Employee theft occurs when a worker steals from their employer or deliberately manipulates company resources for personal gain. It ranges from petty cash skimming and stock shrinkage to sophisticated payroll fraud, expense manipulation and the theft of client data or intellectual property.
The damage goes well beyond the money lost. Employee theft can erode team morale, undermine client trust, distort financial records and expose the business to legal and regulatory risk. Because the person involved usually knows the company's systems and controls, these matters are difficult to resolve fairly without an independent, professional investigation.
Common Signs of Employee Theft
No single sign proves dishonesty, but a combination of red flags usually justifies a closer look:
- Unexplained stock shortages or shrinkage
- Cash register discrepancies, or frequent voided and refunded sales
- A lifestyle that seems out of line with the employee's salary
- Reluctance to take leave or to hand over duties to colleagues
- Missing documentation, altered records or duplicate payments
- Invoices from unfamiliar suppliers, or supplier bank details matching an employee's
- Rising customer complaints about billing or missing deposits
Common Types of Employee Theft
The method usually matches the employee's level of access. Common forms include:
- Cash theft — skimming takings, falsifying refunds or pocketing deposits
- Stock and asset theft — taking inventory, tools, fuel or equipment for personal use or resale
- Payroll fraud — ghost employees, inflated hours or false overtime claims
- Expense fraud — fabricated or inflated claims, or personal spending on company cards
- Procurement fraud — kickbacks, inflated supplier invoices or conflicts of interest
- Data theft — copying client lists, pricing or trade secrets, often before resigning
- Time theft — claiming pay for hours not worked
What a Professional Investigation Involves
A professional investigation combines conventional detective work with digital forensics. While every matter is different, the process typically follows these steps:
- Initial consultation — understanding the allegation, the individuals involved and the potential exposure.
- Evidence preservation — securing point-of-sale data, CCTV footage, access logs, emails and devices before anything can be altered or deleted.
- Discreet observation — where lawful and justified, surveillance to document activities without alerting the suspect.
- Digital forensics — forensically imaging computers and cell phones to recover deleted files, trace communications and analyse financial records.
- Interviews — structured, legally sound interviews conducted once the evidence has been gathered.
- Reporting — a clear, professionally documented report setting out the findings and the evidence behind them.
Digital Evidence That May Be Examined
Electronic records often tell the story that paper trails cannot. Depending on the matter, an examiner may analyse:
- Emails, instant messages and chat applications such as WhatsApp
- Deleted or hidden files on work computers, laptops and cell phones
- Point-of-sale, accounting and payroll system logs
- Banking and payment records, including EFT and card transactions
- CCTV footage and electronic access-control records
- Cloud storage accounts and USB device connection histories
The Legal Position in South Africa
In South Africa, employee theft may amount to theft or fraud under common law, and serious cases are typically referred to the South African Police Service (SAPS). Employers must still respect the employee's rights: searches should rest on consent or a proper policy, surveillance must be proportionate, and evidence gathered in breach of the Protection of Personal Information Act (POPIA) or labour law may be ruled inadmissible or expose the employer to claims. An experienced investigator works within these boundaries.
Practical First Steps for Employers
If you suspect employee theft, the following can protect both the evidence and the company:
- Do not confront the suspect prematurely — this can tip them off and destroy evidence.
- Secure relevant records, CCTV footage and devices in their current state.
- Restrict the employee's access to cash, stock and systems discreetly where possible.
- Document dates, amounts and observations in writing as events unfold.
- Involve your attorney early, especially where dismissal or prosecution is likely.
- Engage a licensed, experienced investigator to gather evidence lawfully and objectively.
Handled correctly, an employee theft investigation can stop ongoing losses and produce evidence that holds up in a disciplinary hearing or in court. For more plain-language guides on investigations and digital forensics, visit the Knowledge Centre.