Employee Theft Investigation When You Suspect Someone on Staff
Suspecting someone you hired, trained and trusted is hard, and acting on a hunch can make things worse. Birds Eye helps Tennessee owners and managers build a quiet, documented picture of what is missing, who had the opportunity, and what the evidence supports.
- Cash, inventory, fuel, refund and time theft
- Evidence built before any confrontation
- Findings ready for counsel, insurer or police
What is going missing?
Pick the closest match and we will point you to the right next step.
How does a PI agency investigate employee theft?
The agency compares loss records against schedules and access to narrow who had opportunity, then gathers lawful evidence through document review, observation, controlled checks and interviews. The goal is a factual, sourced account that supports a fair decision about discipline, termination, civil recovery, an insurance claim or a police report.
The Many Forms Employee Theft Takes
Theft by staff is seldom a single dramatic event. It tends to be small, repeated and designed to blend into normal activity: a cashier who voids sales after the customer leaves, a warehouse worker who under-counts a delivery and loads the difference into a personal vehicle, a manager who issues refunds to a relative's card, or a driver who fills a personal truck with the company fuel card.
Time theft belongs on the list too. Buddy punching, padded timesheets and paid hours spent running a side business cost real money even though nothing physical leaves the building. Each form leaves different traces, which is why an employee theft investigation starts by defining exactly what is being lost.
- Register voids, no-sales and fake refunds
- Inventory diverted during receiving or shipping
- Fuel card, company card and expense abuse
- Scrap, returns and damaged-goods write-offs
- Payroll padding and buddy punching
Matching Losses to Schedules and Access
Before anyone is watched or questioned, we line up the numbers. Shortage dates go beside shift schedules, key and alarm logs, point-of-sale user IDs and delivery records. When losses appear only on certain days, or only when a specific combination of people is working, the pool of possible explanations shrinks quickly.
This stage also protects innocent staff. Rumors in a small business tend to settle on whoever is least liked, and that person is often not the one responsible. A schedule-based analysis gives the owner an objective reason for focusing on some people and clearing others, which matters later if a termination is challenged.
Gathering Evidence Without Tipping Anyone Off
Once the likely window and people are identified, our PIs choose methods that fit. That can mean reviewing your own camera footage against transaction logs, lawful observation of a loading dock or parking lot from public vantage points, following a vehicle to see where goods go, or checking online marketplaces for items matching your stock.
Controlled checks are sometimes useful, such as a documented purchase to see whether it is rung up correctly. These are planned carefully and documented from start to finish. We do not install hidden audio recorders, since Tennessee's one-party-consent rule does not allow recording conversations no one on your side is part of.
Talk it through with a licensed PI
Tell us what is happening. We will explain what the work involves and put scope, timeline and cost in writing before anything starts.
When and How the Interview Happens
The interview comes last, after the documents and observations are organized. A well-prepared interview is calm and fact-based: the employee is shown what the records reflect and given a fair chance to explain. Some people admit the conduct and agree to repay. Others offer an explanation that checks out, which is exactly why the question should be asked.
We recommend a witness in the room, no threats about criminal charges in exchange for repayment, and no blocking of exits. Your attorney can advise on how statements and any repayment agreement should be handled so they hold up later.
Termination, Recovery, Insurance or Police
Owners usually have several paths and can take more than one. You may terminate under your policies, pursue civil recovery with counsel, submit a claim if you carry employee dishonesty or crime coverage, or report the matter to local police. Many policies have notice requirements, so review yours early.
The same report can support each path because it separates what was observed, what records show and what the employee said. Police in Nashville, Knoxville or a smaller county seat are far more able to act on a clear, organized packet than on a general complaint that money is missing.
Fixing the Weakness That Allowed It
Every theft reveals a control gap: one person handling cash and deposits, refunds without manager approval, inventory counts done by the same people who receive shipments. Our report notes the gaps we observed so you can fix them before the next hire tests the same weakness.
If you want a broader look at controls rather than a single incident, a fraud risk audit or an unannounced shock audit may be the better next step.
