You've probably already asked yourself the question in this title at least once. Maybe more than once. A number that didn't quite add up, a stock count that felt short, an explanation that sounded a little too smooth. Most business owners talk themselves out of investigating further, because accusing someone based on a feeling seems unfair, and because part of you hopes you're just being paranoid.
Sometimes you are just being paranoid. Often, though, that feeling is your own attention to detail picking up on something real before you've consciously pieced it together. Here's how to tell the difference, organized by the specific signs that actually show up, not vague warnings to "trust your gut."
None of these signs prove anything on their own. What they're good for is helping you notice a pattern you might otherwise keep explaining away one incident at a time.
The numbers keep needing an explanation
This is usually the first thing people notice, and the easiest to dismiss individually. A shrinkage percentage that's crept up slightly over the last few months. A cash reconciliation that's short by a small, manageable amount, again. None of it feels big enough to act on in the moment.
What actually matters is repetition, not size. Watch for these specific patterns:
- The same category of discrepancy shows up month after month, with the same or a very similar explanation each time
- Voided transactions, discounts, or refunds cluster heavily around one till, one shift, or one employee
- Cash deposits consistently run a little lower than what the sales records suggest they should
- Reconciliation always seems to happen quickly and cleanly for one particular employee's shifts, while everyone else's occasionally shows minor, honest errors
A single discrepancy is normal. Human error happens. A pattern that repeats with the same explanation, especially tied to the same person or shift, has stopped being an accident and started being worth a proper look.
It helps to actually write these down as they happen rather than trusting memory. A discrepancy that feels minor in the moment often looks very different once you see six months of them listed together on one page.
Behavior that doesn't quite match the role
People who are taking something usually change how they act around the parts of the job connected to it, sometimes subtly, sometimes not. This isn't about personality, some people are naturally private or particular about their work. It's about a specific shift in behavior around specific responsibilities.
- Reluctance to take leave, or visible anxiety about someone else covering their role even briefly
- Defensiveness or irritation at routine questions about their area that never used to bother them
- Insisting on personally handling a task that genuinely doesn't require their constant, exclusive involvement
- A noticeable lifestyle change, a new vehicle, a bigger house, frequent expensive purchases, that doesn't obviously match their salary
- Working alone at unusual hours, or being present for tasks they don't strictly need to be there for
That lifestyle point deserves a caution. It's real, and it does show up in genuine cases, but it's also the easiest sign to misread. Someone might have a second income, family support, or savings you don't know about. Treat it as one data point among several, not proof on its own.
The behavioral signs generally matter more in combination with the numbers than on their own. Someone who's simply private about their personal life isn't necessarily hiding anything. Someone who's private and consistently the common thread in a pattern of financial discrepancies is a different situation entirely.
Stock that doesn't match what the records say
For any business holding physical inventory, this is often where the clearest evidence eventually surfaces, because unlike a number on a spreadsheet, missing stock is a physical fact that can actually be counted and confirmed.
- The same specific products or categories come up short repeatedly, rather than shrinkage being spread evenly across everything
- Items marked as damaged, expired, or written off cluster around a particular employee's shifts or approvals
- Stock counts that are "close enough" every single time, never dramatically wrong, but consistently, quietly short in the same direction
- Deliveries that arrive with quantities matching the invoice on paper, but don't match what actually gets physically counted onto the shelf
Unannounced spot checks reveal far more here than scheduled counts. Anyone involved in ongoing theft has had time to prepare for a count everyone knows is coming. A count nobody expected shows the real state of things.
It's also worth checking whether shrinkage is genuinely spread across your whole product range or concentrated in a handful of specific, easily resold items. Genuine random loss tends to be scattered. Deliberate theft tends to target whatever moves fastest on the side market, the same pattern our guide on common types of fraud affecting Tanzanian businesses covers under inventory and agent fraud.
Customers or vendors act like something's off, even if they can't say exactly what
Theft doesn't only leave traces inside the business. People outside it sometimes notice patterns before you do, they just don't always think to mention it, or don't realize what they've noticed is actually significant.
