Employee Embezzlement: The Minnesota Owner's Playbook

Preserve the Evidence Before You Confront Anyone

The instinct is to walk into the office and demand an explanation. Resist it for at least a day. The moment an embezzler knows you know, the records start disappearing: the laptop gets wiped, the email account gets cleaned out, the QuickBooks entries get adjusted, the personal bank account gets emptied.

Do these things first:

• Lock down the devices and accounts quietly. Image the company laptop and phone rather than handing them to IT for a routine wipe. Preserve the email mailbox, including deleted items. Suspend automatic deletion or retention purges on anything the employee touched.
• Pull the paper trail yourself. Gather bank statements, canceled checks, credit card statements, vendor invoices, payroll records, expense reimbursements, and the accounting-system audit log. Note who has access to change entries.
• Track chain of custody. Write down who took what, when, and where it is stored. A recovery case that depends on documents nobody can authenticate is a weaker case.
• Do not tip off the employee. Hold off on any confrontation, company-wide announcement, or sudden change to their system access that signals an investigation until the evidence is secured. The exception is money: quietly remove the employee’s authority to sign checks, approve payments, or move funds, because crime policies often stop covering an employee’s thefts once you learn of that employee’s dishonesty.
• Identify the scope before you decide anything. A single skimmed deposit and a three-year vendor-invoice scheme call for different responses. You cannot size the insurance claim, the civil demand, or the criminal referral until you know the number.

Do You Fire the Employee?

Most likely, but not on the day you find out, and not before you have your attorney’s advice. Firing the employee before the evidence is secured can cost you records you need. If the employee is still working while you investigate, a paid suspension is usually cleaner than an abrupt termination. It removes their access without creating a wage dispute or giving the employee a basis to claim retaliation before you understand what happened. When you do discharge the employee, Minnesota’s final-paycheck rules still apply in full.

Build Your Checklist With a CPA and an Employee Theft Attorney

Your first calls should go to a CPA and an outside attorney, not the police. Ask the CPA to review all of the books, starting with any money you hold for clients and then every large transaction connected to the employee. An employee who confesses often admits to only part of what was taken, so the theft you know about may be a fraction of the loss. If the money moved through several accounts, a forensic accountant can trace it, which supports both the insurance claim and any claim to an asset the employee bought.

Bring in an outside attorney even if you know this area of law. When I discovered that an employee had misappropriated client money, I hired an outside attorney because the betrayal and anger made it hard to think clearly about my own obligations. Acting on professional advice also builds a record that you handled the theft with care.

Build the response checklist with both of them. It should answer these questions:

1. What does the insurer need, and by when? Crime policies commonly require notice as soon as possible after you discover a loss and a sworn proof of loss within a set number of days.
2. Which government agencies or licensing boards must hear about it? That depends on your industry. A national bank, for example, must file a suspicious activity report when it has a substantial basis for identifying one of its own directors, officers, or employees as having committed a known or suspected federal crime against the bank, “regardless of the amount involved in the violation,” under 12 C.F.R. § 21.11(c)(1), and no later than 30 calendar days after first detecting the facts. In my case, my outside attorney advised me to report the misappropriation to the board that handles attorney discipline, and I did.
3. Which clients or customers must be told? If the employee took money or property you held for someone else, that person should hear it from you, along with how you will make them whole. If the employee took customers’ computerized personal information, such as Social Security numbers or card numbers with the codes needed to use them, Minn. Stat. § 325E.61, subd. 1, may require notice to each affected Minnesota resident “in the most expedient time possible and without unreasonable delay.” The statute excuses an employee’s good-faith access to that information only if the information “is not used or subject to further unauthorized disclosure.”

Treat the theft you know about as a sign that there may be more, and keep the review going until the books reconcile.

What to Do When You Discover Employee Theft (Video)

In this video, I explain what I did when an employee told me he had misappropriated $40,000 of client money. I told him to put the full amount back that day, asked a CPA to examine all of our client money and every large transaction connected to him, and hired an outside attorney. Before deciding whether to fire him, I had our tech support company back up his computer and arrange to preserve his phone.

My free one-page checklist of seven common legal mistakes made by new businesses is at aaronhall.com/free.

