The person stealing from a business is rarely a stranger. It's usually someone trusted — the one who handles the money, who's been there for years, who nobody thinks to check. And the reason is usually something the business never sees: a gambling habit, a drug or alcohol problem, a debt that's spiralled. This is how addiction-driven employee theft actually works, the signs that it's happening, and — the part that matters most once you suspect it — how to find out for certain without tipping anyone off.
In this guide
Why trusted people start stealing
Investigators talk about the "fraud triangle": three things that have to line up before an honest person steals. There has to be pressure — a money problem they can't talk about. There has to be opportunity — access to funds and the ability to hide the taking. And there has to be rationalisation — the story they tell themselves: "I'll put it back," "I'm owed this," "just until payday."
Addiction supplies the pressure like almost nothing else. A gambling habit, in particular, creates a bottomless, urgent, secret need for cash — the next bet is always going to fix the last one. Drug and alcohol dependency, and the debt that rides alongside both, do the same. The person isn't a career criminal. They're usually someone who started by "borrowing" a few hundred dollars to cover a shortfall, fully intending to repay it, and then couldn't — so they took a bit more to cover the first, and the habit grew faster than they could put it back.
That's the uncomfortable truth behind most insider theft: it's not greed, it's desperation, and it comes from people you'd never suspect. Which is exactly why it runs for so long before anyone looks.
Who it usually is
Addiction-driven theft concentrates in a predictable profile — not because of who the person is, but because of what they can reach:
- They control the money. Bookkeeper, office manager, finance officer, payroll clerk, the trusted "right hand" in a small business. They can create, approve, pay, refund or adjust — often more than one of those at once.
- They're long-serving and trusted. The trust is the control failure. Nobody double-checks their work because they've "always handled it," and questioning them feels like an insult.
- They never let go. They don't take holidays, or they work through them. They resist anyone else touching the books, "helpfully" keep everything to themselves, and get defensive about handovers — because a fresh pair of eyes on the accounts is the one thing they can't allow.
None of this proves anything on its own — plenty of dedicated, honest people fit the same description. But when a suspicion is already there, this is the shape it usually takes.
The warning signs
Red flags come in two kinds. On their own, each has an innocent explanation; it's the cluster, especially around one person, that should prompt a quiet look.
Behavioural signs:
- A money-handling employee who won't take leave, or who stays reachable and "on top of it" even when away.
- Lifestyle, spending or stress that doesn't match their salary — or visible signs of a gambling or substance problem.
- Defensiveness about the accounts; reluctance to hand over, be audited, or let anyone else reconcile.
- Living noticeably payday-to-payday, chasing advances, or quiet signs of serious personal debt.
Financial signs:
- The books and the bank never quite reconcile — small unexplained differences that get "fixed" with adjustments.
- Supplier costs, expenses or reimbursements creeping up with no clear reason.
- Round-sum payments, payments just under an approval threshold, or transactions timed for when nobody's watching.
- Refunds, credits, write-offs or journal adjustments that cluster around one person or one account.
- Cash takings that are lighter than the sales suggest they should be.
How the money actually leaves
People steal through whatever they already touch, so the method follows the role. The most common routes:
- Skimming. Taking cash or takings before they're recorded or banked, so the money never appears in the books to be missed.
- Fake and duplicate suppliers. Setting up a vendor that doesn't exist (often with their own bank details), or paying a real invoice twice and keeping the second.
- Expenses and reimbursements. Inventing or inflating expenses, submitting personal spending as business cost, or reimbursing costs that were never incurred.
- Payroll. Ghost employees, inflated hours, or quietly adjusting their own pay.
- Refunds and credits. Issuing refunds, credit notes or adjustments to an account they control.
Two features are almost universal. It starts small — a single shortfall covered quietly. And it grows with the habit, because the pressure never eases. That growth curve is the tell: over a month it can look like noise, but across years, laid against the bank record, it becomes a pattern that can't be explained away.
Why you have to move quietly
This is where good intentions do the most damage. The instinct, when you suspect someone, is to act — pull their access, ask them directly, or quietly mention it to a colleague. Each of those does the same three things: it warns the person, it destroys evidence, and it stops the money moving so the trail goes cold.
Someone stealing to feed a habit is already watchful. The moment they sense scrutiny, records get "tidied up," the fake supplier goes quiet, the taking stops, and your chance to establish what really happened — and to recover it — evaporates. Confrontation without evidence also exposes you: if you're wrong, you've accused a loyal employee; if you're right but can't prove it, you've tipped them off and got nothing.
So the rule is simple. Until you know, change nothing visible. Keep access to the data, keep behaving normally, and get the facts established quietly first.
How we find it — remotely, from your data
You don't need anyone walking the floor, asking questions, or doing anything your staff would notice. The truth is already sitting in two places that can't be talked over: your bank records — the authoritative account of what actually happened to the money — and your accounting system, which is only what someone chose to enter. When those two disagree, that's where the theft lives.
Our forensic accounting audit runs entirely on read-only data you hand us: statements for every bank, card and merchant account — typically up to seven years — plus an export of your accounting system. Our banking-analysis algorithms reconcile the two across accounts and over time, then surface everything that doesn't line up: the deposits that never hit the books, the payments to parties that shouldn't exist, the duplicates, the round-trips, the entries that appear in one system and not the other. A senior specialist reviews every flag, so what you get is findings, not noise.
Because it all runs from data, the entire examination can be done remotely and invisibly — no site visit, no interviews, nothing on the floor that signals an investigation is underway. The person you're worried about never knows. If you'd prefer we come on-site, we can; but we never need to in order to find it. And what we hand back is documented to an evidence standard — enough to act on, however you choose to.
What to do once you know
Knowing — precisely, with evidence — puts you back in control. From there the options open up, and you pick the one that fits:
- Recovery. A clear, documented account of what was taken supports civil recovery and asset tracing.
- Insurance. Many businesses hold employee-dishonesty or fidelity cover; a defensible forensic report is usually what a claim turns on.
- Police referral. Where you choose to report it, the evidence is already in a form investigators can use.
- A quiet, clean exit. Sometimes the right outcome is a managed departure and recovery without publicity — and you can only negotiate that from a position of proof.
It's worth saying plainly: addiction is a health problem, and many business owners feel real conflict about someone they trusted and may still care about. Establishing the facts doesn't take that choice away from you — it gives it back. You decide what happens next. Our job is to make sure you're deciding with the truth in front of you, not a suspicion.
If that suspicion is sitting with you right now, the first step is the quietest one: tell us what's worrying you, by email, and we'll tell you how we'd find out — without anyone else knowing a thing.