What Are Common Embezzlement Schemes?

Common embezzlement schemes include cash skimming, forged checks or refunds, ghost employees, fictitious accounts, inventory theft, fraudulent wire transfers, and manipulation of accounting records. These schemes tend to exploit recurring gaps in custody, authorization, recordkeeping, system access, and independent review.

This article organizes those risks in two complementary ways. The first framework covers six areas where opportunities often appear. The second lists ten techniques that owners, managers, and accounting teams should recognize when designing controls.

What Are the Six Areas of Embezzlement Risk?

The U.S. Department of Justice defines embezzlement as the fraudulent appropriation of property by a person to whom the property has been entrusted. That element of trust distinguishes embezzlement from ordinary theft. An employee can still misuse company property without committing embezzlement, so policy violations and suspected crimes should be investigated and described carefully.

For practical control design, six areas deserve close attention: cash, negotiable documents, account credits, delivered or received items, wire transfers, and computer access. This is an operating framework, not an exhaustive legal taxonomy. In the Association of Certified Fraud Examiners’ 2024 case dataset, asset misappropriation was the most common occupational fraud category.

Written procedures reduce opportunity when they assign custody, authorization, recording, and review to different people. This is the principle behind segregation of duties. Controls cannot guarantee that fraud will never occur, but they can make unusual activity harder to conceal and easier to investigate.

(1) Cash Embezzlement

Cash is exposed whenever one person can receive money, record the transaction, issue a refund, and reconcile the drawer without independent review. Examples of cash embezzlement include:

• Holding cash from a transaction instead of placing it in the register, vault, safe, or other approved cash container.
• Taking money from an unsecured petty cash container.
• Taking cash from wallets, purses, briefcases, backpacks, or other personal items left on the premises.
• Short-changing customers during a transaction.
• Returning stolen items or processing false refunds for cash.
• Cashing stolen or forged documents for a confederate.
• Taking cash from another employee’s work area.

Useful cash security controls include written policies and procedures governing cash handling and cash station security, secured cash drawers and keys, supervisor approval for refunds, documented cash counts, and independent reconciliation. Require strict dual control over cash containers used to store or transfer money. Conducting frequent, unannounced cash counts and rotating tasks among personnel at unpredictable intervals can expose irregularities. Staff rotation or leave should be part of a risk-based control plan rather than a blanket rule for every employee.

(2) Embezzling Negotiable Documents Issued or Sold by the Company

Negotiable documents and transaction authorizations can be stolen and forged, negotiated after reported void, or negotiated after the payee or amounts are altered. Examples include refund authorizations, unauthorized use of credit and debit memos, money orders, forgeries, travelers checks, cashier’s checks, and the company’s official checks.

Controls should cover document ordering, receipt, storage, inventory, approval, issue, cancellation, and destruction. Require strict dual control over negotiable documents, including checks, refund authorizations, and credit and debit memos. Do not let the same person order blank checks, receive them, maintain the inventory, prepare payments, and reconcile the account. A supervisor can approve the order while a different person receives it. Supervisor approval, dual control, exception reports, frequent unannounced audits, and task rotation can help identify missing documents, altered payees, changed amounts, and unexplained voids. An accounting policies and procedures manual can document who performs each step.

(3) Account Credit Embezzlement

Account credit embezzlement involves manipulating or creating records that move value without a legitimate business purpose. Examples include:

• Accessing inactive or dormant accounts, particularly senior citizen, foreign customer, or conservatorship accounts.
• Making unauthorized transfers between general ledger accounts.
• Creating ghost employees in the company’s accounting system for payroll fraud.
• Opening loans or lines of credit for fictitious borrowers.
• Creating deposit accounts for fictitious persons or entities to receive stolen or forged checks.
• Using deposit accounts in a check-kiting scheme.

These schemes may require manipulation of account information, generation of phony accounts, use of fictitious identities, or cooperation between personnel working at other companies. Appropriate internal control procedures include supervisor involvement in every account adjustment request, a triggering device to alert management when a dormant account is accessed, independent review of new accounts and credit changes, and reconciliation between source documents and the general ledger.

