By Thomas W. Raftery III
Raftery served 22 years as an FBI Special Agent and was the first appointed Inspector General for the Delaware River Port Authority. He is a Certified Fraud Examiner and holds an MBA with a concentration in accounting.
The first question a business owner asks after discovering an internal fraud is almost never about the investigation. It is whether the money is coming back.
The honest answer is that most of it usually does not, and the reason has less to do with the law than with timing and arithmetic. Occupational fraud losses are typically spent rather than saved. By the time a scheme surfaces, the funds have become car payments, a mortgage, tuition, gambling losses, or transfers to people who had nothing to do with the scheme. Recovery is possible, and it happens regularly, but it depends almost entirely on decisions made in the first two weeks after discovery.
Can a Company Actually Recover Money Stolen by an Employee?
Yes, but recovery depends on what the stolen money became rather than on how much was taken. Funds that were converted into identifiable assets, transferred to third parties, or covered by insurance can often be reached. Funds that were consumed generally cannot be recovered from the employee, because there is nothing left to recover from.
That distinction reframes the whole exercise. The investigative question is not simply how much left the company. It is where each dollar went, what it turned into, and whether that thing still exists in a form the law can reach.
Why Recovery Rates Are Low
Two structural facts work against recovery, and both are visible in the ACFE's Occupational Fraud 2026: A Report to the Nations.
The first is duration. The typical scheme ran 12 months before detection, and the median loss across the 2,402 cases studied was $104,000, with an average loss exceeding $1.4 million. Every additional month is money that has already been spent by the time anyone is looking for it. The report's velocity analysis puts the ongoing cost at roughly $9,400 per month on average.
The second is response. In the 2026 findings, 68% of perpetrators were terminated by their employers and 54% of cases were referred to law enforcement. That means nearly half of confirmed occupational fraud cases were never referred at all. A termination ends the exposure. It does not return the money, and in a meaningful number of matters it is the only action the organization ever takes.
Where the Money Usually Goes
Occupational fraud is overwhelmingly asset misappropriation, which appeared in 90% of the cases in the 2026 study. These are not sophisticated offshore structures in most instances. They are payments to a shell vendor, payroll manipulation, expense abuse, or cash skimming, and the proceeds fund ordinary consumption.
That is why living beyond apparent means has been the most frequently observed behavioral red flag in every ACFE study since the data was first tracked, and why 84% of perpetrators in the 2026 study displayed at least one behavioral red flag before detection. The spending is the scheme's purpose, and it is also the thing that makes recovery difficult. A leased vehicle, a vacation, and a paid-down credit card are not recoverable assets.
What is recoverable tends to be narrower and specific: real property, titled vehicles, brokerage or retirement accounts, business interests, insurance policies with cash value, and transfers made to a spouse, relative, or friend who gave nothing in exchange.
What Does Asset Tracing Actually Involve?
Asset tracing reconstructs the movement of funds from the point of loss to their current form, and identifies what the money became and who currently holds it. It is a documentary exercise built to a standard that will survive challenge, not a search for hidden treasure.
Reconstructing the Flow of Funds
The starting point is the company's own records: the general ledger, payment files, vendor master data, payroll registers, expense systems, and bank statements. The objective is a transaction-level schedule showing each improper payment, its date, its authorization path, and its destination account.
This schedule becomes the backbone of everything that follows. The insurance claim, the civil complaint, and any restitution figure all rest on it, and each of those audiences will test it differently. Building it once, properly, is materially cheaper than building it three times under time pressure.
Identifying What the Money Became
From the destination accounts, the analysis moves outward through public and obtainable records: county property records, motor vehicle titles, UCC filings, corporate registrations, civil judgments and liens, and bankruptcy filings. The purpose is to identify assets acquired during the scheme period that are inconsistent with known legitimate income.
Timing carries evidentiary weight here. An asset purchased two weeks after a large improper payment, in an amount that approximates it, is a substantially stronger tracing argument than the same asset purchased years earlier. This is the same investigative logic that applies when vetting a counterparty's ownership and sources of wealth, run in the opposite direction.
Third-Party Recipients and Voidable Transfers
Money moved to a spouse, relative, or associate for no consideration is frequently the most recoverable category, and it is the one companies most often overlook. State fraudulent transfer statutes, adopted in most states as the Uniform Voidable Transactions Act, allow a creditor to unwind transfers made without reasonably equivalent value where the transfer left the debtor unable to pay.