- A customer mentions being charged an odd amount that got quietly "corrected" without much explanation
- A regular customer or client seems unusually close to one particular staff member, more familiar than a normal service relationship would suggest
- A vendor's invoices or delivery notes come with small inconsistencies that always seem to favor the same side of the transaction
- Complaints about pricing or billing cluster around one specific staff member, shift, or location more than any others
These signs are easy to write off individually as one-off misunderstandings. Worth asking, though: if you actually tracked complaints and unusual interactions by employee over a few months, would one name come up more than the others?
Most business owners never actually run that comparison, mostly because complaints arrive scattered across weeks or months and nobody's connecting them to a single name in the moment. A simple running log, even an informal one, tends to reveal a pattern surprisingly fast once you start keeping it.
One person has too much control, with nobody else checking
This isn't a sign that theft is happening. It's a sign that theft would be very easy to hide if it were. Structural gaps like this are worth identifying on their own, separate from any specific suspicion, because they're exactly where the signs above tend to cluster once something does start.
- One person requests, approves, and pays for purchases with no second signature required at any point
- Only one employee fully understands how a specific process works, and nobody else has ever been trained to do it
- Financial records or reconciliations are "always ready" verbally, but rarely produced in full, actual detail when asked
- Access permissions, systems, keys, accounts, haven't been reviewed in a long time, and nobody's quite sure who still has what
If several of these apply to the same role or person, that's worth addressing regardless of whether you currently suspect anything specific. It's the gap that makes every other sign on this list harder to catch, the same structural exposure our guide on building a fraud risk management program walks through how to close.
Fixing this doesn't require restructuring the whole business. Often it's as simple as adding one second signature to a process, or having someone else spend fifteen minutes occasionally checking work that's currently only ever seen by one person.
Frequently asked questions
Not necessarily, no single sign is proof on its own. What matters is whether multiple signs point toward the same person, process, or pattern, and whether it repeats rather than being a one-time thing. One odd discrepancy is normal business. A repeating pattern across several of these categories is worth investigating properly rather than continuing to explain away one incident at a time.
Document quietly rather than confronting them immediately. Write down dates, amounts, and specific incidents as they happen, without tipping off the person involved. Confronting too early usually just gives someone the chance to cover their tracks before you have anything solid to act on, and it can also unfairly damage trust if your suspicion turns out to be wrong.
It's tempting, but generally not the right first move if you genuinely suspect theft rather than an honest mistake. A direct question with no evidence behind it either alerts someone actually guilty to start covering up, or unfairly puts an innocent employee on the defensive over something they had nothing to do with. Establish the facts first.
Generally yes, records the business itself owns and generates, till transactions, inventory logs, system access records, can be reviewed as part of normal business oversight. This is different from intercepting someone's personal communications, which does cross into illegal territory. If you're unsure where a specific check falls, that's exactly the kind of question worth putting to a professional before acting.
Pattern and direction are the key clues. Honest mistakes tend to go both ways, sometimes a discrepancy favors the business, sometimes it doesn't, and they're usually spread across different people and situations. Theft tends to consistently favor the same direction and cluster around the same person, shift, or process, repeating in a way that random error rarely does over any meaningful stretch of time.
Usually not as the first step. Police generally need solid evidence to act on, and involving them too early, before you've documented a clear pattern, can complicate matters without actually resolving anything. Building a properly documented case first, often with professional help, gives you a much stronger position if it does eventually need to go that far, whether that means internal action, recovery, or a formal report.
Trusting a pattern you've genuinely noticed, rather than either ignoring it or acting on it too fast, is usually the right instinct, one of several reasons we cover in our guide on why people in Tanzania hire private investigators. FP Adjusters investigates suspected employee theft for businesses across Tanzania, gathering the kind of documented evidence that actually holds up once you decide what to do next.
Noticed a Pattern Worth Checking?
Tell FP Adjusters what you've observed, and we will tell you honestly what it takes to confirm it, quietly and properly.
Talk to an Investigator