(4) Embezzling Delivered or Received Items

Employees may divert property that the company receives, stores, ships, safeguards, or uses in production. Examples include money paid against a layaway purchase, merchandise hidden in the company’s garbage for retrieval by a confederate, abuse of an employee discount, raw materials, scrap, stocks and bonds, items held in trust, negotiable instruments, equipment, and supplies.

Written procedures governing the shipping, receiving, and storing of property should create a chain of custody. Apply the same discipline to items held for safekeeping or as collateral. The person receiving an item should document it promptly; another person should update the inventory or accounting record; valuable items should move to a designated secure storage facility; and an independent count should be compared with the records. Transfer receipts, restricted storage access, periodic inspections, and frequent unannounced audits of instruments and other property make unexplained losses easier to find.

(5) Wire Transfer Embezzlement

Wire transfer schemes may involve manipulation or alteration of the company’s own accounts or transfer instructions, falsified customer instructions, compromised email accounts, or unauthorized changes to beneficiary details. Faxed transfer instructions from an unauthorized source remain a possible legacy channel. An employee assigned to the wire transfer function may act alone, coordinate with another employee, or provide information made available to an external source that completes the theft.

A controlled wire transfer request should record the requester, purpose, destination, authorization, verification, release, and reconciliation. The Office of the Comptroller of the Currency says dual controls and segregation of duties should be part of payment processes to help prevent and deter fraud.

Use separate receiver, sender, validator, and reviewer roles where volume and staffing permit. Verify new payment requests and changed account details through a trusted channel before release. The FBI recommends verifying payment and purchase requests in person or by calling a known contact. Review transfer documents and reconcile the bank activity independently after release. A documented wire transfer procedure makes these responsibilities clear.

(6) Computer Embezzlement

Computer embezzlement uses authorized or unauthorized access to, or manipulation of, a computer system to divert funds, alter records, transfer title to property, conceal transactions, or impair the company’s ability to investigate. Examples include skimming customer account information, electronically transferring a small amount from each transaction to another account, changing transaction data, inserting extra commands into a computer program, erasing data, or neutralizing control mechanisms. Older descriptions call some of these techniques salami schemes, trap door techniques, data diddling schemes, Trojan horse programs, or logic bomb commands. The terms may be dated, but the control problem remains: one person has enough access to change both the transaction and its evidence.

Written computer system security policies and procedures should properly identify and document persons accessing any system through direct, remote, or network access. Assign every user a named account, control access to information by role, protect privileged accounts, routinely monitor employees’ work and levels of access, retain activity logs, notify appropriate persons of unauthorized activities, and require periodic independent reviews of system controls and integrity. Shared credentials should not be used. Current NIST guidance says organizations should not require periodic password changes unless there is evidence that a password has been compromised. Use unique credentials, multifactor authentication where available, compromised-password screening, and prompt removal of access when responsibilities change.

Common Embezzlement Schemes

The six areas describe where opportunities appear. The following ten examples describe how misuse or misappropriation can occur inside those areas. They are examples rather than a frequency ranking, and an investigation should determine what actually happened before anyone labels conduct as criminal.

1. Using Company Assets for Personal Gain

• Using the company’s telephones, copy machines, and mail services for personal business.
• Using the company’s equipment, machinery, vehicles, supplies, and computer programs for personal business.
• Using the company’s expense accounts and credit cards to pay personal expenses.
• Creating cash loans from one’s own area of control to pay personal expenses on a temporary basis.

2. Stealing Company Assets

• Wiring funds from company or customer accounts to secret personal accounts.
• Stealing cash or negotiable documents from another employee’s area of control.
• Creating ghost employees in the payroll system.
• Converting titles to double-ordered, abandoned, or stored company property, then selling the property.
• Burglarizing the company’s premises, dual-custody containers, or safe-deposit boxes.

3. Forging or Altering Company Documents

Examples include altered signature cards, powers of attorney, refund documents, money orders, travelers checks, cashier’s checks, purchase records, or other accounting documents. Compare each approval with the supporting source record and investigate changes made after approval.