What an Employee Theft Case Can Include
Loss pattern review
Comparing shortages against shifts, user IDs and access logs.
Camera footage review
Matching your existing video to specific transactions and times.
Lawful surveillance
Observing where goods or people go from public places.
Resale checks
Searching marketplaces and pawn listings for items matching your stock.
Structured interviews
Fact-based interviews planned with you and, where needed, counsel.
Case packet
An organized report suited to counsel, an insurer or law enforcement.
From Suspicion to Documented Answer
Describe the loss
You share what is missing, how you know, and who has access.
Agree on scope
Scope, timeline and cost are written down before work begins.
Investigate quietly
Records, observation and checks narrow the field without alerting staff.
Decide with facts
You receive a sourced report and choose discipline, recovery or referral.
Theft types, typical signals and the evidence that tends to help
| Type of theft | Typical signal | Evidence that usually helps |
|---|---|---|
| Cash skimming | Shortages on certain shifts | POS user logs matched to camera footage |
| Refund fraud | Refunds without receipts or to repeat cards | Refund reports and card matching |
| Inventory diversion | Counts off after deliveries | Receiving records and dock observation |
| Fuel card abuse | Fill-ups beyond tank capacity | Card data compared with vehicle logs |
| Time theft | Hours logged while work is not done | Badge data, GPS on company vehicles, observation |
| Scrap or return abuse | High write-offs in one department | Write-off approvals and resale checks |
Steps to Take Right Now
What you do in the first days shapes what can be proven later.
Statewide coverage from Nashville
Birds Eye takes employee theft cases for restaurants, retailers, clinics, contractors and warehouses throughout Tennessee. That includes Nashville, Murfreesboro and Clarksville in Middle Tennessee, Knoxville and Johnson City in East Tennessee, and Memphis and Jackson in West Tennessee, along with smaller towns where everyone knows the owner's truck. Our PIs plan observation to stay unnoticed in both settings and deliver records in a form local police and courts can follow.
All service areasNashvilleMemphisKnoxvilleChattanoogaProcess serving
Frequently Asked Questions
Can I fire an employee I think is stealing without proof?
Tennessee is generally an at-will employment state, but firing on suspicion alone can lead to disputes over unemployment benefits, defamation claims if accusations spread, or missed recovery. Documented facts protect the business. Your attorney can advise on your specific situation and any contract or policy that applies.
Can I make an employee pay back what they stole?
An employee may agree to repay, and counsel can put that in writing. Avoid pressuring anyone by promising not to call police in exchange for payment, which can create legal problems. Civil recovery through the courts is another option your attorney can explain. Keep any agreement, and the amounts involved, documented and signed.
Is it legal to put hidden cameras in my store?
Video in open work and sales areas of your own business is common, but restrooms, changing areas and similar private spaces are off limits, and hidden audio recording raises separate problems. Ask your attorney before adding cameras for an investigation, and tell your PI what already exists.
What if the thief is a family member or longtime manager?
These cases are common and emotionally difficult. The approach is the same: quiet fact-gathering, then a decision. Owners sometimes prefer a private resolution, and a clear report makes that conversation more honest and less likely to turn into an argument over what happened. The facts also help family members see the situation the same way.
Will police take an employee theft report?
Usually yes, though many departments have limited time for smaller business losses. An organized packet showing dates, amounts, records and observations makes it easier for officers and prosecutors to evaluate the case and decide whether charges are appropriate. Include copies of records, not just a summary, and keep your originals secured for later use.
How long does an employee theft case take?
It depends on how often the theft occurs and how much existing data you have. A pattern that repeats weekly can be documented faster than occasional losses. We discuss the likely timeline during intake and put it in writing with the scope before starting. If the pattern changes midstream, we tell you before extending the work.
Related pages
Get the Facts Before You Act
Call or text (629) 310-8667 or email contact@delatorgroup.com to talk through what is missing and what can be documented.
Photography: Matthew Jackson (Unsplash License). Last reviewed . General information, not legal advice.