When a Customer Accuses Your Employee of Theft

A customer’s report that your employee stole from them puts two things at risk at once: the customer’s trust and your employee’s reputation. Run the same investigation you would run for a theft from the company, and finish it before anyone is accused.

• Get the customer’s account in writing. Ask what is missing, when the customer last saw it, why they suspect your employee, and whether they have receipts, photos, or messages.
• Preserve your records and the employee’s devices. Secure them as you would for a theft from the company, including schedules, access logs, and payment records.
• Investigate before you accuse. In Wirig v. Kinney Shoe Corp., 461 N.W.2d 374 (Minn. 1990), a store accused an employee of theft at a meeting of all employees, relying on a coworker who may have been biased and on secondhand hearsay, without investigating. The Minnesota Supreme Court held that the store had no qualified privilege for the accusation and reinstated the jury’s compensatory damages for defamation.
• Keep the accusation among the people who need to know. In Bahr v. Boise Cascade Corp., 766 N.W.2d 910 (Minn. 2009), the Minnesota Supreme Court agreed “that statements made in the course of an employer’s investigation into employee misconduct are protected by the qualified privilege,” and it held the evidence insufficient to show actual malice by an employer that repeated the accusations only to employees likely to have information and interviewed the accused employee twice.
• Make the customer whole once the facts are in. Under Hagen v. Burmeister & Associates, Inc., 633 N.W.2d 497 (Minn. 2001), respondeat superior liability “is not based on fault of the employer,” so your business may be legally responsible for the loss even if you did nothing wrong. An employer is vicariously liable for an employee’s intentional tort when the tort “is related to the employee’s duties” and “occurs within work-related limits of time and place,” and whether that kind of misconduct is foreseeable in your business is an important consideration.
• Check your crime policy for client coverage. Some crime policies cover an employee’s theft of a client’s property as a separate coverage, and some treat a customer’s claim against you as the moment you discovered the loss, which starts the notice deadline.

How to Get an Employee to Admit to Theft

A careful interview is your best chance at an admission, and it is part of the investigation that gives an employer reasonable grounds to accuse anyone of theft. In Wirig, the Minnesota Supreme Court observed that in every case where it had found an employer had probable cause for its statements, “investigative steps had been taken, including personal questioning of the affected employee.”

• Hold the interview after the evidence is secured. By then your CPA should know enough for you to ask about specific transactions. An interview held too early warns the employee before the records are safe.
• Have two company representatives present. One asks the questions and one takes notes. Ask your attorney whether to attend.
• Ask about the documents. Walk through specific transactions and ask the employee to explain each one. Open questions get more information than accusations do.
• Get a signed statement. Ask the employee to write what happened in their own words, then sign and date it.
• Keep any repayment promise in a separate document. If the employee offers to repay through payroll deductions, Minn. Stat. § 181.79, subd. 1(a), requires a voluntary written authorization, made after the loss, that sets out the amount to be deducted each pay period. The same subdivision provides that the authorization “shall not be admissible as evidence in any civil or criminal proceeding,” so keep it apart from the written statement.
• Do not threaten, and do not block the door. Minn. Stat. § 609.27, subd. 1, makes it coercion to cause someone to act against their will by “a threat to make or cause to be made a criminal charge, whether true or false,” and its list of threats also includes a threat to unlawfully hold the person in confinement. Physically keeping the employee in the room can support a false imprisonment claim, which, under Blaz v. Molin Concrete Products Co., 244 N.W.2d 277 (Minn. 1976), requires “words or acts intended to confine,” “actual confinement,” and the person’s awareness of being confined. Tell the employee they are free to leave, and leave the door open.
• Treat an admission as the start of the scope review. Employees who confess often admit to only part of what they took. Give the admission to your CPA and keep reviewing the books.

Do Not Take It Out of Their Paycheck

This is the trap. You are owed money, the employee is owed a final paycheck, and the arithmetic seems obvious. Minnesota law says otherwise.

