Home / Insights / Research
The data · Australian employee fraud

$350 million, 102 frauds, and a median that ran for years

By Financial Crime Advisory · 11 October 2026 · 8 min read · data from Warfield & Associates

Over one decade, researchers tracked 102 significant employee frauds in Australia. Together they cost employers about A$350 million. The largest single theft was A$27.4 million. The longest ran for 17 years. And more than half of them — 52 of the 102 — were not discovered for over five years. These are not scams run by outsiders. They are the quiet, patient work of trusted insiders, and the data tells you something uncomfortable: by the time most of them are found, the money is long gone.

In this report

The numbers

The forensic accounting firm Warfield & Associates analysed significant Australian employee fraud cases across the decade from August 2012 to August 2022. The headline findings:

And a caveat that matters more than any single figure: these are the frauds that were caught. Every one of them spent years invisible. The frauds still running today, and the ones that ended quietly without ever being reported, are not in this data at all. The real number is bigger — nobody can tell you by how much, which is precisely the point.

Why these frauds run for years

A five-year median isn't bad luck. It's structural. Insider fraud survives because of three things working together:

It looks like normal business. A fake supplier paid steadily, a slightly inflated expense claim, a payroll entry for someone who left — each transaction is small, ordinary, and individually unremarkable. On the ledger it blends in perfectly. It is only visible when you compare the books against what actually happened.

The person stealing controls the controls. The finance-function concentration in the data is not a coincidence. The people who process payments, reconcile the bank and prepare the reports are the people who understand exactly where the checks are — and how to sit inside the blind spots. Segregation of duties fails quietly when one trusted person is allowed to both create and approve.

The annual audit was never built for this. A statutory audit exists to give reasonable assurance that the financial statements are fairly stated — not to hunt for a determined insider hiding small amounts across years. It is a common and expensive misunderstanding: businesses assume the yearly audit would have found the theft. Repeatedly, it didn't.

Who does it, and why

The motivations in the data are strikingly human. The leading driver was funding a lifestyle beyond the person's means (44 cases). Gambling addiction was the primary motivation in 39 cases — more than a third of the total. These are not, for the most part, criminal masterminds. They are long-serving, trusted employees who crossed a line once to cover a loss, found that nobody noticed, and kept going because the hole only ever got deeper.

We have written up several of these in detail — the bank manager who gambled A$19 million the bank's own audits never caught, the accounts clerk who ran dummy invoices for 17 years, and the bookkeeper who defeated segregation of duties with a borrowed login. Different people, same shape every time: trusted, patient, and invisible until something outside the business finally forced the truth into the open.

Why the business is usually the last to know

Here is the part that should change how you think about it. When stolen company money moves, it leaves fingerprints in the banking system — and under Australia's anti-money-laundering regime, banks and other reporting entities are required to monitor transactions and file Suspicious Matter Reports (SMRs) with AUSTRAC. AUSTRAC analyses that financial intelligence and shares it with law-enforcement and partner agencies.

But the business being stolen from is almost never in that loop. The bank can't tell you what it has reported — the AML law's "tipping-off" provisions generally prohibit it. So the money's trail can be visible to a bank's monitoring team, to AUSTRAC, and ultimately to police, while the company that is actually losing the money sees nothing at all. In the cases that surface, the first external signal is frequently exactly that kind of outside trigger: a police contact, an auditor's chance finding, a customer complaint, a dispute during a sale — or a confession. The common thread across the whole dataset is that the victim organisation was not the one that found it.

That is an uncomfortable position to be in — waiting to be told, by an outsider, that you have been robbed for five years. The alternative is to go looking yourself, deliberately, before anyone has to call you.

What actually catches it

The one thing every long-running fraud in this data has in common is that nobody was quietly checking the real money against the record of it. That is the gap, and it is a closable one:

If the data says anything, it's this: the frauds that cost the most are the ones that ran the longest, and the thing that lets them run is the absence of anyone looking on purpose. Our forensic accounting audit exists to be that look — quiet, independent, and built to find the leak before a bank, an auditor or the police find it for you.

Sources

Figures are drawn from research by Warfield & Associates analysing 102 Australian employee fraud cases over August 2012 – August 2022, as reported in the Australian business press. The description of Australia's AML/CTF reporting regime (Suspicious Matter Reports to AUSTRAC and tipping-off restrictions) reflects the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and AUSTRAC's published guidance.

Don't wait for someone outside to tell you.

We run silent, discreet forensic audits with our own AI audit tools — reconciling your real bank records against your books, every account, up to seven years — so skimming, ghost vendors and insider theft surface fast, and nobody on your team knows a review is happening. Email us; a senior specialist replies within one business day.

Talk to a Specialist How the forensic audit works