Recipients are usually surprised to learn they are exposed. That surprise is itself useful, because a third party facing an unwinding action often settles faster and more cheaply than the employee will. The specific statute, look-back period, and available remedies vary by state, which is a question for counsel rather than for an investigator.
What Are the Four Recovery Routes?
There are four practical routes to recovery after an internal fraud: criminal restitution, a civil action, an insurance claim under employee dishonesty coverage, and negotiated repayment. They are not mutually exclusive, and the sequence in which they are pursued materially affects what each one yields.
Route One: Restitution Through a Criminal Prosecution
Where a federal prosecution results in conviction, restitution to the victim is mandatory for offenses against property committed by fraud or deceit under 18 U.S.C. § 3663A, and the court is directed to order the full amount of each victim's losses. The procedure for determining and enforcing that order is set out at 18 U.S.C. § 3664.
The practical limits matter as much as the statute. The prosecutor controls charging decisions, not the company. Restitution follows a conviction, which can be years out. And an order is not a payment: collection runs against a defendant who is frequently insolvent by the time sentencing arrives. Criminal referral is often the right decision for reasons other than recovery, including deterrence and the organization's own credibility with regulators and insurers.
Route Two: A Civil Action Against the Employee
A civil suit gives the company control that a criminal referral does not. The standard of proof is lower, the timeline is shorter, and the remedies can reach third-party recipients and specific assets rather than a general obligation to pay.
The leverage in a civil action is usually front-loaded. Federal Rule of Civil Procedure 64 makes state-law prejudgment remedies for seizing property available in federal court, and Rule 65 governs temporary restraining orders and preliminary injunctions. Freezing an account or attaching a property before the employee can move it is often worth more than the eventual judgment, and both require a supported evidentiary showing on very short notice. That is a forensic accounting deliverable, not a legal one.
Route Three: An Insurance Claim
Employee dishonesty coverage, whether written as a fidelity bond or as a crime policy endorsement, is the route that most reliably returns actual cash. It is also the one most often lost on technicalities.
Policies typically impose short notice deadlines running from discovery, define discovery narrowly, and require a sworn proof of loss supported by documentation the carrier can test independently. Carriers routinely dispute the loss period, the definition of a covered dishonest act, and whether the company's own records substantiate the figure claimed.
A proof of loss built from a documented transaction schedule and a stated methodology tends to survive that review. A number assembled from estimates and internal summaries tends not to. This is the same distinction that separates a defensible damages figure from an approximation, and it is why the underlying work matters as much as the credentials of whoever eventually presents it.
Route Four: Negotiated Repayment
Many matters end with a repayment agreement, and for smaller losses it is frequently the most rational outcome. It is also where companies do the most self-inflicted damage.
An agreement drafted without counsel can waive the insurance claim, release civil claims the company did not intend to release, create tax consequences, and generate a document that a prosecutor later reads as the company having resolved the matter privately. Any repayment arrangement should be negotiated with counsel and with the carrier on notice, not settled in a conference room the afternoon of the confrontation.
Why the First Two Weeks Determine the Outcome
Every route above depends on evidence that exists at the moment of discovery and is fragile from that moment forward.
Confronting the employee early feels decisive and usually is not. Once a subject knows, accounts get emptied, property gets retitled to a relative, devices get wiped, and the third-party transfers that were the most recoverable category become far harder to reach. Preservation and tracing should be substantially complete before the conversation happens, and that sequencing decision is one that a company only gets to make once.
The same window governs the evidentiary record. Imaging systems rather than browsing them, preserving email before retention policies run, and documenting who handled what and when are the difference between a claim that survives a carrier's review and one that does not. Those obligations attach on their own timeline, which is one of several reasons the decision to escalate from internal audit to a forensic engagement should be made early rather than after three weeks of internal effort.
What Kills a Recovery Case
- Confrontation before preservation. The single most common and most expensive error, and the one that cannot be undone.
- A loss figure that cannot be reconstructed. Carriers, courts, and prosecutors all test the number independently. An estimate that cannot be walked back to source documents fails all three tests.
- Missed policy deadlines. Notice provisions in employee dishonesty coverage often run from discovery rather than from the completion of an investigation. Waiting for certainty is how coverage is forfeited.
- Termination as the entire response. Removing the employee ends the exposure and closes off leverage at the same time. Recovery options should be assessed before the separation, not after it.
- Records generated without counsel. Internal notes, emails, and interview summaries created before counsel is engaged are ordinary business records, and they are usually discoverable.
