Employee Embezzlement: The Minnesota Owner's Playbook

Preserve the Evidence Before You Confront Anyone

The instinct is to walk into the office and demand an explanation. Resist it for at least a day. The moment an embezzler knows you know, the records start disappearing: the laptop gets wiped, the email account gets cleaned out, the QuickBooks entries get adjusted, the personal bank account gets emptied.

Do these things first:

• Lock down the devices and accounts quietly. Image the company laptop and phone rather than handing them to IT for a routine wipe. Preserve the email mailbox, including deleted items. Suspend automatic deletion or retention purges on anything the employee touched.
• Pull the paper trail yourself. Bank statements, canceled checks, credit card statements, vendor invoices, payroll records, expense reimbursements, and the accounting-system audit log. Note who has access to change entries.
• Track chain of custody. Write down who took what, when, and where it is stored. A recovery case that depends on documents nobody can authenticate is a weaker case.
• Do not tip off the employee. No confrontation, no company-wide announcement, no sudden change to their system access that signals an investigation, until the evidence is secured.
• Identify the scope before you decide anything. A single skimmed deposit and a three-year vendor-invoice scheme call for different responses. You cannot size the insurance claim, the civil demand, or the criminal referral until you know the number.

If the employee is still working while you investigate, a paid suspension is usually cleaner than an abrupt termination. It removes their access without creating a wage dispute or a retaliation narrative before you understand what happened.

Do Not Take It Out of Their Paycheck

This is the trap. You are owed money, the employee is owed a final paycheck, and the arithmetic seems obvious. Minnesota law says otherwise.

Minn. Stat. § 181.79, subd. 1(a), provides:

No employer shall make any deduction, directly or indirectly, from the wages due or earned by any employee, who is not an independent contractor, for lost or stolen property, damage to property, or to recover any other claimed indebtedness running from employee to employer, unless the employee, after the loss has occurred or the claimed indebtedness has arisen, voluntarily authorizes the employer in writing to make the deduction or unless the employee is held liable in a court of competent jurisdiction for the loss or indebtedness.

Two exceptions in the deduction rule itself, then: a written authorization the employee signs voluntarily after the loss, or a court judgment holding the employee liable. Your own certainty that they stole the money is not one of them. Check any collective bargaining agreement before you rely on that list, because subd. 1(c) does not apply the section where the agreement contains a contrary provision. An employer who deducts anyway is liable in a civil action for twice the amount of the deduction under subd. 2.

The final-paycheck timing rule compounds the risk. Under Minn. Stat. § 181.13(a), when you discharge an employee, wages actually earned and unpaid are immediately due upon the employee’s written demand, and if they are not paid within 24 hours of that demand, the employer is in default. The discharged employee may then collect a penalty equal to their average daily earnings for each day the employer stays in default, up to 15 days.

So the self-help deduction produces the worst version of this case: you still have to chase the stolen money through the courts, and now the embezzler has an affirmative wage claim against you with a doubling provision and a daily penalty attached. Pay the final wages on time and recover the theft through the channels built for it. The final pay rules for Minnesota employers cover the mechanics.

What You Can Actually Recover

The theft statute. Section 604.14 is the centerpiece, and several of its subdivisions matter more than owners expect:

• Subd. 4 states that filing a criminal complaint, a conviction, or a guilty plea is not a prerequisite to liability. You do not need the prosecutor to act before you sue. The subdivision also provides that payment or nonpayment may not be used as evidence in a criminal action.
• Subd. 5 provides that recovering the stolen property does not affect liability under the section, other than liability for the value of the property. Getting the laptop back does not extinguish the punitive-damages exposure.
• Subd. 6 allows a written demand for payment before you file suit, and it contemplates that the demand include a copy of the statute and a description of the liability it imposes. A demand letter that puts the doubling provision in front of the employee, with the evidence behind it, resolves a meaningful share of these matters without litigation.

