Suspect Embezzlement in Your Business? The First Steps Before the Evidence Disappears
What you do in the first days decides what you recover later. We examine the records discreetly, establish how much was taken and how, and prepare a report fit for the Public Prosecution and the court.
Why the first days decide the outcome
Embezzlement is rarely discovered all at once. It starts with a doubt about an invoice, a transfer or a cash shortage, and at that stage the digital and documentary evidence still exists. Every day the suspect knows of the doubt reduces what can be proved and recovered.
The law also has deadlines that do not wait. If the suspect is an employee, Article 80 of the Labour Law allows termination without award or notice where an act of dishonesty or breach of trust is proven, or where the employee deliberately caused material loss to the employer provided the employer reports the incident to the competent authorities within 24 hours of learning of it, and provided the employee is given the opportunity to state the reasons for objecting to the termination. Article 69 bars accusing an employee of a violation discovered more than 30 days earlier. If the suspect is a manager or board member, Articles 26, 27 and 28 of the Companies Law set out the duties of care and loyalty, the prohibition on exploiting company assets, and liability to compensate the company, and the partners or the general assembly decide whether the company sues (Article 29).
What to do now
- Do not confront or alert the suspect: an early confrontation means messages and files are deleted and entries altered before they are preserved.
- Preserve the evidence before any other step: a full copy of the accounting system database, official bank statements for the period in question, and images of the mailbox and devices used, with a note of who preserved what and when.
- Suspend access without destroying the record: disable system, bank and signing access, but do not delete the account or its logs.
- Keep the circle small: one senior manager, legal counsel and an external examiner; everyone else you tell raises the risk of a leak.
- Define the hypothesis and scope: the period, the accounts, the people, and the likely method (fictitious invoices, sham suppliers, transfers, unrecorded sales). An open-ended examination with no scope costs more and takes longer.
- Decide the reporting route with legal counsel: the criminal complaint, a precautionary attachment over assets, and the 24-hour deadline in Article 80(4) if you intend to rely on it for termination.
- Notify your insurer if you hold a fidelity guarantee policy; late notice can void the cover.
How we help
- A confidential preliminary examination within days that establishes whether the suspicion is serious, the initial amount involved, and the scope of the full examination required.
- Establishing the amount and the method by reconciling the entries to bank statements, invoices and contracts, and tracing the funds to their final destination.
- An embezzlement report fit for the Public Prosecution and the court, with a documented methodology and numbered exhibits, within our fraud and misconduct reports service.
- Litigation support, answering the questions of the court-appointed expert and the court, within our litigation support reports service.
- Closing the gap that allowed the embezzlement: segregation of duties, system permissions, and dual authorisation of payments.
Frequently asked questions
Should I dismiss the employee immediately?
Termination without award under Article 80 requires the act to be proven and the employee to be given a chance to state their objection. It is better to suspend access, complete the examination, and then decide with legal counsel, so the matter does not turn into a wrongful-dismissal claim.
Should I report to the authorities before I am certain?
Reporting within 24 hours of learning of the incident is a condition for relying on paragraph 4 of Article 80 in cases of deliberate loss. Legal counsel decides the timing of the criminal complaint, and the accounting report is what gives the complaint its weight.
How long does an embezzlement examination take?
The preliminary examination takes days; the full examination takes weeks depending on the length of the period, the number of accounts and transactions, and the quality of the records.
What if the suspect is a partner or a manager?
They are liable to compensate the company under Article 28 of the Companies Law, and the partners or the general assembly decide whether to sue (Article 29). See our guide on settling accounts between partners in a dispute.
Digital evidence disappears at the press of a button. Contact us before anyone else knows.