A Practical Sequence
For most organizations, the order that preserves the most options looks like this. Engage counsel first, so the work that follows can be structured appropriately. Preserve records and systems before anyone is alerted. Put the carrier on notice within the policy window even if the loss figure is still preliminary. Build the transaction schedule and trace the funds. Then decide, with a documented loss figure in hand, which combination of the four routes is worth pursuing.
The confrontation comes near the end of that sequence rather than at the beginning. That ordering feels counterintuitive to most owners and is the single highest-value decision in the entire matter.
Frequently Asked Questions
Can you get money back from an employee who stole from the company?
Sometimes, and it depends on what the money became. Funds converted into identifiable assets such as real property, vehicles, or accounts can often be reached, and transfers to third parties who gave nothing in exchange are frequently recoverable. Funds that were simply spent generally cannot be recovered from the employee, because there is no remaining asset to reach.
Should we call the police first or investigate first?
Investigate and preserve first, with counsel engaged. A criminal referral is often appropriate, but law enforcement will need a documented loss figure and organized records to act on, and once a matter is referred the company loses control of timing and charging decisions. Referral is a stronger option after the tracing work is done, not before.
Does insurance cover money stolen by an employee?
Employee dishonesty coverage, written as a fidelity bond or as part of a crime policy, is designed for exactly this loss. Coverage turns on the policy language, the notice deadline running from discovery, and a sworn proof of loss the carrier can test against source documents. Many valid claims are reduced or denied on documentation and timing rather than on whether the fraud occurred.
How long does it take to recover money after employee fraud?
Insurance claims typically resolve fastest, often within months of a complete proof of loss. Civil actions run considerably longer, though prejudgment remedies can secure assets early. Criminal restitution is the slowest route because it follows a conviction, and an order to pay is not the same as collection from a defendant who may be insolvent.
What is asset tracing in a fraud investigation?
Asset tracing reconstructs the movement of funds from the point of loss to their current form. It combines the company's financial records with public records such as property, vehicle, corporate, and lien filings to identify what the money became and who holds it now. The output is a documented schedule that supports an insurance claim, a civil action, or a restitution figure.
Should we let the employee sign a repayment agreement?
Not without counsel and not without the insurance carrier on notice. Repayment agreements routinely waive coverage, release claims the company intended to keep, and create documents that complicate a later prosecution. A repayment arrangement can be a good outcome. Signing one in the room on the day of the confrontation rarely is.
The Bottom Line
Recovery after employee fraud is not primarily a legal question. It is a sequencing question that gets answered in the first two weeks, usually by people who do not realize they are answering it.
The companies that recover meaningful amounts are the ones that preserved records before confronting anyone, put a documented loss figure together early, and kept all four routes open long enough to choose among them. The companies that recover nothing usually did the humane and obvious thing first, and closed off their options while doing it.
Key Takeaways
- Trace first, confront second. Preservation and tracing should be substantially complete before the employee knows, because the most recoverable assets are the easiest to move.
- Put the carrier on notice inside the policy window even with a preliminary figure. Notice deadlines usually run from discovery, not from the end of an investigation.
- One transaction schedule serves all four routes. Build it once to a standard a carrier, a court, and a prosecutor can each test independently.
- Third-party transfers to family and associates are frequently the most recoverable category and the most commonly overlooked.
- A criminal referral is a deterrence and credibility decision more than a recovery decision. Restitution follows conviction, and collection follows solvency.
- Engage counsel before generating the record. Notes and interview summaries created beforehand are ordinary business records and are generally discoverable.
Talk to Falcon Consulting Group
Falcon Consulting Group conducts internal fraud investigations, asset tracing, and loss quantification for organizations deciding what can realistically be recovered and how.
Our investigative and advisory services are delivered by former federal and state law enforcement personnel, certified fraud examiners, and accountants who have built these cases from the investigative side and defended the numbers from the corporate side. We work with your counsel and your carrier from the outset rather than after the record has already been created.
If you have discovered a loss and have not yet confronted anyone, contact us before that conversation happens.
About the Author
Thomas W. Raftery III served 22 years as a Special Agent with the Federal Bureau of Investigation and was the first appointed Inspector General for the Delaware River Port Authority. He deployed to Afghanistan with the Special Inspector General for Afghanistan Reconstruction. He is a Certified Fraud Examiner and holds an MBA from Drexel University with a concentration in accounting. Learn more about the Falcon team.