Most owners who call us don't say "we've been defrauded." They say the margin's slipped and they can't work out why. Or a supplier cost looks high. Or the books balance but something feels off. Fraud rarely arrives with a label — it hides inside the ordinary flow of a business, in amounts small enough to miss, through people you were meant to be able to trust. Here are the main ways money quietly leaves a private business, why it stays hidden for so long, and how a forensic examination — bringing the data together and matching it with machine learning — finds it.
In this guide
It never comes labelled "fraud"
The thing that makes business fraud so durable is that every individual transaction looks legitimate. A payment to a supplier. A refund to a customer. A payroll run. An adjustment to tidy up the month. Nothing jumps out, because each entry was designed not to. The loss only becomes visible in the pattern — the supplier that's a little too expensive, the refunds that cluster around one person, the deposits that are lighter than the sales suggest — and patterns don't show up in a glance at the ledger. That's why fraud in a private business often runs for years, and why the person who finally notices usually can't prove it.
Private businesses are especially exposed. Trust and access are concentrated in a few people, and the segregation of duties that larger organisations lean on — the person who raises a payment isn't the one who approves it, who isn't the one who reconciles it — simply isn't there. One trusted person can often create, approve, pay and reconcile. That's not a criticism of how you run things; it's the reality of a small team. But it's exactly the condition fraud needs.
Out through your employees
The most common route, because it has the most access. Insider theft takes whatever shape the person's role allows:
- Skimming — cash or takings diverted before they're recorded, so the money never enters the books to be missed.
- Fake and duplicate suppliers — a vendor that doesn't exist (often with the employee's own bank details), or a real invoice paid twice with the second kept.
- Expenses and reimbursements — personal spending claimed as business cost, or costs that were never incurred.
- Payroll — ghost employees, inflated hours, or quiet self-adjustments.
- Refunds and credits — issued to accounts the employee controls.
It's usually someone long-serving and trusted — the one who "always handles it" and never takes leave. The pressure behind it is often personal and hidden; we cover that pattern in depth in our guide to addiction-driven employee theft.
Out through your customers & clients
Money doesn't only leak through staff. Customers and clients are a major channel, and often a blind spot because they sit outside the business:
- False or inflated claims — warranty, insurance, rebate or performance claims that don't reflect reality.
- Application and identity fraud — accounts or credit obtained on false details, then run up and abandoned.
- Refund and chargeback abuse — goods kept and payments reversed, or serial refunds engineered at scale.
- Collusion — the most expensive version: a customer working with a staff member, so an insider waves through what should be stopped.
Collusion is where single-system reviews fail completely. The customer looks fine in the CRM; the employee looks fine in the ledger. It's only when you match the two — same device, same timing, same cluster of approvals — that the relationship appears.
Out through your suppliers
Accounts payable is a quiet, high-value target, because a fraudulent payment there wears the uniform of a legitimate one:
- False and inflated invoices — billing for goods or services never delivered, or padded beyond what was.
- Kickbacks — a supplier overcharges and returns part of the difference to an insider who approves it.
- Duplicate and altered payments — the same invoice paid twice, or a payee's bank details changed after approval.
- Ghost vendors — a supplier set up purely to receive money.
These are invisible on the face of the accounts because the paperwork is complete. They surface when you match payments against delivery, against market pricing, against the pattern of every other supplier — the kind of comparison no one has time to do by hand across years of data.
When it's a business partner
The hardest version, because there's no "them" — it's one of the owners. Partner and shareholder disputes often come down to a simple, unanswerable question: did my partner take more than they should have? Drawings dressed up as expenses, business funds spent personally, revenue diverted before it reached the shared account. When trust has broken down, accusation gets you nowhere. A forensic reconstruction of who took what, when, settles it on evidence — and that tends to end the dispute far faster than lawyers arguing over suspicion.
Why it hides — and how data-matching finds it
Every one of the frauds above shares a defence: it lives in a single system where it looks normal, and relies on no one ever comparing that system to another. The fake supplier is clean in accounts payable. The colluding customer is clean in the CRM. The skimmed takings are clean in the point-of-sale, because they were removed before they were recorded. The one place the truth can't be edited is the bank — and the gaps appear the moment you line the bank up against everything else.
That's the method. We bring the data together from wherever it lives — bank, card and merchant accounts, the accounting system, payroll, point-of-sale, supplier records, spreadsheets — and run machine-learning analysis and data-matching across all of it, over years, not months. The models surface what doesn't reconcile, what repeats, what round-trips, what appears in one system and not another, and what clusters suspiciously around one person or account. A senior specialist then investigates every flag, so what reaches you is findings, not noise. Pulling that data together and making it comparable is the hard first step most internal reviews never finish — and it's where we start.
On-site or remote, always discreet
Because the work runs on data, it doesn't need to disrupt anything. We can do it entirely remotely, from read-only exports you provide, or on-site if that suits you better. Either way it's done discreetly — nothing signals to staff, customers or suppliers that a review is underway. That discretion isn't a nicety; it's essential. The moment anyone involved senses scrutiny, records get "tidied up," the fake supplier goes quiet, and the chance to establish — and recover — what happened evaporates.
What to do with a suspicion
If something feels off, the worst move is to act on it openly. Don't confront anyone, don't suddenly change access, don't discuss it around the office — each of those warns the person and destroys the evidence. Instead: preserve access to the data, keep everything looking normal, and get an independent, discreet forensic examination done. Once you know — precisely, with evidence — you're back in control, and the options open up: quiet recovery, an insurance claim, a managed exit, or a referral, whichever fits.
If that's where you are right now, the first step is the quietest one. Tell us what's worrying you, by email, and we'll tell you how we'd find out — without anyone else knowing a thing. More on the examination itself is on our forensic accounting audit page.