Signs an Employee Is Committing Fraud: An Investigator's List

Updated 5 October 2026 by Investigation Bureau

The signs are seldom dramatic. Employee fraud usually looks like a pattern that has quietly become normal: the sick note that always follows a refused holiday, the supplier only one person is allowed to deal with, the "bad back" that somehow coexists with a five-a-side league. This guide lists what employers actually notice, and the mistake most of them make next.

The Association of Certified Fraud Examiners runs a long-standing global study of fraud inside organisations. It estimates that organisations lose around 5% of revenue to fraud each year, and that tips remain the most common way a fraud is discovered. In other words, most schemes come to light late, when someone finally speaks up. For a small UK business, one dishonest employee is not a rounding error. It is often the margin.

The behavioural signs investigators see

Nothing on this list proves anything alone. What matters is the pattern, and how the person reacts to ordinary scrutiny:

A lifestyle that outruns the salary. The new car, the holidays, the watch, none of it explained or even mentioned.
Never taking leave and never being ill. Two weeks away would mean someone else opening the post. Gatekeeping of this kind is the classic sign of invoice and supplier fraud.
One-person territories. A supplier, a customer or a system that only they handle, with records that are always "in hand" and never quite available.
Defensive escalation. Ordinary questions about records or process are met with disproportionate pushback, a grievance or a sudden resignation.
Duplicate, round-number or just-under-the-threshold invoices. Amounts engineered to sit below the approval limit.

Sickness-absence fraud: the familiar version

One of the most common reasons a UK employer turns to an investigator is long-term sickness absence that does not add up: an employee certified as unfit for work who is visibly active everywhere else. Employers tend to describe the same pattern. Absences cluster around weekends and refused leave. Social media is quietly locked down. Colleagues knew long before HR did. Our illustrative case story about a long-term absence shows how such a case plays out, and why the answer was lawful surveillance and not confrontation.

Expenses, theft and moonlighting

Three more patterns deserve a name.

Expense creep. Mileage that assumes every journey starts from home, per-diems claimed for days the diary places elsewhere, receipts that photocopy suspiciously well.
Stock and cash leakage. Shrinkage that follows one person's shifts.
Moonlighting on your time. The field engineer or night-shift supervisor running a second job, or a competing business of their own, inside hours you are paying for.

Each of these can be proved with lawful observation and with records you already own. None can be proved by asking the person.

What to do before you confront anyone

In most employee-fraud cases the most expensive step is the accusation made too early. Once a person has been challenged, the evidence evaporates. Records get tidied and stories get aligned. A mishandled process can also turn a thief into a successful unfair-dismissal claimant. Before any confrontation:

Preserve what you already hold. Invoices, rotas, expense claims, access logs and any CCTV you lawfully operate. Do it quietly, and outside systems the person controls.
Keep the circle small. Tips are how frauds come to light. Leaks are how investigations die.
Check proportionality. UK GDPR and the ICO's employment guidance allow an employer to investigate a reasonable suspicion, provided the investigation is targeted, documented and proportionate, and not blanket snooping.
Get independent evidence before the meeting, not after it. An HR process built on suspicion alone collapses. One built on timestamped, third-party evidence rarely has to fight at all.

How a professional investigation closes the case

An external investigator gives you two things HR cannot produce from inside. The first is independent evidence, lawfully obtained: surveillance of activity in public, verified moonlighting, documented patterns. The second is distance, so that the disciplinary process rests on a third party's report and not on a manager's hunch. The evidence is timestamped, logged through a chain of custody and prepared to the standard employment tribunals expect. It then goes to your HR team or employment solicitor, who run the procedure correctly.

Frequently asked questions

Is it legal to have an employee followed?

Yes. Surveillance of what an employee does in public places is lawful where there is reasonable suspicion, a legitimate aim (protecting your business from fraud, for example) and a proportionate, documented approach. Getting that proportionality assessment right is part of what you pay a professional for.

Can I check an employee's social media?

Posts that are publicly visible, yes. Looking at what anyone can see is lawful, and public activity during certified sickness is often decisive evidence. Getting into private accounts by deception, borrowed logins or fake friend requests is not lawful, and it taints everything it touches.

Will investigator evidence stand up at an employment tribunal?

Evidence gathered lawfully and proportionately is used in tribunals routinely. Method is what counts. Covert footage of public activity, obtained on reasonable suspicion and handled with a proper chain of custody, supports a fair disciplinary process. Your employment solicitor runs the procedure. Our job is to make sure the evidence beneath it is sound.

What does a workplace investigation cost?

Most cases need one to three days of surveillance, plus reporting. Typical UK market day rates are £500 to £1,200 per operative, and we give a fixed quote in writing before any work begins. Set against a full-time salary paid through a fraudulent absence, or invoice leakage that is still running, the sums are usually short. For the wider picture, see what a private investigator costs.

Something not adding up. Describe the pattern to an investigator. It is free, confidential and without obligation, and we will tell you whether it is worth investigating and what it would cost: send a confidential enquiry.