Preventing Fraud in Your Own Business: Typical Patterns and Controls

Why fraud hits small businesses particularly hard

Hardly any owner expects a long-standing employee to steal from them. But it is precisely this trust that explains why fraud goes undetected for so long in a small business. Where everyone knows everyone, nobody asks questions, and where one person does the bookkeeping alone, nobody else looks.

This guide answers the question: Which patterns are typical of fraud in your own business, and which controls allow a small business to prevent it effectively without placing its employees under blanket suspicion? To answer it, we first present the fraud triangle as the thinking model, then look at figures and patterns, weigh two readings, and finally derive a plan with three levers.

The thinking model: pressure, opportunity, rationalization

In the 1950s, the criminologist Donald R. Cressey studied people who had embezzled their employer's money. This gave rise to the fraud triangle: fraud becomes likely when three conditions come together. Pressure is a financial or personal problem that someone cannot raise openly. Opportunity is a gap in rules and controls that allows access. Rationalization is an explanation that makes the act justifiable to oneself, such as 'I'm only borrowing it' or 'I'm owed this anyway'.

Wolfe and Hermanson (2004) added a fourth side to the model, capability: the position, knowledge, and self-confidence that make deception possible. This fraud diamond mainly explains large-scale fraud at the top, as Patterns of accounting scandals shows. For employee fraud in a small business, the triangle is usually enough.

An everyday analogy: a bicycle is rarely stolen because someone urgently needs it. It is stolen because it stands there unlocked and the thief tells himself the owner will not notice anyway. The lock changes nothing about the thief's need, but it changes his opportunity.

Prevention does not mean distrusting people but closing opportunities before anyone gets into difficulty.

What the figures show

The Association of Certified Fraud Examiners (ACFE), an international association of fraud investigators, regularly analyzes cases of employee fraud. The 2024 study is based on more than 1,900 cases from 138 countries.

The 2026 edition is based on 2,402 cases from 143 countries and emphasizes that anti-fraud controls are associated with lower losses and quicker detection. It also shows which behavioral red flags were associated with particularly high losses.

The figures have clear limits. They come from cases investigated by examiners, in other words from detected fraud, and mostly from countries other than Germany. The red flag 'excessive pressure from within the organization' nevertheless deserves a second look because it concerns the business itself: anyone who sets targets that can only be met with tricks supplies pressure and rationalization at the same time.

Typical patterns in a small business

Employee fraud follows a few recurring patterns. Othman and Ameer (2022) analyzed 18 court documents on fraud in small businesses in New Zealand from 2006 to 2020. According to their findings, the acts were often motivated by addiction or family hardship, and where opportunity and capability came together, they lasted particularly long and caused great damage. The perpetrators mostly had no prior convictions but displayed unusual behavior. Billing was particularly vulnerable.

1. Fake invoices and fictitious suppliers

   Someone sets up a supplier that does not exist or belongs to them and has its invoices paid.

2. Manipulated bank details

   The IBAN of a real supplier is changed, and the money ends up in someone else's account. Often a forged email from outside is behind it.

3. Expenses and company cards

   Private expenses are claimed as business expenses, receipts are submitted twice.

4. Cash and cash sales

   Cash takings are not recorded or are cancelled afterward.

5. Collusion with suppliers

   A buyer receives kickbacks for accepting inflated prices or steering orders.

How ordering, receiving goods, and payment can be separated so that these patterns have little room is described in Purchasing and approvals. The overall framework of controls is covered in Internal controls for small businesses.

Two readings: more control or more trust?

Both readings are right, but for different sides of the triangle. Controls close opportunities. Trust, fairness, and an open approach to mistakes cut the ground from under rationalization and make tips more likely. How strongly employees are shaped by their sense of fair treatment is described in Principal-agent theory in the business with the counter-model of stewardship theory.

I therefore consider a combination to be right: a few fixed controls that apply to everyone, and a culture in which problems are raised early. A laboratory experiment by Krügel and Uhl (2023), described in detail in Whistleblower protection, calls for caution: a reporting system without noticeable consequences for misconduct can even encourage misconduct. Control and consequences belong together.

The three-lever plan: opportunity, rationalization, detection

From the triangle and the findings I derive a plan that I call the three-lever plan. It addresses the sides a business can influence and adds detection, because no prevention is complete.

Lever 1: Close opportunities

• Payments above a set amount only with approval by a second person.
• New suppliers and changed bank details only after review by a second person and a call back to a known number.
• Separate roles for ordering, receiving goods, and approving payment.
• Count and reconcile cash daily, cancellations only with a reason and approval.

Lever 2: Make rationalization harder

• Rules apply to everyone, expressly including the owner.
• A short code of conduct states what is allowed and what is not, for example regarding gifts from suppliers.
• Fair, transparent pay and achievable targets instead of pressure at any price.

Lever 3: Make detection likely

• Monthly review of all outgoing payments and master data changes by the owner.
• Mandatory vacation of at least one consecutive week with a real stand-in.
• A confidential reporting channel that everyone knows about.
• Exit interviews that explicitly ask about irregularities.

In a paper on low-cost measures for small businesses, Treadwell (2021) names similar building blocks: a code of conduct, careful hiring procedures, a reporting channel, managers who question missing or altered documents, exit interviews, and insurance against employee theft, known in Germany as fidelity insurance.

What to do if a suspicion arises?

A suspicion is not yet proof. The same distinction applies as in large cases: what is documented, what is alleged, what remains open? Calm and the right sequence protect both the business and the person suspected.

1. Do not rush, and initially share the suspicion only with a few trusted people.
2. Secure evidence without altering it: bank statements, invoices, logs of the accounting software.
3. Seek legal advice before speaking with the person concerned or taking action.
4. Close the gap that made the act possible, regardless of the outcome.

How to communicate externally in such a situation, if customers or banks are affected, is described in Reputation in a crisis.

Transferability and limits

Employee fraud is rarely the work of people who were hired with that intention. More often it is a situation in which pressure meets an open opportunity. This implies a sober role for the owner: you cannot prevent your people's hardship, but you can make sure they do not find an open till and that problems can be voiced.

The limits of the findings are clear. The ACFE figures are based on detected cases, the New Zealand study on 18 court documents, and there are hardly any robust data for small German businesses. The three-lever plan is derived from the model and the findings, not a measured method.

Conclusion: close opportunities, open conversations

To the guiding question: fake invoices, manipulated bank details, expenses, cash, and collusion with suppliers are typical in a small business. According to the fraud triangle, fraud arises when pressure, opportunity, and rationalization come together. A business prevents it effectively by closing opportunities with a few controls, making rationalization harder with fair rules for everyone, and making detection more likely through mandatory vacation, reviews, and a reporting channel.

No blanket suspicion is needed for this. On the contrary: controls that apply to everyone protect the honest people in particular, and that is almost everyone.