# How to Tell If My Bookkeeper Is Stealing: 9 Checks

> You rarely spot bookkeeper theft from behaviour or the monthly summary. You spot it where money leaves: your own bank login, vendor payment details, the payroll register, your EFTPS or CRA payroll account and the QuickBooks audit log. ACFE's 2026 study puts the median small-business loss at $126,000, typically found after about a year.

- Canonical URL: https://www.pavadotech.com/blog/how-to-tell-if-my-bookkeeper-is-stealing
- Author: Om Patel
- Published: 2026-09-28
- Topic: Growth

You usually cannot tell your bookkeeper is stealing by watching them. You tell by looking where money leaves the business: your own bank login, the bank details behind each vendor, the payroll register, your payroll tax account and the QuickBooks audit log. Most small-business theft hides in payments too small and too regular for anyone to question.

Here is how it looked for one owner on r/Accounting. Their part-time external accountant, three years in, handled "bookkeeping, reimbursements, bill pay and basically anything financial that wasn't payroll." A new employee asked why a reimbursement was slow, so the owner logged into the bank portal and saw a reimbursement labelled "client supplies" for $412. The same vendor name appeared [every few weeks for over a year](https://www.reddit.com/r/Accounting/comments/1ozyn1k/just_found_out_our_accountant_has_been_scamming/), "always for random amounts between 200 to 600 bucks," coded as misc supplies and approved by the accountant himself. The routing number was his personal bank. Total: about $10,000. The owner's own verdict: "I trusted him way too much and never checked anything beyond the monthly summary he gave us."

That pattern, small repeating payments nobody reads, is the same place most [small business money leaks](https://www.pavadotech.com/blog/where-is-my-small-business-losing-money) hide. The checks below find it.

- **Small businesses lose the most per case.** ACFE's 2026 study of 2,402 frauds found a median loss of $126,000 at organizations under 100 employees, the highest of any size.
- **It runs for about a year.** The median fraud lasted 12 months before detection; expense reimbursement schemes lasted 18.
- **QuickBooks access alone cannot move money.** Theft needs a payment path: bank login, bill pay, payroll, reimbursements, cards or deposits. Check each one.
- **Your own bank login beats any report.** The Reddit theft above was found in the bank portal, not the books.
- **Verify payroll taxes yourself.** The IRS tells employers to get their own EFTPS PIN and check payment history; unpaid withholding can land on the owner.
- **Signing every check is not a control.** Owners on r/Accounting describe signing lookalike-vendor checks for years.

## What bookkeeper theft looks like in a small business

**It looks like normal spending: vendor bills, reimbursements and payroll, slightly inflated or redirected.** The ACFE's [Occupational Fraud 2026 report](https://www.acfe.com/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf), built from 2,402 cases in 143 countries, shows which schemes are far more common in small organizations than large ones.

| Scheme (ACFE 2026) | Under 100 employees | 100+ employees | What it looks like on your statements |
| --- | --- | --- | --- |
| Billing | 28% | 18% | Invoices from a vendor that does not exist, or a real vendor's name with someone else's bank account |
| Expense reimbursements | 19% | 10% | Personal purchases, duplicate receipts, "misc supplies" |
| Check and payment tampering | 18% | 8% | Payee changed after approval, forged signatures |
| Skimming | 17% | 6% | Customer payments that never reach the deposit |
| Payroll | 13% | 8% | Ghost or reactivated employees, extra hours, off-cycle runs |

Two numbers from the same report explain why these schemes survive. Expense reimbursement fraud did damage at a median **$1,900 a month** and lasted a median **18 months**. Billing schemes ran $6,400 a month for 14 months. Those are amounts that look like a busy month, not a crime. The Reddit case above, $200 to $600 every few weeks for a year, fits the reimbursement profile almost exactly.

The report also lists how people hide it. The most common method was creating fraudulent physical documents (39% of cases), followed by altering them (33%). Nineteen percent created fake transactions in the accounting system and 12% deleted or left transactions out. Only 11% bothered with no concealment at all. So a tidy set of books proves little: the fake invoice is usually filed right where the real one would be.

