How to Fire an Employee for Stealing

Employee theft is one of the most difficult and sensitive issues an organization can face. Beyond the immediate financial impact, theft can damage morale, erode trust, and expose the organization to legal risk if handled incorrectly. When theft is suspected or confirmed, employers must act carefully, consistently, and in line with company policy and applicable laws.

This guide walks through a clear, defensible timeline for how to fire an employee for stealing. It is designed for HR professionals and managers who need to balance fairness, confidentiality, and risk management while protecting the organization.

Step 1: Understand Why Employees Steal

Employee theft rarely happens without warning signs or contributing factors. While theft is never justified, understanding why it occurs can help organizations prevent future incidents.

Employee theft is a workplace crime that can take many forms. Common types of employee theft include merchandise theft (taking products from inventory or the sales floor), payroll theft (manipulating pay by inflating hours or claiming pay for work not done), time theft (clocking hours not actually worked, such as long breaks or buddy-punching), data theft (stealing confidential company or customer information), embezzlement (stealing company funds for personal gain), kickbacks (secret payments or gifts for special treatment of vendors), fraudulent disbursement (making unauthorized payments through fake invoices or expense reports), theft of services (using company services for personal benefit without authorization), and intellectual property theft (stealing proprietary ideas, designs, or trade secrets).

Common contributing factors include:

• Opportunity: Weak internal controls, lack of oversight, or poor segregation of duties
• Financial pressure: Personal debt, addiction, or external stressors
• Rationalization: Feelings of being underpaid, overworked, or unfairly treated

Understanding these drivers can help organizations strengthen policies, improve controls, and reduce the risk of repeat incidents. This step is not about excusing misconduct—it's about prevention and long-term improvement.

Understanding Time Theft

Time theft is a growing concern for organizations of all sizes, as it can result in significant monetary loss and decreased productivity. Unlike more obvious forms of employee theft, time theft occurs when employees are paid for work they did not actually perform. This can take many forms, including buddy punching (when one employee clocks in for another), taking excessively long breaks or smoke breaks, or misrepresenting work hours for personal use.

To address time theft, companies must establish clear policies that define acceptable conduct and outline the consequences of intentional wrongdoing. When an employee is suspected of time theft, it is critical to follow a fair and thorough investigation process. This includes gathering evidence, such as time records or digital logs, and interviewing witnesses as well as the accused employee. Ensuring due process not only protects the rights of the employee but also strengthens the employer’s position if disciplinary action or termination becomes necessary.

Employers should communicate expectations around work hours and break times, and consistently enforce these workplace policies. By taking a proactive approach to preventing and investigating time theft, organizations can protect company assets, maintain fairness, and uphold productivity.

Step 2: Gather and Preserve Evidence

Before any disciplinary action is taken, evidence must be collected carefully and lawfully. Acting too quickly without sufficient proof can lead to wrongful termination claims or discrimination allegations.

Relevant evidence may include:

• Video surveillance footage
• Witness statements
• Financial records or inventory logs
• Emails, system access logs, or computer files

Surveillance tools may be used to gather evidence, but only with proper employee consent and in compliance with privacy laws. Employers should ensure that all employees acknowledge and consent to being under video surveillance in public areas.

Best practices when gathering evidence:

• Preserve original records and avoid altering files
• Follow company policies and local laws related to monitoring and privacy
• Document who collected the evidence and when
• Involve at least two individuals in the investigation process to ensure objectivity and avoid bias

It is important to include all individuals with relevant knowledge in the investigation process to ensure a thorough and credible outcome.

A centralized case file helps ensure consistency and defensibility. Many organizations use case management software, such as Case IQ, to securely document evidence, track investigation steps, and maintain an audit trail. The employee's account should be included in the record of the investigation to prevent perceptions of being railroaded. All evidence gathered during the investigation must be organized and preserved for future use, including potential court proceedings.

Step 3: Maintain Strict Confidentiality

Confidentiality is critical throughout the investigation and termination process. Information should only be shared with individuals who have a legitimate need to know.

Why confidentiality matters:

• Protects the integrity of the investigation
• Reduces reputational harm to all parties
• Lowers the risk of retaliation or discrimination claims

Discuss the matter only with:

• The accused employee
• Witnesses (when necessary)
• Necessary members of your investigative team

Avoid discussing the situation with coworkers or external parties before conclusions are reached.

Step 4: Anchor the Decision in Policy, Not Accusations

Using the word “theft” as the official reason for termination can expose an organization to legal risk. Instead, termination should be framed around violation of company policy.

Key considerations:

• Ensure anti-theft, fraud, and code of conduct policies are clearly written
• Confirm the employee acknowledged these policies
• Apply policies consistently across roles and departments

Documenting termination as a policy violation helps reduce the risk of defamation claims while reinforcing organizational standards.

Step 5: Obtain a Written Admission When Possible

If the employee admits to the misconduct, request a written and signed statement. A written admission can strengthen your documentation and reduce the likelihood of disputes later.

Best practices:

• Do not coerce or threaten the employee
• Allow them to write the statement in their own words
• Include the date and signature

Without written confirmation, employees may later claim they never admitted guilt or were pressured into doing so.

Step 6: Decide Whether to Involve Law Enforcement

Not every case of employee theft requires police involvement, but the decision should be made deliberately.

