Investigating employee theft: a guide for Tennessee employers
Suspecting an employee is the easy part. Proving it in a way that survives a wrongful-termination claim, an unemployment hearing or a prosecutor’s review takes method. Here is the method.
How theft shows up
- Inventory shrinkage concentrated on one shift, one location or one product line.
- Voids, refunds, discounts or write-offs clustered under one login.
- A bookkeeper who never takes vacation and resists outside review.
- Vendors nobody can describe; invoices just under approval thresholds.
- Lifestyle out of step with pay.
- Tips from co-workers, often vague and off the record.
First steps: preserve and contain
- Do not confront yet. Confrontation ends the evidence trail and starts the deletion.
- Preserve records: access logs, POS data, camera footage (which often overwrites in days), email and system logs. Issue an internal hold.
- Limit who knows. Theft investigations leak.
- Review your policies: what employees were told about monitoring, property searches and conduct. These shape what you can lawfully do.
- Call counsel if the amounts are significant or the employee is in a protected situation (leave, complaint, union).
What a licensed private detective does
- Covert surveillance on company property with the employer’s consent, documenting the conduct itself: product leaving the back door, cash pocketed, the after-hours visit. No cameras in private areas; silent video.
- Records analysis alongside your accountant: transaction patterns, vendor verification, entity research on suspect vendors.
- Undercover and integrity checks where appropriate; see workplace surveillance.
- Interviews conducted properly: voluntary, documented, non-coercive, with statements that hold up.
- Asset and background research on the employee and any outside accomplices.
- A report your attorney can use for termination, restitution, insurance claims and a referral to law enforcement.
See employee theft casework and embezzlement investigations.
Legal lines employers must respect
- Recording: silent video in work areas is generally permissible with policy; audio is governed by consent law. No cameras in restrooms, locker rooms or other private areas.
- Searches of personal belongings and devices: follow policy and take advice.
- Interviews: no false imprisonment, no threats; let the employee leave.
- Background checks through a third party for employment decisions trigger the Fair Credit Reporting Act; see our FCRA guide.
- Do not accuse publicly or to other employees; defamation claims follow.
The point of a licensed private detective is a file that respects every one of these lines.
Types of theft, and the evidence that proves each
| Scheme | How it looks | Evidence |
|---|---|---|
| Cash skimming | Sales not rung; voids and refunds | POS logs by login; covert video of the register; test purchases |
| Inventory theft | Shrinkage; product out the back | Covert video of loading areas; inventory counts; vehicle observation |
| Billing and vendor fraud | Fake vendors; inflated invoices | Entity research on vendors; address matches; approval patterns |
| Payroll fraud | Ghost employees; padded hours | Payroll vs. access logs; surveillance of claimed hours |
| Expense fraud | Duplicate or personal expenses | Receipt analysis; card data |
| Time theft | Paid hours not worked | Access logs; surveillance of remote or field staff |
| Data and trade-secret theft | Files copied before departure | Device and account logs through IT and counsel; see trade-secret page |
Running the interview properly
- Private room, two interviewers, door unlocked, employee free to leave.
- State the purpose plainly; no promises about outcomes; no threats.
- Present the evidence after the employee’s account, not before.
- Take a written statement in the employee’s words; let them read and sign it.
- Document the time, who was present and what was said.
- If the employee asks for a lawyer or refuses, stop and document that too.
A properly conducted interview produces admissions that hold up; an improper one produces claims against the employer.
After the investigation: policies that prevent the next one
- Segregate duties: the person who approves vendors does not pay them.
- Mandatory vacations and rotation for finance roles.
- Surprise counts and audits, announced as policy.
- Clear monitoring and property-search policies, acknowledged in writing.
- A confidential reporting channel for employees.
- Fidelity or crime insurance with documentation requirements understood in advance.
Referring to law enforcement
When the loss is significant and the evidence is documented, a referral to the police or the district attorney is a business decision with real consequences: restitution orders, deterrence and, sometimes, publicity. A detective receiving a package with surveillance video, transaction analysis, statements and a loss calculation can act; one receiving a complaint that “money is missing” usually cannot. Pinnacle prepares referral packages in cooperation with counsel so that the decision, once made, works.
Quick reference
| First week | Avoid |
|---|---|
| Preserve logs, footage and records | Confronting the employee |
| Limit who knows | Discussing it with co-workers |
| Review monitoring and search policies | Searching personal devices without policy and advice |
| Engage counsel and a licensed private detective | Hiring an unlicensed operator |
| Plan covert surveillance on company property | Cameras in private areas |
The investigation as a business process
The employers who handle theft well treat the investigation as a defined project with a sponsor, a budget, a timeline and a decision at the end, rather than as an emotional reaction. The sponsor is usually the owner or a senior executive; the team is counsel, the accountant and the licensed private detective; the budget is set against the loss and the exposure; the timeline is measured in weeks; and the decision is one of a defined set: terminate, pursue restitution, claim on insurance, sue, refer, or some combination. Every step is documented, because the file is the asset.
Run that way, an investigation typically costs a small fraction of the loss it stops, and the documentation protects the employer from the claims that follow a termination. Run as a confrontation, it costs the evidence, often the restitution and sometimes the employer’s own position.
A Nashville case, start to finish
A restaurant group noticed voids clustered on one manager’s login. Ownership preserved the point-of-sale logs and camera footage, engaged counsel, and brought in a licensed private detective. Covert video on company property, with the employer’s consent, documented the manager voiding cash sales and pocketing the money across five shifts. Two test purchases confirmed the method. The private detective and the controller reconciled the pattern over six months. In a properly conducted interview, the manager admitted the conduct and signed a statement. The group terminated with a complete file, recovered part of the loss through a restitution agreement, claimed the balance under its crime policy, and referred the matter to the police with a package a detective could act on. No wrongful-termination claim followed, because there was nothing to claim.
Deciding what to do
With the facts documented, you have real options: termination with a defensible file, a restitution agreement, an insurance claim under a fidelity or crime policy, a civil suit, or a referral to law enforcement with a clean package that a detective can act on. Each has trade-offs that your attorney can weigh. The worst option is the one most employers choose by default: a confrontation with no evidence and a resignation that leaves the money gone.
Questions people ask before they call
Silent video in work areas is generally lawful with a monitoring policy; never in restrooms or private areas, and audio raises consent issues. Take advice on your specifics.
Preserve evidence and document first unless a crime is in progress. A documented file gets action; a vague suspicion does not.
Yes, voluntarily and lawfully, with documented statements.
Tennessee is an at-will state, but timing, policies and protected statuses matter. Talk to counsel.
Fidelity and crime policies often require prompt notice and documentation. A professional file supports the claim.
Often one to three weeks, depending on the pattern and records involved.
Services and resources
Talk to a Nashville private detective.
Call 615-977-9929 or email contact@delatorgroup.com. Confidential, no obligation, all 95 Tennessee counties.