Perpetrators in accounting made up 13% of cases, with a median loss of $164,000. For US and Canadian victims specifically, the median loss was $110,000 across 863 cases.

## Can my bookkeeper steal if they only have QuickBooks access?

**Not directly. QuickBooks records money; it does not move it.** In a [walkthrough on this exact question](https://www.youtube.com/watch?v=cKG7llxURaU), accountant Edrina of Accounting By Edrina shows that bank feeds in QuickBooks Online only pull in past transactions: "I wouldn't be able to make a transfer, I wouldn't be able to make a charge on your credit card." What a QuickBooks user can do is enter, edit and delete records, which is how theft gets hidden.

So the useful question is not "do they have QuickBooks?" but "where can money leave, and who controls each exit?"

| Exit | How money leaves | Who should control it |
| --- | --- | --- |
| Bank login and bill pay | Transfers, wires, ACH to any account typed in | Owner releases; bookkeeper can prepare |
| Vendor bank details | Real vendor name, new account number | Owner approves every change |
| Payroll system | Ghost employees, extra hours, payroll reimbursements | Owner approves the final register, not just the total |
| Reimbursements | Personal spending, duplicates, fake receipts | Someone other than the submitter approves |
| Company cards | Personal purchases, refunds to a personal card | Owner reviews the full statement monthly |
| Customer deposits and refunds | Payments skimmed before deposit, refunds out | Someone other than the person recording sales |
| Payroll tax remittances | Withholding collected, never paid | Owner verifies directly with the IRS or CRA |

Write your bookkeeper's name next to every exit they touch. Each one they both prepare and release is a place to check first. The same list is worth running on any office manager, which is why [onboarding a new office admin](https://www.pavadotech.com/blog/how-to-onboard-a-new-office-admin) should start with who can release money.

The theft in this article hid in small, repeating payments that nobody outside the bookkeeper ever read. Send us your bank, card and vendor exports, no logins, and we read them line by line and send back a written list of every charge that does not match what you agreed to pay.

## The 9 checks you can run this week

**Run these from your own logins, not from reports your bookkeeper prepares.** Each takes 10 to 20 minutes. None of them accuses anyone; a clean result is useful too.

### 1. Scroll 90 days of your bank account yourself

Log into online banking with your own credentials and look at every outgoing line for three months. Forensic accountant Leah Wietholter of Workman Forensics lists the items to [look for as you scroll](https://www.workmanforensics.com/workman-forensics-blog/what-to-do-if-you-think-your-bookkeeper-is-stealing-from-your-business): cash withdrawals, transfers to accounts you do not recognize, wires, credit card payments (especially to cards you do not have), payroll totals higher than expected and off-cycle payroll debits. Open the check images too: the payee on the image is what matters, not the name in the books.

### 2. Match vendor names to where the money actually went

Pull your vendor list and sort payments by payee. For any vendor you do not recognize, look it up in your state or provincial business registry. One controller on r/Accounting found a "MISC" vendor type paying a company whose registered owner was the [AP clerk's husband](https://www.reddit.com/r/Accounting/comments/1ic9laj/tell_me_an_embezzlement_story_that_happened_at/): $250,000 over 10 years. Another story in the [worst embezzlement thread](https://www.reddit.com/r/Accounting/comments/1qqvu2r/whats_the_worst_case_of_embezzlement_youve_seen/) describes a bookkeeper who set up LLCs with names similar to real suppliers and brought the checks to the owner to sign, about $900,000 over a decade. Watch for lookalike names and for any vendor whose bank account changed recently.

### 3. Search for repeating small payments in vague categories

Filter expenses coded to miscellaneous, supplies, office, client supplies or ask my accountant. Sort by payee and look for the same name recurring at irregular amounts. A top commenter on the $10,000 thread gave the follow-up question every owner should ask: was the scheme "using multiple vendor names"? Duplicate receipts are the reimbursement version; a r/smallbusiness owner covering for a bookkeeper on leave found [the same $38 Uber receipt](https://www.reddit.com/r/smallbusiness/comments/1pdax88/i_caught_an_employee_submitting_fake_expense/) submitted twice, then about $2,544 in six months. Getting [employees to turn in receipts](https://www.pavadotech.com/blog/how-to-get-employees-to-turn-in-receipts) with the job attached makes this pattern easier to see.

