Signs of Fraud in a Company: How to Spot Employee Abuse

Internal fraud rarely begins with a big theft. It begins with a small abuse that nobody noticed and nobody recorded. The sooner an owner learns to read the financial and behavioral signals, the smaller the losses will be — and the greater the chance of proving the abuse with documents rather than emotions. What follows is a practical guide drawn from my forensic practice: where to look first, what to watch for, and how to act within the law so that the material you gather will later withstand scrutiny in court.

Why internal fraud is more dangerous than external

An employee knows the processes from the inside, has legitimate access to systems and documents, and — most importantly — enjoys trust. Trust is usually the very instrument of the scheme: an owner does not check the person he believes in. That is why internal abuse typically lasts for months or years, accumulating in small, “unnoticeable” amounts until a critical event triggers discovery — a cash-flow gap, a supplier complaint, a surprise stocktake, or the departure of a key person.

It is important to separate the terms from the outset. In everyday speech, “fraud” means any kind of abuse, but the legal classification of an act — fraud proper, misappropriation or embezzlement, abuse of office, forgery of documents — belongs exclusively to the investigator, the prosecutor and the court. An owner, and even an expert, works with a narrower and more precise category: a documented fact of a shortage, an overstatement, or an unjustified payment. This distinction matters at every step, from the first suspicion to the point of turning to law enforcement.

Common abuse schemes

The schemes repeat from one business to another. Here are the ones I encounter most often.

Fake counterparties and kickbacks

A purchasing manager or department head brings in “their own” supplier — often a newly created sole proprietor (FOP) or limited liability company (TOV) registered to a related person. The goods or service may actually be delivered, but at an inflated price, with the difference returned to the insider in cash (the “kickback”). Sometimes there is no delivery at all, and payment goes out for “thin air”.

Duplicate (“doubled”) payments

The same invoice is booked and paid twice — once against the original and once against a copy, or with a slight change to the number or date. The second payment lands in a controlled account. This scheme thrives wherever there is no strict duplicate control and no regular reconciliation against the bank statement.

Inflated purchases and write-offs

More is bought than is really needed, and the surplus is siphoned off; or materials are written off “to production” in larger volumes than were actually used. The classic risk zone is fuel, consumables, and raw materials, where the true consumption norm is hard to calculate and a shortage is easy to hide behind “technological losses”.

Forged source documents

Acts, delivery notes, and expense reports are drawn up for a non-existent transaction. A signature, a stamp, or a scanned blank “legalizes” the outlay. Forged primary documentation is the foundation of almost every scheme, because it is exactly what turns theft into a “lawful” movement of funds in the books.

”Dead souls” on the payroll

The staffing schedule lists people who do not actually work (dismissed employees, fictitiously registered relatives), and their salaries are routed to the right cards. The same category includes inflated bonuses and compensation for “insiders”.

Financial red flags

A single sign proves nothing on its own — it is the combination that should raise concern. In practice, these signals fire most often:

• a gap between the books and reality — the accounts show a balance that is not on the shelf or in the till during a surprise stocktake;
• abnormal write-offs — spikes in costs that do not correlate with sales or production volume;
• settlements with newly created FOPs/TOVs — a counterparty registered shortly before the deal, with no history, resources, or reputation;
• payments on the eve of weekends and holidays — when control is relaxed and the trail “goes cold” before the next working day;
• repeated amounts just below the approval limit — payments artificially split to avoid an additional manager’s sign-off;
• a rising share of cash operations with no clear business reason;
• systematic “corrections” and reversals in the books, always by the same person.

Where to look first: the highest-risk zones

The resource for checking is limited, so start where money concentrates and control is weak at the same time.

Zone	What to check first
Cash desk	Surprise stocktake, matching RRO (registered cash register) Z-reports against takings, “temporary” loans from the till
Purchasing	Prices against the market, the circle of suppliers, tender discipline, signs of kickbacks
Warehouse	Reconciling balances with the books, write-off norms, misgrading, “disappearance” of liquid goods
Payroll	Staffing schedule against people actually working, bonuses, “dead souls”
Related-party settlements	Contracts with firms of relatives or management, non-market terms, pass-through payments

The key principle: control must sit wherever access to an asset and the authority to record its movement intersect. If one person orders, receives, pays, and writes off, that is no longer a red flag — it is a systemic risk that should be removed regardless of whether a specific suspicion exists.