Minn. Stat. § 181.79, subd. 1(a), provides:

No employer shall make any deduction, directly or indirectly, from the wages due or earned by any employee, who is not an independent contractor, for lost or stolen property, damage to property, or to recover any other claimed indebtedness running from employee to employer, unless the employee, after the loss has occurred or the claimed indebtedness has arisen, voluntarily authorizes the employer in writing to make the deduction or unless the employee is held liable in a court of competent jurisdiction for the loss or indebtedness.

The deduction rule itself has two exceptions: a written authorization the employee signs voluntarily after the loss, or a court judgment holding the employee liable. Your own certainty that they stole the money is not one of them. Check any collective bargaining agreement before you rely on those exceptions, because under subd. 1(c) the section does not apply where a collective bargaining agreement contains a contrary provision. Under subd. 1(b), even an authorized deduction may not exceed the amount the law makes subject to garnishment from wages. An employer who deducts anyway is liable in a civil action for twice the amount of the deduction under subd. 2.

The final-paycheck timing rule compounds the risk. Under Minn. Stat. § 181.13(a), when you discharge an employee, wages actually earned and unpaid are immediately due upon the employee’s written demand, and if they are not paid within 24 hours of that demand, the employer is in default. The discharged employee may then collect a penalty equal to their average daily earnings for each day the employer stays in default, up to 15 days.

So the self-help deduction produces the worst version of this case: you still have to pursue the stolen money through the courts, and now the embezzler has an affirmative wage claim against you with a doubling provision and a daily penalty attached. Pay the final wages on time and recover the theft through the channels built for it. The final pay rules for Minnesota employers cover the mechanics.

What You Can Actually Recover

The civil theft statute. Minn. Stat. § 604.14, subd. 1, is the centerpiece:

A person who steals personal property from another is civilly liable to the owner of the property for its value when stolen plus punitive damages of either $50 or up to 100 percent of its value when stolen, whichever is greater.

In plain terms, the theft statute lets you sue for what was taken plus punitive damages of up to the same amount again. The statute does not define “steals.” In TCI Business Capital, Inc. v. Five Star American Die Casting, LLC, 890 N.W.2d 423 (Minn. Ct. App. 2017), the Minnesota Court of Appeals read the word to mean that a person “wrongfully and surreptitiously takes another person’s property for the purpose of keeping it or using it,” and held that an officer who moved company funds by wire transfer and falsified accounting entries, with no intent to keep or use the money, did not steal it. An employee who kept or spent the money falls within that reading. An employee who only moved money between accounts may not.

Several subdivisions of the statute matter more than owners expect:

• Subd. 4 states that filing a criminal complaint, a conviction, or a guilty plea is not a prerequisite to liability. You do not need the prosecutor to act before you sue. The subdivision also provides that payment or nonpayment may not be used as evidence in a criminal action.
• Subd. 5 provides that recovering the stolen property does not affect liability under the section, other than liability for the value of the property. Getting the laptop or other stolen goods back does not extinguish the punitive-damages exposure.
• Subd. 6 allows a written demand for payment before you file suit, and it contemplates that the demand include a copy of the statute and a description of the liability it imposes. A demand letter that puts the doubling provision in front of the employee, with the evidence behind it, can resolve the matter without litigation.

Other claims to plead alongside it. These matter most when the facts do not fit the civil theft statute, or when the employee has spent the cash but holds a traceable asset.

• Fraud and breach of fiduciary duty. In TCI, the falsified records that failed as civil theft and conversion still supported the company’s claims for fraudulent misrepresentation and breach of fiduciary duty, which the court sent back for a trial on damages even though the officer had not profited. A fiduciary duty claim fits an officer or manager.
• Conversion. Conversion fits tangible property, such as inventory, equipment, or cash kept apart. It fits money moved electronically poorly: in TCI, the Court of Appeals read its own precedent to allow a conversion claim for money “only if the money is in a tangible form (such as a particular roll of coins or a particular stack of bills) and is kept separate from other money.”
• Unjust enrichment. This equitable claim reaches something of value the employee “knowingly received or obtained” and “in equity and good conscience” should pay for, under ServiceMaster of St. Cloud v. GAB Business Services, Inc., 544 N.W.2d 302 (Minn. 1996).
• Constructive trust. A constructive trust follows the money into what it bought. In Thompson v. Nesheim, 159 N.W.2d 910 (Minn. 1968), the Minnesota Supreme Court called it “a well-established doctrine that where one person misappropriates property of another and converts it into another species of property, the defrauded party can assert equitable rights in the traceable product, unless the rights of a bona fide purchaser without notice have intervened.” That is how an owner reaches the truck or the down payment rather than an empty bank account, if the CPA can trace the stolen money into it.