### 4. Read the payroll register, not the payroll total

Compare every name on the last three registers with the people who actually work for you, and check hours against schedules. In one r/Accounting account, a controller ran payroll and added cash reimbursements to his own paychecks for years; the owner "just looked at the biweekly cash requirements," and it reached over $1 million. In another, a payroll administrator [reactivated former employees](https://www.reddit.com/r/Accounting/comments/1vnvljm/any_fraud_bust_stories/) and moved inflated hours onto them after approval, about $35,000 in five months, caught because a payroll clearing account was off by two cents. If you [run payroll yourself](https://www.pavadotech.com/blog/how-to-run-payroll-for-a-small-contracting-business), this check takes five minutes.

### 5. Confirm your payroll taxes were actually paid

This is the check almost no guide mentions, and it protects the owner personally. The IRS page on [outsourcing payroll duties](https://www.irs.gov/businesses/small-businesses-self-employed/outsourcing-payroll-duties) tells employers to register for their own EFTPS PIN and "periodically verify payments," which gives 16 months of payment history, and says "a red flag should go up the first time a service provider misses a payment or makes a late payment." It also warns against changing your IRS address of record to someone else's, because that cuts you off from notices.

The stakes are real: the [Trust Fund Recovery Penalty](https://www.irs.gov/businesses/small-businesses-self-employed/employment-taxes-and-the-trust-fund-recovery-penalty-tfrp) "is equal to the unpaid balance of the trust fund tax," and the IRS says an employee who only pays bills as directed is not a responsible person. The owner usually is.

In Canada, the CRA lets you [view payroll statements online](https://www.canada.ca/en/revenue-agency/services/tax/businesses/topics/payroll/remitting-source-deductions/how-when-remit-confirm-payment.html) through your business account. Note that after six months of electronic remittances, paper statements stop arriving, so nobody mails you a warning.

### 6. Open the QuickBooks audit log

In QuickBooks Online, go to Settings, then [Audit log](https://quickbooks.intuit.com/learn-support/en-us/help-article/audit-log/use-audit-log-quickbooks-online/L2WoVnW6I_US_en_US). Intuit says it records user sign-ins, settings changes, edits to customers, vendors and employees, and payroll submission, keeps events for two years and cannot be turned off. You need admin access to see it, which is itself a test: if you cannot open it, you are not the admin of your own books. Filter by user and look for deleted or voided transactions, edits to vendor records, and changes made long after the original date.

### 7. Check who has access, and to what

In QuickBooks, open Manage users and remove anyone you cannot name. Do the same in your bank's user settings and your payroll provider. Shared logins are a problem on their own: one r/Accounting commenter described a team lead who used a colleague's login while that colleague was on medical leave, processing invoices with a vendor, $2.2 million in total. The rule a r/Accounting bookkeeper put simply: "I'm a bookkeeper and would never want to approve anything, only request."

### 8. Compare card refunds and deposits with sales

Pull card processor refunds for the last few months and check where each refund went. An accountant on r/Accounting described an internal bookkeeper who issued refunds matching incoming card payments to her own card, "a couple hundred thousand" in total. Then compare deposits with invoices marked paid; skimming shows up as customers who paid in full and deposits that came in short. If invoices live in a separate system, [reconciling invoices with QuickBooks](https://www.pavadotech.com/blog/how-to-reconcile-crm-invoices-with-quickbooks) is how you see the gap.

### 9. Make sure statements and notices come to you

Bank statements, card statements, tax notices and vendor complaints about late payment should reach your inbox directly. A bookkeeper who insists on handling all of it is a control problem even when nothing is wrong. Set up daily balance alerts from the bank, and put company cards on a statement you can see; a [business credit card](https://www.pavadotech.com/blog/should-i-get-a-business-credit-card-for-my-contracting-business) with per-card limits makes that easier.