Behavioral indicators

Numbers show the consequence; behavior often runs ahead of it. The same patterns recur across investigations:

• the person clearly lives beyond their official income — cars, holidays, and purchases that a salary does not explain;
• avoids vacations and sick leave — fearing that in their absence someone else will “see” the scheme (which is why an annual leave with a proper handover is not only a labor-law requirement but also a control tool);
• monopolizes the process and the documents — won’t share access, insists on “doing it all myself”, avoids handovers and rotation;
• overreacts to checks and takes simple clarifying questions personally;
• has unusually close, opaque ties with a particular counterparty.

Let me stress: behavioral signs are grounds to look closer, not to accuse. A person may avoid vacations out of diligence, not out of fear of exposure. Behavior sets the direction of the check; only documents prove the case.

Detection tools

Once a suspicion has already arisen, tools entirely available to an owner will work — provided they are used methodically.

1. Reconciling source documents against reality and the books. The foundation of everything. Compare the contract, the delivery note, the act, and the payment order with each other and with the actual movement of goods or services. The discrepancy between what is written and what really happened is the main trail.
2. Analysis of bank statements. This shows the real payments: to whom, when, and for what. It reveals duplication, payments to related parties, split amounts, and operations atypical for the business. The payment purpose is only what the payer typed in, so it must always be checked against the source documents.
3. Checking counterparties in open registers. The Unified State Register of Legal Entities, Individual Entrepreneurs and Public Organizations (EDR) shows the date of creation, the founders, the director, the types of activity, and possible ties to employees. The Unified State Register of Court Decisions (EDRSR) shows whether the counterparty appears in disputes and proceedings. Often this one step already reveals that the “supplier” was registered to a manager’s relative a week before the deal.
4. A surprise stocktake of the cash desk and warehouse. The element of surprise leaves no chance to “adjust” balances to match the books.

When to bring in a forensic expert — and how not to tip off the culprit

On your own you can spot a signal and record the obvious. But when the scheme is complex, the sums are significant, or you plan to turn to the court or law enforcement, it is wise to engage a forensic economic expert at an early stage — not after the documents have already been “cleaned up”.

A few practical rules so you don’t harm your own case:

• Don’t show your cards too early. Sharp moves — public accusations, a demonstrative blocking of access, an emotional confrontation “in the heat of the moment” — warn the culprit, who then destroys or substitutes evidence. Quiet, documented preparation is stronger than a loud conflict.
• Preserve access and data before you intervene. Before the person suspects anything, capture the databases, correspondence, files, and balances in a way that preserves their integrity and provenance. A document with an unverified source is easy to challenge and is worth almost nothing to an expert.
• Limit the circle of insiders. The more people who know about the check, the higher the chance of a leak.
• Act within the law. Access to personal data, banking secrecy, and private correspondence has statutory limits. Exceeding them not only makes the evidence inadmissible but can turn into liability against the owner.

When the matter moves into the procedural sphere, a forensic expert is engaged to establish circumstances requiring specialized economic knowledge. In criminal proceedings, the examination is ordered by the investigating judge or the court (and the parties may engage an expert themselves) under the Criminal Procedure Code of Ukraine (KPK); in commercial, civil, and administrative cases, under the rules of the Commercial (HPK), Civil (TsPK), and Administrative (KAS) Procedure Codes respectively. A forensic economic expert works within the Law of Ukraine “On Forensic Expert Activity” and the Instruction on ordering and conducting forensic examinations, approved by Ministry of Justice Order No. 53/5, under economic specialties — examining accounting and tax records, the economic activity of enterprises, and financial-and-credit operations.

In turn, several bodies act within their powers against economic offenses: pre-trial investigation of economic crimes is conducted by the Bureau of Economic Security (BEB); tax control under the Tax Code is exercised by the State Tax Service (DPS); analysis of suspicious financial transactions and financial intelligence is handled by the State Financial Monitoring Service (Derzhfinmonitoring). Understanding who is responsible for what helps you address your complaint correctly and not waste time.

A common mistake: acting on emotion without securing evidence

The costliest mistake an owner makes is reacting on the first impulse. Having found abuse, the manager fires the person “in a day” in anger, demands the money back verbally, and deletes them from chats and systems — and is left without evidence. Formally there is no fact: the source documents have been swapped, witnesses are on guard, the trail in the data has been erased.

The correct logic is the reverse: first secure, then act. Document the discrepancies with stocktaking acts, keep the statements and source documents, obtain written explanations, and if needed an expert’s opinion — and only then take personnel and legal decisions. A careful, document-backed position is always stronger than a loud but unproven accusation — and it is exactly what gives a real chance to recover the funds and hold the culprit accountable.

If you are an owner, a manager, a lawyer, or an investigator, and you see warning signals but are unsure how to record them so the evidence holds, get in touch for a consultation. An independent forensic economic examination or a forensic investigation will help you separate suspicion from fact and build a position on documents, not on emotions.