Common-law theories, pleaded alongside. Conversion reaches the wrongful exercise of dominion over your property. Unjust enrichment reaches the benefit the employee retained at your expense. A constructive trust can follow the money into the asset it purchased, which is how an owner reaches the truck or the down payment rather than an empty bank account. These theories matter most when the employee has spent the cash but holds a traceable asset.

Criminal restitution. If the employee is charged and convicted, restitution runs alongside your civil claim rather than replacing it. Under Minn. Stat. § 611A.04, subd. 1, a crime victim has the right to receive restitution as part of the disposition of a criminal charge if the offender is convicted, covering out-of-pocket losses resulting from the crime, and an actual or prospective civil action may not be used as a basis to deny that restitution. Expect an offset rather than a windfall: the offender is credited in any civil judgment for restitution already paid on the same loss.

The Criminal Referral Decision, and the Line You Cannot Cross

Reporting is a business decision with real considerations on both sides. Charges create restitution leverage and a public record that deters the next person. They also hand control of the timeline to a prosecutor whose priorities are not your recovery, expose the matter to publicity you may not want, and can slow your civil case while the criminal matter proceeds.

Value drives the exposure. Under Minn. Stat. § 609.52, subd. 3, theft of property or services worth more than $5,000 carries imprisonment of up to ten years or a fine of up to $20,000. The twenty-year tier and its $100,000 fine require both a value over $35,000 and a conviction under one of the specific clauses of subdivision 2 that subdivision 3 enumerates. Those include obtaining property by false representation and by swindling, and, directly on point for embezzlement, diverting corporate property with intent to defraud. An insider who moves more than $35,000 of company assets can therefore land in the twenty-year tier, while the same amount charged as a straight unauthorized taking stays in the ten-year tier. Either way, this is felony territory, and prosecutors treat it that way.

Here is the line. Do not offer to withhold a criminal report in exchange for repayment. Under Minn. Stat. § 609.27, subd. 1, a person who makes one of the threats the statute lists and thereby causes another, against that person’s will, to do an act or forbear doing a lawful act is guilty of coercion. The listed threats include, at clause (5), “a threat to make or cause to be made a criminal charge, whether true or false.”

Making that trade explicitly converts your recovery effort into potential criminal exposure of your own. The correct path is to keep the two decisions separate: negotiate a civil settlement and release on the merits of the civil claim, and decide independently whether to report. Employees frequently pay to end a documented civil claim. Let counsel paper the agreement so the settlement stands on the claim rather than on a threat.

Insurance Is Often the Fastest Money

Employee dishonesty is generally excluded from a standard commercial property policy. The coverage that responds is a fidelity bond or a crime policy, often written as an employee dishonesty endorsement.

Read the policy in the first days, not the last. These policies routinely require prompt notice upon discovery and a sworn proof of loss within a defined window, and they define discovery in a way that starts the clock earlier than owners assume. Late notice is a common reason an otherwise covered loss is denied. The investigation file you built in the first week is also the file the carrier will want, which is another reason the evidence work comes first.

Close the Hole That Let It Happen

Every embezzlement has a control failure behind it, and the same failure is usually still open the day you discover the theft. The recurring ones are simple: one person both writes checks and reconciles the bank statement; nobody outside accounting reviews the vendor list; the owner signs whatever is in the stack; nobody takes mandatory vacations, so nobody else ever touches the books.

Separate the duties, require a second signature above a threshold, review new vendors and the bank reconciliation yourself, and audit the expense and payroll files at random intervals. For the broader control framework, see how to protect your business from employee fraud. If the discovery is part of a larger performance or conduct problem, the Minnesota problem-employee legal playbook covers the discipline and termination side. The underlying claims here sit within the business torts practice area.

The owners who recover the most are not the ones who move fastest on the day they find out. They are the ones who spend the first 48 hours securing the evidence, paying the final wages correctly, and reading the insurance policy, and who then send a demand letter that puts § 604.14 and a documented file in front of the person who took the money.