4. Manipulating Account Balances

An employee may make unsupported adjustments, move amounts between accounts, or exploit a dormant account. Account manipulation can use legitimate system permissions, compromised credentials, or collusion. Strong business cybersecurity helps, but accounting review and reconciliation are equally important.

5. Hiding Assets

Merchandise, cash, computer data, account information, raw materials, or scrap can be hidden in a work area, storage location, vehicle, or garbage container for later retrieval by the employee or a confederate. A chain of custody and periodic physical counts connect the record to the asset.

6. Establishing Fictitious Accounts

Fictitious accounts may support phony loans, lines of credit, payroll entries, vendors, customers, or deposit accounts. Require independent approval for master-data creation and changes, then compare new or changed records with source documentation.

7. Accepting and Holding Favors

An employee may hold favorite customers’ or coworkers’ post-dated checks until they can make a corresponding deposit to the paying financial institution, sometimes in exchange for a fee or favor. A consistent problem checks procedure should define escalation, approval, and documentation.

8. Assisting a Friend in Operating Credit for a Fee

An employee may assist a customer, friend, or coworker in operating credit, interest, and check kites or bust-out schemes for a fee or another benefit. Review related-party patterns, override activity, unusual account changes, and exceptions approved by the same person.

9. Short-Changing Customers During a Transaction

Short-changing includes deliberately returning less than the correct amount or reusing an item that should have been surrendered, such as a ticket that is accepted and then resold. Receipts, drawer balancing, transaction logs, customer complaints, and camera review where lawful can help identify a pattern.

10. Secret Unsecured Personal Loans from Favorite Customers

An employee may grant an unauthorized loan or exception to a favored customer, or may borrow secretly from a customer whose account the employee influences. A written credit policy is only effective when access, approval, exception reporting, and independent testing show that employees follow it.

A Practical Embezzlement Control Checklist

Use this checklist to match a scheme with the evidence and control that matter most. It is an illustrative starting point, not a substitute for legal advice, an investigation plan, or controls designed for your industry.

Scheme	Evidence to Review	Preventive or Detective Control
Cash skimming or false refunds	Register detail, refund records, approvals, drawer counts, bank deposits	Separate cash custody from reconciliation and require approval for exceptions
Ghost employee or fictitious vendor	Master-data changes, tax or identity records, payment destination, access logs	Independent setup approval and recurring duplicate-data review
Altered payment instructions	Original request, change history, callback record, approver identity	Out-of-band verification and dual authorization before release
Inventory or equipment diversion	Receiving log, transfer record, count sheet, disposal record, access history	Separate receipt, recordkeeping, custody, and physical count
Unauthorized account adjustment	Source document, adjustment log, dormant-account alert, reviewer sign-off	Role-based access, supervisor approval, exception reporting, independent reconciliation

• Assign ownership. Name the employee responsible for custody, authorization, recordkeeping, and review.
• Separate incompatible duties. One person should not control a transaction and all evidence that proves it occurred correctly.
• Require evidence. Approvals should point to source records, not rely on verbal confirmation alone.
• Review exceptions. Refunds, overrides, dormant-account activity, new payees, changed bank details, write-offs, and unusual transfers deserve prompt review.
• Reconcile independently. Compare records with bank activity, inventory, cash, and supporting documents.
• Protect system access. Use named accounts, appropriate roles, multifactor authentication where available, retained logs, and prompt access removal.
• Plan the response. Preserve evidence, restrict access carefully, and follow a documented process for suspected workplace fraud.

Areas of Embezzlement Risk and Common Embezzlement Schemes

Embezzlement methods are limited only by access, opportunity, and the ability to conceal evidence. The six risk areas help you identify where that opportunity exists, while the ten scheme examples help you recognize how it can be used. A sound control system combines written procedures, authorization, secure custody, accurate records, system access controls, exception reporting, and independent review.

Continue with fraud prevention and detection guidance, or use the Embezzlement Prevention Guide to reduce exposure to waste, fraud, and abuse of financial assets and to document responsibilities and control steps. You can also download free policy and procedure samples to see how easy it is to edit Microsoft Word templates and build a policy and procedure management system.