**The one-hour version.** If you only do three things this month: scroll 90 days of the bank yourself (check 1), log into EFTPS or your CRA business account (check 5), and open the QuickBooks audit log filtered to your bookkeeper's user (check 6). Those three cover the exits where the largest losses in the stories above came from.

## Behavioral red flags: what they are worth

**Behavior is a reason to look, never proof.** Most ranking guides lead with lifestyle and vacation habits, and ACFE's data backs them partly: 84% of 2026 perpetrators showed at least one behavioral red flag, living beyond their means was the most common at roughly 39%, and cases with a red flag had a median loss of $125,000 against $94,000 without. But 16% showed none at all, and the controller in the Reddit $1 million story looked like the most diligent person in the building.

The flags worth acting on are the ones that block checking: refusing to share duties, refusing to let anyone else see statements, resisting an outside review, or getting defensive about ordinary questions. Those point you back to the nine checks, which answer the question either way.

## Why signing every check does not protect you

**Signing is not reviewing.** The owner who signed ten years of lookalike-vendor checks and the boss whose signature was forged on 26 checks both believed they had a control. The fix is not a signature; it is a second person seeing the detail behind the payment, from a source the preparer does not control.

Small businesses mostly skip that step. ACFE's 2026 comparison of anti-fraud controls:

| Control | Under 100 employees | 100+ employees |
| --- | --- | --- |
| Management review | 41% | 79% |
| External audit of financial statements | 51% | 91% |
| Proactive data monitoring | 17% | 58% |
| Surprise audits | 16% | 52% |
| Job rotation or mandatory vacation | 8% | 32% |

ACFE also found active detection methods, such as management review and account reconciliation, uncovered fraud up to four times faster than passive ones like confessions or accidents. The monthly bank scroll in check 1 is management review. A bookkeeper covering another's leave is job rotation; in two of the Reddit stories, the theft was found exactly then.

Did a check turn up payments you cannot place? We go through your bank, card and vendor exports line by line and send a written list of the charges that do not match what you agreed to pay, so you know what is normal before you ask anyone about it. If the list points to theft, take it to a fraud examiner or a lawyer; we will tell you so.

## What to do if you think your bookkeeper is stealing

**Secure the money quietly, preserve the records, then bring in help.** In order:

1. **Take back the exits.** Change bank, payroll and card passwords, remove extra users, and require your approval for new payees and changes to vendor bank details. Do this before any conversation.
2. **Preserve evidence.** Download bank and card statements, the vendor list, payroll registers and an export of the QuickBooks audit log (it only goes back two years). Keep copies off the shared systems.
3. **Do not confront yet.** Workman Forensics advises not firing the bookkeeper on the spot, because "she has all the information" about how and where the money went. A forensic accountant on the $10,000 thread added that "there may be more he was taking that you don't know about."
4. **Call a fraud examiner and a lawyer.** They can size the loss, advise on police and civil options and handle any interview.
5. **Check your insurance.** Crime or employee dishonesty coverage is what pays, if you have it.
6. **Check your tax exposure.** If payroll taxes were involved, EFTPS or CRA statements show what was actually paid.

Be realistic about recovery. ACFE found 56% of victim organizations recovered nothing, 29% recovered part and 15% recovered everything. The Vancouver owner who lost $25,000 over four years was told by police to use small claims court. Speed matters more than anything: at the report's median of $9,400 a month across all schemes, every month of not looking costs real money.

## Can someone just do this for me?

**You can run the nine checks yourself, and you should, because the point is that someone other than the bookkeeper looks.** They need your own logins and about an hour a month. What you should not do alone is investigate once you find something: a fraud examiner knows how to trace funds and document it for police or insurers.

