I don’t like being the bearer of bad news. But I’d rather tell you now than watch you learn it the hard way. Embezzlement, fraud, and financial manipulation happen in small businesses more often than anyone wants to admit. According to the Association of Certified Fraud Examiners (ACFE) Report to the Nations, small businesses lose a higher percentage of revenue to fraud than large companies, and the median loss is measured in six figures.

And here’s the thing that gets me every time: it’s almost always someone the owner trusted.

So let’s talk about red flags. Not to make you paranoid. To make you informed.

Behavioral red flags to watch for:

  1. An employee who refuses to take vacation.
    • Sometimes they’re dedicated. Sometimes they can’t step away because the fraud would be discovered.
  2. An employee living visibly beyond their means.
    • New car, new boat, weekend trips. Ask yourself how.
  3. An employee who insists on handling everything personally.
    • Won’t delegate. Won’t let anyone else see the books. Gets defensive when you ask questions.
  4. Unusual closeness with vendors.
    • Especially vendors you’ve never met or who don’t have a clear business purpose.

Financial red flags in your books:

  1. Round-number transactions that don’t match any invoice
  2. Frequent adjustments or “miscellaneous” entries
  3. Vendor addresses that match employee addresses
  4. Payroll hours that don’t match timesheets
  5. A growing gap between sales and bank deposits
  6. Checks made out to cash (this should basically never happen)
  7. Voided transactions that keep happening

What to do about it:

  1. Separate duties.
    • The person who writes checks should not reconcile the bank statement. The person who enters invoices should not also approve payments.
  2. Require two signatures on checks over a set amount.
  3. Review your bank statements yourself. Every month. No exceptions.
  4. Run surprise audits.
  5. Use AI-powered anomaly detection.
    • Modern accounting platforms can flag unusual patterns, duplicate payments, and transactions that deviate from historical norms. This kind of automated monitoring catches things human eyes miss.

If you suspect something, don’t confront the person. Call your CPA, your attorney, and if warranted, law enforcement. The worst thing you can do is tip someone off before you’ve documented the issue.

I’ve had the conversation I’m about to describe more than once. An owner finds out a longtime bookkeeper has been skimming for years. The first words out of their mouth are always the same: “I trusted them.” Trust is wonderful. Trust with verification is better.