Top Five Indications Someone is Embezzling

Home > Media > Embezzlement Blog

Top Five Indications Someone is Embezzling

March 11, 2026

Top Five Indications Someone is Embezzling

Prosperident has performed thousands of investigations into embezzlement in dental practices. While every case is different, certain behavioral and financial patterns appear again and again. When we arrive at an office and later confirm that theft has occurred, the following warning signs are frequently present.  None of these indicators prove that embezzlement is happening, but each should prompt closer attention because they often reflect the methods employees use to conceal financial misconduct.

A staff member is territorial.
Employees who are stealing often try to control every aspect of the systems they manipulate.  They may guard their duties aggressively, resist cross-training, or discourage the dentist from involving outside advisors such as accountants or consultants. This behavior helps them maintain exclusive knowledge of key processes such as posting payments, handling adjustments, preparing deposits, or reconciling reports. Embezzlement schemes often depend on the same person controlling both the transaction and the records of the transaction.  When others learn the system or review the data, irregularities are more likely to be discovered.  Territorial behavior is therefore often a defensive tactic designed to protect a scheme from scrutiny.

The team member spends considerable time in the office alone, normally on evenings or weekends.
While some employees simply prefer quiet time to catch up on work, unexplained after-hours access to the office can create opportunities to alter records or remove evidence. Many embezzlement schemes require periodic “cleanup” activities—editing transactions, deleting ledger entries, adjusting accounts, or reconciling manipulated reports so that numbers appear normal.  These tasks are easier to perform when no one else is present to observe the computer screen, ask questions, or notice unusual activity.  Employees engaged in theft may therefore seek opportunities to work alone so they can manipulate records without interruption.

Production and profitability don’t line up.
In a healthy practice, increases in production typically translate into increases in collections and profitability.  When production rises, but profitability remains flat—or when production remains steady while profitability declines—it may signal that money generated by the practice is not making its way to the bank.  Many embezzlement schemes involve diverting patient payments before they are deposited or masking collections with adjustments or write-offs.  The practice management software may still show strong clinical production, but if money is being siphoned off before it reaches the practice’s accounts, the financial results will not reflect the clinical activity taking place.

A staff member is reluctant to take a vacation or uses vacation days in small increments.
Embezzlers often depend on their daily presence to maintain the illusion that everything is normal.  Many schemes require ongoing manipulation of records to keep accounts balanced or to prevent patients from noticing discrepancies in their statements. If the person responsible for the scheme is absent for an extended period, another employee may perform their duties and uncover irregularities—such as missing payments, unusual adjustments, or incomplete records. For this reason, employees engaged in theft sometimes avoid taking full vacations or will break vacation time into one- or two-day increments so that no one else has sustained control over their responsibilities.

Amounts collected according to your practice management software do not line up with deposits made to your bank.
This is one of the most direct indicators that something may be wrong. In a properly functioning financial system, the totals reported by the practice management software for a given day or period should reconcile closely with the amounts deposited in the bank. When there are unexplained differences—particularly recurring ones—it may indicate that funds are being removed before deposit, deposits are being altered, or transactions are being manipulated to conceal missing money. Common methods include deleting payment entries, posting false adjustments, or holding checks and cash out of deposits. Persistent reconciliation gaps between software reports and bank deposits should always be investigated promptly.


In our experience, embezzlement rarely begins with dramatic, obvious actions. Instead, it often develops gradually, supported by behaviors that allow the individual to maintain control over financial systems and avoid oversight. Recognizing these warning signs early allows practice owners to strengthen controls and investigate concerns before small irregularities turn into significant losses.

Our FIRST LOOK product is a quick, inexpensive initial assessment tool to determine whether a more intensive audit is needed.  Click the button below to learn more.  

FIRST LOOK

 

© 2026 - Prosperident | Designed in Halifax, Nova Scotia by: immediac