In between sits the review you do not have time for: reading every line of a year of bank, card and vendor exports to see what recurs, what changed and what nobody approved. That is also how overcharges get found, and it is the part worth handing off. If you are still deciding how much to outsource, the post on [whether you need a bookkeeper or software](https://www.pavadotech.com/blog/do-i-need-a-bookkeeper-or-accounting-software) covers who should own the ledger, and our list of [what you can automate](https://www.pavadotech.com/blog/what-can-i-automate-in-my-small-business) shows which alerts can run without you.

## Five controls that cost nothing

**Most prevention is who clicks which button.** Set these up once:

- **Bookkeeper prepares, you release.** Every payment, transfer and payroll run needs your approval in the bank or payroll system. Ask your bank whether it offers dual approval for ACH and wires.
- **You approve every new vendor and every bank detail change.** Call the vendor on a number you already have before approving a change.
- **Statements come to you first.** Bank, card, payroll and tax accounts list your email.
- **Your own EFTPS PIN or CRA login.** Check payment history every quarter.
- **Someone else covers once a year.** A week where another person, or you, runs the books is the cheapest surprise audit there is.

Tie receipts to jobs as they come in, as in [tracking receipts and expenses by job](https://www.pavadotech.com/blog/how-to-track-receipts-and-expenses-by-job), and a fake "supplies" line has nowhere to hide. For a sense of how line-level review catches vendor overbilling in a different industry, the [restaurant invoice audit](https://www.pavadotech.com/blog/restaurant-invoice-audit) uses the same method. And if cash always feels tighter than the P&L says it should, [cash flow management](https://www.pavadotech.com/blog/contractor-cash-flow-management) is where the gap usually shows first.

## FAQ

### Can my bookkeeper steal from me if they only have QuickBooks access?

Not directly. QuickBooks bank feeds only pull in transactions, so a user cannot move money from inside QuickBooks alone. Theft needs a payment path: a login to your bank or bill pay, the payroll system, reimbursement approval, a company card, or handling of deposits and refunds. List every one of those your bookkeeper touches and you have the list of places to check.

### What is the most common way bookkeepers steal from small businesses?

In ACFE's 2026 study, the schemes most over-represented at organizations under 100 employees were billing schemes (28% of cases versus 18% at larger ones), expense reimbursements (19% versus 10%), check and payment tampering (18% versus 8%) and skimming (17% versus 6%). In practice that means fake or lookalike vendors, padded reimbursements and payments redirected to a personal account.

### How long does bookkeeper theft usually go on before it is caught?

ACFE's 2026 report puts the median duration of occupational fraud at 12 months. Expense reimbursement schemes ran a median 18 months and billing schemes 14, because the amounts are small enough to blend into normal monthly spending.

### Should I confront or fire my bookkeeper if I think they are stealing?

Protect the money first, then decide. Take back sole control of bank logins, payment approval and payroll, and save copies of statements, the vendor list and the QuickBooks audit log before anyone can change them. Fraud examiners generally advise against a confrontation until you have the records, because the person who took the money knows best where it went.

### Will the police help if my bookkeeper stole money?

Sometimes, and it varies a lot by amount and place. File a report and bring documents that show where each payment went. One owner in Vancouver said on r/Accounting that police told them they do not act on a $25,000 theft and pointed them to small claims court. A lawyer can tell you whether a civil claim is worth pursuing.

### Does business insurance cover bookkeeper theft?

Only if you have crime or employee dishonesty coverage, which a general liability policy does not include. One controller on r/Accounting said their insurer paid $34,000 of a roughly $35,000 payroll theft, minus a $1,000 deductible, after a lot of document gathering. Ask your broker whether you have it before you need it.

### Am I liable for payroll taxes my bookkeeper did not pay?

Often, yes. The IRS Trust Fund Recovery Penalty equals the unpaid withheld taxes and can be assessed against responsible people, which can include owners. The IRS says an employee who only pays bills as directed is not a responsible person, so the owner usually is. Check your EFTPS payment history yourself.

### How often should I check my bookkeeper's work?

Monthly for the bank, card and payroll checks, which take under an hour once you know where to look, and at random times for a deeper look. ACFE found surprise audits at only 16% of organizations under 100 employees, against 52% of larger ones, and management review at 41% against 79%.