Suspect an employee of fraud? What to do before you confront anyone

Short answer: if you suspect an employee of fraud, keep the circle small, secure the evidence quietly before anyone is confronted or suspended, and take legal advice early. A fair, well-documented process protects the business whether the case ends in dismissal, recovery of money, a report to the police or a finding that nothing was wrong.

Suspicion usually arrives sideways: an invoice from a supplier no one recognises, payments just under an approval limit, a colleague who never takes leave, a whistleblower's email, or an audit query that gets an evasive answer. None of these proves fraud. Each is a reason to find out quietly.

Keep the circle small. Tell only the people who need to know, and choose them carefully: the person you suspect may have help, and senior people sometimes turn out to be involved. Word travels quickly in a business and gives someone time to delete files, move money or prepare a story.

Secure the evidence first. Preserve email accounts, devices, accounting records and access logs before anything changes, and do it in a way that can be explained later. Copying files by hand or looking through someone's laptop yourself can damage evidence and create arguments about what was found and how. Forensic preservation of systems and devices is routine and need not alert anyone.

Then establish the facts. Forensic accounting reconstructs the payments and shows who benefited and how much was lost. Corporate research checks suppliers, related companies and links to the employee or their family. Only once the documents are understood should anyone be interviewed, and the interview should be planned around what the evidence shows.

Run a fair process. Employment law still applies when fraud is suspected. The Acas Code of Practice sets the standard for investigation and disciplinary meetings, and a dismissal handled badly can be challenged even where the fraud was real. HR and employment lawyers should be involved from the start.

Stay within the law. Bank records, phone records and other personal data cannot be obtained by pretexting or by paying insiders; that is an offence under section 170 of the Data Protection Act 2018. Monitoring an employee's work systems is possible within the business's policies and data protection law, and your lawyers can advise on what is proportionate.

Think about recovery and reporting early. If money has gone, civil steps such as freezing orders may be possible and speed matters. Fraud can be reported to Action Fraud or the police, but a criminal investigation runs on its own timetable and does not recover money by itself. Many businesses pursue both routes with their lawyers.

The first conversation with Neel Chakrabarti is free and confidential. Tell us what you have noticed and who knows; we will tell you how we would secure the evidence and establish the facts without alerting anyone, and agree scope and fees before any work begins.

Cato & Veil practice note. General information, not legal or employment advice. Decisions about suspension, dismissal, reporting and proceedings belong to your lawyers and HR advisers.