Signs an Employee Is Committing Fraud — an Investigator's List

Updated 31 July 2026 by K3K Investigations

The signs are rarely dramatic. In the cases that cross our desk, employee fraud looks like a pattern that has quietly become normal: the sick note that always follows a denied holiday, the supplier only one person is allowed to deal with, the "bad back" that coexists with a five-a-side league. This guide lists what employers actually see — and the mistake most make next.

The Association of Certified Fraud Examiners' long-running global study estimates organisations lose around 5% of revenue to fraud each year, and that tips remain the most common route to discovery — meaning most schemes surface late, after someone finally says something. For a UK small business, one dishonest employee is not a rounding error; it is often the margin.

The behavioural signs investigators actually see

No single item below proves anything. It is the pattern — and how the person reacts to ordinary scrutiny — that matters:

Lifestyle outrunning salary. The new car, the holidays, the watch — unexplained and un-mentioned.
Never taking leave, never being ill — because two weeks away means someone else opens the post. Gatekeeping is the classic tell of invoice and supplier fraud.
One-person territories. A supplier, customer or system only they handle, with records that are always "in hand" and never quite available.
Defensive escalation. Ordinary questions about records or process met with disproportionate pushback, grievances or sudden resignations.
Duplicate, round-number or just-under-threshold invoices — amounts engineered to sit below approval limits.

Sickness-absence fraud: the version we see most

The most common workplace instruction K3K receives from UK employers is long-term sickness absence that does not add up: certified as unable to work, visibly active everywhere else. The pattern employers describe is consistent — absences clustering around weekends and denied leave, social media quietly locked down, and colleagues who knew long before HR did. Our case story The Six-Month Bad Back shows how one plays out, and why the answer was lawful surveillance rather than confrontation.

Expenses, theft and moonlighting

Three more patterns worth naming. Expense creep: mileage that assumes every journey starts from home, per-diems on days that diaries show elsewhere, receipts that photocopy suspiciously well. Stock and cash leakage: shrinkage that tracks one person's shifts. Moonlighting on your time: the field engineer or night-shift supervisor running a second job — or their own competing business — inside hours you are paying for. Each of these is provable with lawful observation and records you already own; none is provable by asking the person.

What to do before you confront anyone

The most expensive step in most employee-fraud cases is the accusation made too early. Once challenged, evidence evaporates: records are tidied, stories align, and a mishandled process can turn a thief into a successful unfair-dismissal claimant. Before any confrontation:

Preserve what you already hold — invoices, rotas, expense claims, access logs, CCTV you lawfully operate. Quietly, and outside systems the person controls.
Keep the circle small. Tips are how frauds surface; leaks are how investigations die.
Check proportionality. UK GDPR and the ICO's employment guidance allow investigation of reasonable suspicion — provided it is targeted, documented and proportionate rather than blanket snooping.
Get independent evidence before the meeting, not after it. An HR process built on suspicion alone collapses; one built on timestamped, third-party evidence rarely needs to fight at all.

How a professional investigation closes the case

An external investigator gives you two things HR cannot generate internally: lawfully obtained independent evidence — surveillance of activities in public, verified moonlighting, documented patterns — and distance, so the disciplinary process stands on a third-party report rather than a manager's hunch. Evidence is timestamped, chain-of-custody logged and prepared to the standard employment tribunals expect, then handed to your HR team or employment solicitor to run the procedure correctly.

Frequently asked questions

Is it legal to have an employee followed?

Yes — surveillance of an employee's activities in public places is lawful when there is reasonable suspicion, a legitimate aim (such as protecting your business from fraud) and a proportionate, documented approach. That proportionality assessment is part of what you are paying a professional agency to get right.

Can I check an employee's social media?

Publicly visible posts, yes — viewing what anyone can see is lawful, and public activity during certified sickness is frequently decisive evidence. Accessing private accounts by deception, borrowed logins or fake friend requests is not lawful, and taints everything it touches.

Will investigator evidence stand up at an employment tribunal?

Lawfully and proportionately gathered evidence is used in tribunals routinely. What matters is method: covert footage of public activities, obtained on reasonable suspicion and handled with a proper chain of custody, supports a fair disciplinary process. Your employment solicitor runs the procedure; our job is to make sure the evidence underneath it is solid.

What does a workplace investigation cost?

Most cases run one to three surveillance days — realistic UK day rates are £500–£1,200 per operative — plus reporting, quoted as a fixed price before we start. Against a full-time salary being paid for a fraudulent absence, or ongoing invoice leakage, the maths tends to be short. Full pricing context: what a private investigator costs.

Something not adding up? Describe the pattern to a senior investigator — free, confidential and without obligation — and we will tell you whether it is worth investigating and exactly what it would cost. Call 020 3343 7007 (24 hours) or book a call.