Updated Checked by the Tax-Services.ca editorial team How we check
If you find employee fraud, don’t confront the person first. Secure the records, limit their access, write down what you found and then speak to a lawyer and, if the amount or the facts justify it, the police. Fraud over $5,000 carries a maximum of 14 years in prison under section 380 of the Criminal Code, so the stakes are real for both sides and mistakes in the first days are costly.
What should you do in the first 48 hours?
Move quietly. The urge to march into someone’s office is strong, and it’s the worst first step, because files disappear once a person knows you know.
Start with the evidence. Copy the accounting file, bank statements, payroll reports and email logs to a place the employee can’t reach. Write a dated note of what you saw, who saw it and how. Then narrow the person’s access to bank portals, payment approvals and the accounting system, and do it in a way that looks routine if you can.
Tell as few people as you can. Rumours are hard to take back once they start. Your accountant will likely be one of the first calls, and this is a good time to look at your engagement letter to see what they cover.
What does a good evidence file look like?
Think of it as a story someone else must be able to follow without you in the room. Keep it short and dated. A simple layout works.
- A timeline: when each odd entry was made, by which login, for how much.
- Copies of the source documents: bank lines, cheques, invoices, payroll reports.
- A list of who had access to what, and since when.
- Your own notes, kept apart from the originals, which you leave untouched.
Don’t try to be the detective. Your job is to preserve what’s there. Interpreting it is for your lawyer, your accountant and, later, the police.
Is it theft, fraud or breach of trust?
The label is for the police and your lawyer to settle, and the first steps are the same either way. Here is what we could confirm from the Department of Justice’s Criminal Code.
| Offence | What the Code says | Maximum |
|---|---|---|
| Fraud over $5,000 (s. 380(1)(a)) | Defrauding a person or the public of property, money or a service by deceit, falsehood or other fraudulent means | 14 years |
| Fraud of $5,000 or less (s. 380(1)(b)) | Same conduct, lower value | 2 years on indictment, or summary conviction |
| Criminal breach of trust (s. 336) | A trustee converts property held for another to an unauthorized use, with intent to defraud | 14 years |
Whether an employee counts as a trustee under section 336 is a legal question we didn’t research. That’s a lawyer’s call. Section 380 also has a two-year minimum where the total value passes $1 million.
Who do you report employee fraud to?
Your local police are the first contact for a crime. The Canadian Anti-Fraud Centre says it collects information on fraud and identity theft and works with police services, so a report there adds to the picture, but it isn’t a substitute for the police. We couldn’t confirm which workplace cases your local force takes, so call and ask.
Does your insurer need to hear early? Your policy may set a notice period, and we can’t tell you what it says. Read the policy or ask the broker before you file anything.
How much did it really cost you?
Take a theft of $20,000. If the business earns a 10% profit margin, you’d need $200,000 of extra sales to earn that back. That’s simple arithmetic, and the profit margin calculator will do it for your own numbers. It’s a useful reminder for the owner deciding whether a case is worth pursuing.
Payroll fraud has its own trail. Fake employees, inflated hours or altered pay all leave a mark in remittances, so compare the payroll remittance calculator results with your actual remittances for a typical pay period. A gap is a clue, not a proof.
And if the person is leaving, think about pay. Notice or severance may be owed in some cases, and the severance pay calculator gives an estimate. We don’t know if fraud changes what you owe, since that depends on the facts and the province, and we didn’t confirm that from an official page, so get employment advice before you write the termination letter.
Common mistakes after a discovery
Accusing without proof. Paying the person off quietly. Deleting anything, even embarrassing things. Changing passwords in a way that wipes logs. Telling the rest of the staff before the lawyer has weighed in.
The bigger long-term mistake is not fixing the gap that let it happen: one person who enters invoices, approves them and reconciles the bank. Split those jobs, or add a review by the owner once a month. A small business can do this with two people and a calendar reminder.
Finally, give yourself some grace. Most owners who find fraud also feel foolish, because the person was trusted. That feeling is common, and it’s no reason to delay the practical steps above.
Where the numbers come from
Offence wording and maximums are from the Justice Canada Criminal Code (sections 336 and 380). The description of the Canadian Anti-Fraud Centre is from its own website. The profit margin example is our arithmetic. We did not confirm employment law on dismissal for cause, insurance terms or police reporting thresholds, and none of this replaces a lawyer’s advice on your case. This site is independent and has no government connection.
Frequently asked questions
Should I confront the employee first?
No. Secure the records and limit access first, then get legal advice, because evidence can disappear once the person knows.
What is the maximum penalty for fraud over $5,000?
Section 380(1)(a) of the Criminal Code sets a maximum of 14 years in prison.
Where do I report fraud?
Your local police first. The Canadian Anti-Fraud Centre also collects fraud reports.
Can I fire the employee right away?
We could not confirm the rules on dismissal for cause from an official page. Get employment advice before you act.
How can I check for payroll fraud?
Compare what you actually remitted with what a payroll calculator gives for a normal pay period, and look into gaps.
All rrsp and retirement calculators
- Dealing with the CRA: letters, audits and payments
Dealing with the CRA: what to do when a letter arrives, how a review differs from an audit, how My Account helps, and what to do if you can't pay