What to Do When You Discover Embezzlement: An Owner's Action Plan
Dental Embezzlement Red Flags Checklist
The specific patterns that indicate billing fraud or embezzlement in a dental practice. Use this checklist to audit your own ledger for the patterns most often missed.
The moment you become certain an employee has been stealing is one of the most disorienting in a practice owner's career. It is also a moment where the wrong instinct, acted on quickly, can cost you the recovery and the case. This is the plan for the first 72 hours and the weeks after.
First, Manage Your Own Reaction
The discovery of embezzlement triggers a powerful set of emotions: betrayal, anger, embarrassment, and an urgent desire to do something immediately. Every one of those feelings is valid. None of them should drive your next action.
The single most common mistake practice owners make is acting on emotion in the first hours. They confront the employee. They fire the employee on the spot. They call the employee's family. They post about it. They delete the employee's system access in a visible way. Each of these feels like decisive action. Each of them damages the recovery, the criminal case, or both.
The discipline required here is genuinely hard. You have to behave normally toward a person you now know has been stealing from you, possibly for years, while you quietly build the foundation for a proper response. It is uncomfortable. It is also what separates owners who recover meaningful amounts and see consequences delivered from owners who get neither.
Give yourself permission to feel everything you are feeling, and commit to acting on the plan rather than the feelings.
The First 72 Hours
Do Not Confront the Employee
This is the first rule and the hardest. Confrontation tips off the employee, which gives them the opportunity to delete records, destroy documents, move funds, coordinate a story, or simply disappear. It also destroys the chain of custody you will need, and it exposes you to a wrongful termination or defamation claim if any detail of your understanding turns out to be wrong.
Until your records are preserved and counsel is engaged, behave exactly as you would on any normal day.
Preserve Everything
Before the suspected employee has any reason to suspect you know, preserve the records. Contact your practice management software vendor and request a full database backup including audit logs, framed as a routine audit, which is true. Do not make this request from the employee's computer. Download or request two years of bank statements, merchant processor statements, and insurance remittance history. Export the suspected employee's user activity log. Capture any vendor portal data, payroll records, and credit card processing records.
Store all of it somewhere the employee cannot access. A personal external drive or a cloud account only you control. If your file server is shared, do not store evidence there.
Write Down What You Know and How You Learned It
Document the trigger, the specific evidence you have found so far, and the timeline of your discovery. This becomes important for counsel and for any insurance claim. Memory degrades and details blur, so write it down while it is fresh.
Do Not Call the Police Yet
Law enforcement will take a report, but local police rarely have the resources to investigate dental embezzlement with the depth required, and an early, disorganized police report can complicate the case. The criminal referral happens later, organized by your attorney, after a private investigation has assembled the evidence.
Engaging the Right Professionals
A Healthcare Compliance Attorney First
Before anything else, retain a healthcare compliance attorney. Not a general business attorney, and not a friend who practices family law. The reasons are specific.
The attorney coordinates the entire investigation under attorney-client privilege, which protects the investigative work product if the case becomes litigation. The attorney retains the forensic accountant, which is important, hiring the forensic accountant directly can forfeit the privilege protection. The attorney advises on the sequencing of insurance notification, employee decisions, payer notification, and law enforcement involvement, all of which have legal consequences if done in the wrong order. The attorney also advises on your own potential exposure, because in cases involving payer fraud, a practice owner can be both a victim of the employee and potentially liable to payers, depending on supervisory responsibility.
A Forensic Accountant
The forensic accountant, retained through your attorney, quantifies the loss. They reconstruct what was stolen, how, and over what period, working from the records you preserved. Their analysis becomes the basis for the insurance claim, the civil case, and any criminal restitution calculation. A proper forensic accounting is what converts your suspicion and partial evidence into a documented, defensible number.
The Insurance Question
Most business insurance policies include employee dishonesty or crime coverage, often with limits between $25,000 and $250,000 depending on the policy. This coverage is the most likely source of meaningful financial recovery.
Two things matter. First, employee dishonesty claims have strict notification requirements, and failing to notify your carrier within the required window can void the coverage entirely. Your attorney will manage the timing of this notification. Second, the claim requires documentation, which is why the preservation and forensic accounting steps come first. A claim supported by a forensic accountant's report is far stronger than one supported by an owner's estimate.
Do not contact your insurance carrier before your attorney advises it. The sequencing matters.
Handling the Employee
Once counsel is engaged and the evidence is organized, the decision about the employee becomes a legal question rather than an emotional one. Your attorney will advise the specific approach based on your state's law and the strength of the evidence.
In most cases, the termination is handled for documented cause without the termination meeting itself becoming an accusation of theft. The criminal and civil case against the employee is built and executed in parallel, after the termination, through your attorney. This sequencing protects you from wrongful termination claims and preserves the evidence.
Do not sign a separation agreement with a mutual release until the full scope of the loss is known. A release signed today can bar you from recovering amounts you discover next month.
What Recovery Realistically Looks Like
Practice owners deserve an honest expectation. Full recovery of embezzled funds is rare. Most dental practices recover somewhere between 20% and 40% of the stolen amount, through a combination of insurance payout, civil judgment, and court-ordered criminal restitution.
The reason is simple. Employees who stole modest amounts usually spent the money and have no assets to recover. Employees who stole large amounts often have no assets either. Civil judgments against people with no assets are difficult to collect. Criminal restitution is ordered but paid slowly, often over years, often incompletely.
This does not mean the process is not worth pursuing. It is. The goals of a proper response are to stop the ongoing loss, recover the portion that is recoverable, protect the practice from liability for any payer fraud the employee committed, document the case so insurance pays what it covers, and ensure the employee cannot do this to their next employer. Those are achievable goals. Full financial restoration usually is not.
After the Case: Closing the Door
Once the immediate crisis is handled, the practice has to close the structural gap that allowed the embezzlement to happen. Almost every owner who goes through this says the same thing afterward, the patterns were there for months or years, and no one was watching.
The structural fixes are consistent across cases. Separate the duties of handling money and reconciling money, so the same person cannot both move funds and verify the books. Require two-person authorization on refunds and on transfers above a low threshold. Have the owner personally review monthly bank statements. Mandate that financial staff take real vacations with their roles covered by someone else. And implement continuous, independent reconciliation that reports to the owner rather than to any staff role.
The practices that close the door do not have to rely on the trustworthiness of any future employee. The verification is structural, and it operates regardless of who fills the role.
Bottom Line
Discovering embezzlement is a crisis, and crises reward preparation over instinct. The owners who come through it best are the ones who resist the urge to confront, preserve their records before anyone knows, engage a healthcare compliance attorney before taking any other step, and let the professionals convert their suspicion into a documented case. Recovery is usually partial. But a disciplined response recovers what can be recovered, protects the practice from secondary liability, and ensures the door is closed behind the case.
If you are reading this because you have just discovered something, the most important next step is the one that requires the most restraint. Do not confront anyone. Preserve your records, and call a healthcare compliance attorney today.
Zeldent provides the continuous, independent reconciliation that closes the structural gap embezzlement relies on. The system surfaces theft patterns in the daily dashboard rather than leaving them to be discovered years later. For practices recovering from an embezzlement case, Zeldent is the verification layer that ensures it does not happen again. Schedule a demo to see how Revenue Integrity protects your practice going forward.
Dental Embezzlement Red Flags Checklist
The specific patterns that indicate billing fraud or embezzlement in a dental practice. Use this checklist to audit your own ledger for the patterns most often missed.