You may need to notify law enforcement if:

• The theft is significant
• Insurance coverage requires a police report
• There is ongoing risk to the organization or others

In some cases, organizations choose to handle the matter internally to reduce time, cost, or disruption. However, failing to report theft may allow the individual to move on to another employer and repeat the behavior. If internal measures do not resolve the issue or if laws have been violated, the employer may need to pursue legal action to address the misconduct and protect the organization.

Step 7: Conduct the Termination Meeting

When termination is necessary, the meeting should be:

• Brief and factual
• Conducted in a confidential area, in private
• Led by HR or management with at least one witness present

If the employee is part of a union, they have the right to have a representative present during investigatory meetings. The termination meeting should not be the first time the accused employee is informed of the suspicion; this should have been addressed during the investigatory meeting.

Avoid debating the evidence or assigning moral judgment. Clearly state that the employee violated company policy and that employment is being terminated effective immediately.

Prepare in advance:

• Final paycheck and benefits information
• Retrieval of company property
• Access termination procedures

Unemployment Compensation Considerations

When terminating employees for theft, employers must carefully consider the implications for unemployment compensation. In many jurisdictions, employee theft is classified as misconduct, which can disqualify the former employee from receiving unemployment benefits. However, the specific rules and definitions of misconduct vary by state, making it essential for employers to consult with legal counsel to understand the relevant law in their area.

To support a claim that an employee is ineligible for unemployment compensation, employers should be prepared to provide clear evidence of the misconduct. This may include witness statements, video surveillance footage, time records, or other documentation that demonstrates the employee’s violation of company policies. Proper documentation not only supports the employer’s position in unemployment claims but also helps defend against potential wrongful termination allegations.

By understanding the legal requirements and maintaining thorough records, employers can navigate the unemployment compensation process more effectively and reduce the risk of costly claims or litigation.

Step 8: Document, Review, and Strengthen Controls

After the termination, review the incident to identify gaps in controls or oversight. Use the findings to:

• Improve internal controls
• Update policies and training
• Reduce future theft risk

Having a structured investigation and case management process helps organizations learn from incidents while demonstrating due diligence.

Managing the Consequences

Effectively managing the consequences of employee theft requires a structured and compliant approach. Once an investigation has established that theft has occurred, employers should take prompt disciplinary action, which may include termination, in accordance with company policies and due process requirements. It is essential that all investigative steps, including interviews with the accused employee and witnesses, are conducted in compliance with federal anti wiretapping laws and other relevant regulations to protect both the organization and employee rights.

After addressing the immediate incident, organizations should review and strengthen their workplace policies and procedures to prevent future occurrences. This may involve implementing or upgrading video surveillance systems, revising written procedures, and providing targeted training to employees on the importance of integrity and the consequences of theft. By taking these proactive steps, businesses can minimize the risk of future monetary loss, safeguard company assets, and foster a culture of accountability.

How Case IQ Can Help

Investigating employee theft and carrying out terminations requires careful documentation, confidentiality, and consistency. Case IQ helps organizations manage these sensitive processes in a structured and defensible way.

With Case IQ's case management software, organizations can:

• Centralize employee theft investigations and supporting evidence
• Maintain a clear audit trail of actions taken and decisions made
• Protect confidentiality through role-based access controls
• Track patterns and trends to strengthen internal controls over time

Small businesses, as well as larger organizations, can benefit from using case management software like Case IQ to prevent and address employee theft by implementing effective anti-theft policies and structured reporting tools.

By using case management software to support investigations and disciplinary actions, organizations can reduce risk, improve consistency, and demonstrate due diligence to regulators, auditors, and legal counsel.

Supporting a Fair and Defensible Process

Handling employee theft requires balance—protecting the organization while treating individuals fairly and lawfully. Employers must comply with federal law and follow their own internal policies and written procedures during investigations to avoid legal pitfalls. A clear timeline, strong documentation, and consistent application of policy are essential.

Many organizations rely on case management solutions like Case IQ to centralize investigations, maintain confidentiality, and demonstrate due diligence throughout sensitive employee matters.

Frequently Asked Questions

Can you fire an employee immediately for stealing?

In many cases, yes. If there is clear and credible evidence that an employee violated company policy through theft, immediate termination may be appropriate. Employers should ensure the decision aligns with internal procedures, employment agreements, and applicable labor laws to reduce legal risk.

Do you need proof to fire an employee for theft?

Yes. Employers should gather and document sufficient evidence before terminating an employee for theft. This may include surveillance footage, financial records, witness statements, or system access logs. Proper documentation helps support the decision and protects the organization in the event of a dispute.

Should you call the police if an employee steals?

It depends on the circumstances. Law enforcement may need to be involved if the theft is significant, if insurance coverage requires a police report, or if there is an ongoing risk to the organization. In other cases, employers may choose to handle the matter internally. However, failing to report theft can allow the individual to repeat the behavior elsewhere.

What should you say when firing an employee for stealing?

The termination conversation should be brief, factual, and professional. Rather than labeling the behavior as theft, employers should focus on the employee’s violation of company policy. Avoid debating the evidence or making emotional statements, and clearly communicate that employment is being terminated.

How can organizations prevent employee theft?

Preventing employee theft requires a combination of strong internal controls, clear policies, employee training, and consistent enforcement. Confidential reporting mechanisms, regular audits, and structured investigation processes can also help organizations identify issues early and reduce the risk of future incidents.

‍