Criminal restitution. If the employee is convicted, restitution runs alongside your civil claim rather than replacing it. Under Minn. Stat. § 611A.04, subd. 1(a), a crime victim has the right to restitution as part of the disposition of the criminal charge, a request may include out-of-pocket losses resulting from the crime, and an actual or prospective civil action may not be used as a basis to deny it. Under subd. 3, the offender gets credit in any civil judgment for restitution already paid for the same injuries.

The Criminal Referral Decision, and the Line You Cannot Cross

Reporting is a business decision with real considerations on both sides. Charges create restitution leverage and a public record that deters the next person. They also hand control of the timeline to a prosecutor whose priorities are not your recovery, expose the matter to publicity you may not want, and can slow your civil case while the criminal matter proceeds.

Value drives the exposure for theft of company property. Under Minn. Stat. § 609.52, subd. 3, theft of property or services worth more than $5,000 carries imprisonment of up to ten years or a fine of up to $20,000. The twenty-year tier and its $100,000 fine apply if the property is a firearm, or if both a value over $35,000 and a conviction under one of the specific clauses of subdivision 2 that subdivision 3 enumerates are present. Those include obtaining property by false representation and by swindling, and, directly on point for embezzlement, diverting corporate property with intent to defraud. An insider who moves more than $35,000 of company assets can therefore face the twenty-year tier, while the same amount charged under the general taking clause, subdivision 2, clause (1), stays in the ten-year tier.

Here is the line. Do not offer to withhold a criminal report in exchange for repayment. Under Minn. Stat. § 609.27, subd. 1, a person who makes one of the threats the statute lists and thereby causes another, against that person’s will, to do an act or forbear doing a lawful act is guilty of coercion. The listed threats include, at clause (5), “a threat to make or cause to be made a criminal charge, whether true or false.”

Making that trade can expose you to a coercion charge of your own. The correct path is to keep the two decisions separate: negotiate a civil settlement and release on the merits of the civil claim, and decide independently whether to report. An employee facing a documented civil claim may choose to pay to resolve it. Have your attorney write the agreement so the settlement rests on the claim rather than on a threat.

Insurance Is Often the Fastest Money

A standard commercial property policy usually excludes theft and other dishonest acts by your own employees. The coverage that responds is a crime policy or fidelity bond, through its employee theft coverage, sometimes called employee dishonesty coverage.

Read the policy in the first days, not the last. Crime policies commonly require notice as soon as possible after you discover a loss, sometimes with an outside limit such as 90 days, and a detailed, sworn proof of loss within a set period, such as 120 days. Policies often define discovery as the moment you first learn facts that would lead a reasonable person to conclude a covered loss has occurred, even before you know the amount, so the clock can start well before your investigation ends. The investigation file you built in the first week is also the file the carrier will want, which is another reason the evidence work comes first.

Close the Hole That Let It Happen

Every embezzlement has a control failure behind it, and the same failure is usually still open the day you discover the theft. The recurring ones are simple: one person both writes checks and reconciles the bank statement; nobody outside accounting reviews the vendor list; the owner signs whatever is in the stack; nobody takes mandatory vacations, so nobody else ever touches the books.

Separate the duties, require a second signature above a threshold, review new vendors and the bank reconciliation yourself, and audit the expense and payroll files at random intervals. For the broader set of controls, see how to protect your business from employee fraud. If the discovery is part of a larger performance or conduct problem, the Minnesota problem-employee legal playbook covers the discipline and termination side. The underlying claims here sit within the business torts practice area.

In the first 48 hours, secure the evidence, bring in a CPA and an attorney, pay the final wages correctly, and read the insurance policy. Then send a demand letter that puts the civil theft statute and a documented file in front of the person who took the money.