Employee theft costs Canadian businesses billions every year, but most owners miss the warning signs until it’s too late. After 30 years investigating workplace fraud across the Greater Toronto Area, we’ve learned that internal theft rarely happens overnight. There’s almost always a pattern.
Here’s what to watch for.
1. Their Lifestyle Suddenly Outpaces Their Salary
Your office manager who makes $55,000 a year just bought a new Audi and took a two-week trip to Bali. Maybe they got an inheritance. Or maybe they’re supplementing their income with your money.
Large, unexplained purchases are one of the most obvious red flags in corporate investigations. The employee who can’t afford their lifestyle on paper often can’t explain it in person either.
2. They’re Extremely Protective of “Their” Processes
Theft requires control. If an employee refuses to take vacation, won’t cross-train anyone on their responsibilities, or gets defensive when you ask basic questions about their workflow, ask yourself why.
Legitimate employees want backup. Thieves need isolation. We’ve investigated cases in Mississauga and Vaughan where bookkeepers went years without a single day off because their absence would have exposed the fraud within hours.
3. Missing Inventory That Doesn’t Match Sales Records
Your stock counts are off, but your sales reports look fine. Physical inventory keeps shrinking while your database shows everything accounted for. Someone is probably adjusting records to hide theft.
This is especially common in retail, warehousing, and food service operations. A business investigator can conduct a comprehensive audit that compares multiple data sources to find the discrepancies.
4. Vendor Relationships That Seem Too Cozy
An employee insists on using a specific supplier. They handle all communication with that vendor personally. They resist when you suggest getting competitive quotes.
Why? Because that “vendor” might be a shell company they created, or they’re getting kickbacks for steering business to an overpriced supplier. According to the Association of Certified Fraud Examiners, billing schemes account for roughly 20% of all occupational fraud cases.
5. Financial Records With Obvious Gaps or “Mistakes”
Repeated errors in financial documentation aren’t usually accidents. Missing receipts, voided transactions that happen frequently, refunds that don’t tie to customer complaints, these are methods for moving money without obvious theft.
One Brampton business owner came to us after noticing their accountant kept “forgetting” to attach backup documentation for certain expenses. Turned out those expenses were fabricated. The accountant had been stealing for four years.
6. They Work Odd Hours When Nobody Else Is Around
An employee who suddenly volunteers for every weekend shift, stays late when the office is empty, or comes in early before anyone arrives might be dedicated. Or they might need unsupervised access to commit theft.
Surveillance can confirm what’s actually happening during those off-hours. We’ve documented everything from inventory theft to data breaches that only occurred when the building was empty.
7. Customer Complaints About Charges They Don’t Recognize
If multiple customers mention billing errors, missing payments they swear they made, or charges that seem wrong, don’t assume it’s customer confusion. Your employee might be:
- Pocketing cash payments and never recording them
- Processing refunds to their own accounts
- Adding small fees that customers rarely notice
This type of theft works because it’s distributed across many transactions in small amounts.
8. Defensive or Hostile When Questioned About Routine Matters
Normal employees answer straightforward questions about their work without drama. Thieves often react with disproportionate defensiveness, anger, or elaborate explanations for simple inquiries.
If asking “Can you walk me through this expense report?” triggers a 20-minute justification about how hard they work and how you don’t trust them, something else is happening.
9. Duplicate Payments to the Same Vendor
Check your accounts payable records. Are you seeing the same invoice paid twice? Multiple payments to one supplier that seem higher than normal?
Duplicate payment schemes are common because they look like clerical errors. The employee processes a legitimate payment, then processes it again and intercepts the second check. Your accounting software might flag it as a duplicate, but if that employee is the one reviewing the flags, they just clear their own fraud.
10. They Have Unusually Close Access to Financial Systems
Does one employee have access to multiple financial systems that should have separation of duties? Can they both create vendors AND approve payments? Enter inventory AND process refunds?
This isn’t always theft, but it’s an open door. According to Statistics Canada, businesses with fewer than 100 employees are particularly vulnerable because owners often give too much access to trusted, long-term employees.
11. Personal Use of Company Resources That’s Hard to Track
Company credit cards used for personal purchases (that get “paid back” but never actually do). Company vehicles driven for personal use without mileage logs. Office supplies, equipment, or materials that disappear without explanation.
Small-scale theft often escalates. The employee who takes home printer paper today might be processing fake invoices next year. The boundary got crossed, and once that happens, it gets easier to cross again.
12. Altered or Destroyed Documents
Missing files. Damaged hard drives. Shredded documents that should have been kept for audit purposes. If an employee is destroying records, especially right before a review or audit, they’re likely hiding something.
One Toronto manufacturing company contacted us after their warehouse manager “accidentally” deleted security camera footage from the same week their inventory showed a major shortage. The accident wasn’t an accident.
What to Do If You Spot These Signs
Don’t confront the employee directly. If they’re stealing, confrontation gives them time to destroy evidence, alter records, or fabricate explanations. If they’re innocent, you’ve just damaged a relationship with a valuable team member.
Instead, document what you’re seeing. Gather records. Then contact us. We can conduct discreet surveillance, forensic accounting reviews, and background checks that either confirm your suspicions or put them to rest.
Most business owners wait too long. They want to give the employee the benefit of the doubt. By the time they call us, the theft has been happening for months or years, and the financial damage is significant.
If something feels off, it probably is. Your instincts are worth investigating.
Investigation Hotline has been conducting corporate investigations across the GTA for over 30 years. If you’re concerned about employee theft, contact us for a confidential consultation.
To learn more, contact Investigation Hotline at +1 416-205-9114 or Speak with the Experts Now
