Legal Blog

The 4 Most Common Employee Theft Schemes and How to Protect Against Them

When it comes to large-scale employee theft, fraud examiners commonly encounter four major types of fraud schemes: billing, check tampering, expense reimbursement, and payroll fraud. Here are some tips on how to detect and prevent them in your workplace.

Billing Schemestheft

False billing schemes are often used to hide large thefts. There are three primary kinds of billing schemes:

  1. False invoicing via shell companies: The fraudster will set up a fake (shell) company that bills for goods or services. Perpetrators are frequently in positions to approve these false invoices and rely on false purchase orders and receiving documents to substantiate the lie. The names of shell companies tend to be similar to existing vendors working with the company.
  2. False invoicing via non-accomplice vendors: The fraudster double-pays or overpays an invoice, contacts the vendor, demands one check or payment be returned, and then intercepts the check before anyone else can see it. Perpetrators may alter the name on the check or the payee line, or create a counterfeit copy. These are commonly known as “pay-and-return” schemes.
  3. Personal purchases made with company funds: The fraudster authorizes improper purchases using company funds or simply buys merchandise to return for cash. For instance, a perpetrator may buy eight computers when the company only needs four, in order to return the surplus for a “refund” in cash or credit in their personal name.

Though personal purchases may seem straightforward and thus easy to spot, they can go unnoticed for long stretches of time. Companies should be vigilant and look for the following red flags:

  • Unfamiliar vendors
  • Invoices for unspecified or poorly defined services
  • Vendors that only have a P.O. Box address
  • Sudden increases in purchases from a particular vendor
  • Vendor addresses that match employee addresses
  • Unusually quick payment or double payment of invoices
  • Large billings that are broken into multiple, smaller invoices so as to not attract attention

Another indication of billing fraud are complaints from vendors. Take action whenever any vendor mentions they have been over- or underpaid, especially continually. It may be human error, or it could be theft. Finally, make time to regularly review and verify your vendor list. It is recommended that clients institute approval procedures, at least for new vendors, so multiple employees have to sign off on a purchase before it is made. Some organizations enact these policies for any purchase over $5,000 while others raise the ceiling to $25,000 and above.

Check Tampering Schemes

Check tampering schemes typically occur over a sustained period, rather than a single instance, for two main reasons: the fraudster has to keep the scheme going in order to avoid getting caught and is often enabled to do so due to their unbridled position at the company. A large percentage of perpetrators are also involved in reconciling their companies’ bank statements, meaning they have almost total control over corporate finances with little to no oversight. Check tampering schemes fall into four main categories:

  1. Forged maker: The fraudster forges an authorized signature on a company check and then endorses the check to themselves, or creates a dual endorsement by adding their name below the payee’s.
  2. Forged endorsement: The fraudster forges the signature of the check’s intended recipient.
  3. Altered payee: The fraudster changes the name to which the check was issued.
  4. Authorized maker: The fraudster modifies a valid check, e.g., by adding a zero to the end or a one at the start of the payment amount.

Be aware of red flags that indicate check tampering:

  • Voided checks
  • Missing checks
  • Altered endorsements or dual endorsements of returned checks
  • Returned checks with obviously forged or questionable signatures
  • Altered payees on returned checks
  • Customer complaints regarding payments not being applied to their accounts
  • Checks payable to employees, with the exception of regular payroll checks

In order to detect check tampering, companies should listen for customer complaints and take a careful look at their bank statements. Fraudsters often maneuver funds between different entities and may overlook applying payments in a timely manner, prompting customers to speak out when money remains in their accounts. If you receive these complaints, contact your bank to gain access to your statements and recently issued/cancelled checks. Though most corporate banking these days occurs online, companies can still access images and hard copies. Check tampering prevention methods are relatively uncomplicated. Make sure your checks come printed with physical tampering prevention and security features such as chemical stains, erasure protection, and microprinting. Checks should never be pre-signed and should never be cut by someone who is not a signatory on the recipient’s account. It is also recommended that bank statements be sent to the owner’s home precluding the fraudster from having the opportunity to open the mail and alter the statement prior to someone else reviewing it.

Expense Reimbursement Schemes

As with check tampering, there are four common and distinct forms of fraud through expense reimbursement:

  1. Mischaracterized expenses: The fraudster requests reimbursement for a personal expense by claiming it is related to the business.
  2. Overstated expenses: The fraudster requests reimbursement higher than what they paid by altering receipts or over-purchasing equipment.
  3. Fictitious expenses: The fraudster claims expenses through a fabricated or blank vendor receipt.
  4. Multiple reimbursements: The fraudster submits the same expense more than once.

These perpetrators aim to achieve their offenses by counting on “rubberstamp managers.” So the best—and perhaps only—recourse companies have to identify expense reimbursement fraud is through a thorough review and analysis of expense accounts and reports. Companies should also enact clearly defined expense reimbursement policies and procedures to deter potential fraudsters from relying on others’ follies.

Payroll Schemes

Employees engaged in payroll frauds disburse funds to themselves or other employees rather than external parties. The most common payroll frauds are:

  1. Ghost employees: Names of individuals added to the payroll who do not actually work for the victim company, or even exist. The fraudster falsifies personnel or payroll records, generates a “ghost,” and an accomplice collects the paychecks. Ghost employees may be fictitious or a real friend or relative of the perpetrator.
  2. Falsified hours and salary schemes: Overpayment of wages. The perpetrator may fraudulently inflate an employee’s work hours or wage rate, or increase an employee’s salary—sometimes changing facts all the way back to day one.
  3. Commission schemes: Falsified or exaggerated sales, or increased commission rates. The fraudster may lie about or overstate the results of a sale, thus collecting a higher commission. When commission is based on gross rather than net sales, employees can sometimes earn fraudulent pay by conspiring with customers on bogus deals.

Payroll schemes are extremely common and widespread throughout many industries. There are several ways to stop payroll schemes in the tracks. Companies can manually distribute paychecks rather than issuing payments automatically. The same goes for W-2 forms, which when distributed by hand can help employers identify the ghost employees. Look for duplicate Social Security Numbers, which can also point to fictitious employees.



Offit Kurman is one of the fastest-growing, full-service law firms in the Mid-Atlantic region. With over 135 attorneys offering a comprehensive range of services in virtually every legal category, the firm is well positioned to meet the needs of dynamic businesses and the people who own and operate them. Our eleven offices serve individual and corporate clients in the Virginia, Washington, DC, Maryland, Delaware, Pennsylvania, New Jersey, and New York City. At Offit Kurman, we are our clients’ most trusted legal advisors, professionals who help maximize and protect business value and personal wealth. In every interaction, we consistently maintain our clients’ confidence by remaining focused on furthering their objectives and achieving their goals in an efficient manner. Trust, knowledge, confidence—in a partner, that’s perfect.

You can connect with Offit Kurman via our Blog, Facebook, Twitter, Google+, YouTube, and LinkedIn pages. You can also sign up to receive Law Matters, Offit Kurman’s monthly newsletter covering a diverse selection of legal and corporate thought leadership content.