uttar Pradesh (2013). If the station refuses, you can approach the Superintendent of Police and then the Magistrate.
Video and system logs will need a certificate under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, signed by the person in charge of the system. Our guide to CCTV footage as evidence explains how to export it and keep a clean chain of custody. Remember that a confession made to the police is generally not admissible against the accused under the BSA, so the case will rest on documents and witnesses.
Mistakes that can turn the employer into the accused
- Detaining the employee in a room until they "confess" can be wrongful restraint or confinement (BNS s.126 and s.127).
- Threats to file false cases or harm the family are criminal intimidation (BNS s.351).
- Seizing a personal phone or demanding passwords to private accounts invades privacy and can be unauthorised access.
- Public accusation in a staff WhatsApp group or to the market, before proof, invites defamation under BNS s.356 and a civil suit.
- Withholding salary or dues beyond what law and contract allow creates a separate labour dispute.
- Forced confession letters carry little weight and can be retracted, often with allegations of coercion.
Fairness is not only ethical; it is what makes the dismissal and the prosecution stick.
How to dismiss an employee for theft
Theft, fraud and dishonesty are standard grounds of misconduct, and proven misconduct can justify dismissal. The process must still be fair: written charges, an opportunity to respond, an inquiry where facts are disputed, a reasoned decision, and a proportionate penalty. Dismissal does not need to wait for the criminal case to end, because a domestic inquiry decides on the balance of probabilities, but consult a labour lawyer where the criminal and disciplinary charges are identical. Record the decision in a dismissal letter that states the proven charges, and settle legally due amounts.
When should a business involve a private investigator?
Bring in a lawful investigator when the facts lie outside your systems: checking whether a vendor is a front for an employee, verifying addresses and company records, discreet enquiries in the market, or surveillance in public places of suspected diversion of goods. A corporate investigation through a verified detective on Hire Your Detective works alongside your auditors and lawyers. Investigators do not access bank records, call records or private accounts; those come only through police and courts. To prevent repeat problems, combine controls with proper employee background verification before hiring, and see our guide on due diligence for vendor and partner checks. Costs vary by city and scope; our detective cost guide explains the usual factors.
Bottom line
Employee theft is best caught through regular reconciliation and separation of duties, and best handled through quiet evidence preservation, a fair inquiry and a well-documented police complaint. Move carefully: wrongly accusing an honest employee is costly, and rough handling of a guilty one can sink your own case.
Sources & official links
This guide is general information, not legal advice. Laws and procedures change, and every case is different — speak to a lawyer about your situation. In an emergency, call 112.