Bookkeeper Fraud: 17 Red Flags and a Monthly Control Checklist

The questions owners ask after they find it

• How did a bookkeeper I trusted for years take money without my noticing?
• How could a long-time office manager write checks to themselves for months?
• How does a fake vendor stay on the payment list for years?
• How would I know if the person filing my returns was diverting a refund?

These questions describe the same shape: long-tenure, trusted, indispensable employee → quiet discovery → large cumulative loss → owner devastated.

ACFE’s 2026 Report to the Nations covers 2,402 investigated occupational fraud cases across 143 countries and territories. CFEs supplied their largest qualifying completed investigation, not a random sample of all businesses. These are case-loss statistics, not the probability your bookkeeper is stealing:

• Median occupational fraud loss: $104,000 per investigated case (ACFE 2026)
• Small organizations (under 100 employees): median $126,000 per investigated case
• Median duration before detection: 12 months
• Control associations: organizations with anti-fraud controls showed lower case losses and faster detection. The comparison does not prove a particular tool prevents fraud

Trust and independent verification can coexist. Missing independent verification can let unauthorized activity persist: the owner stops checking because trust replaces verification.

This post is the red-flag checklist and the control framework. Read it once. Implement the 10 core controls. Sleep better.

---

The 17 red flags

These are signals that something might be wrong. One alone isn't proof. Do not use a numerical score to diagnose fraud. Investigate the underlying transaction and arrange an independent review when the evidence warrants it.

Behavioral red flags

1. Refuses vacation or time off. Someone avoiding vacation may be overloaded, worried about coverage or hiding a problem. In ACFE’s 2026 investigated cases, about 5% of perpetrators were recorded as refusing to take vacation. This does not estimate the probability that an employee who skips vacation is stealing. Operator check: when did someone else last reconcile the accounts, inspect vendor changes and compare payroll with the active employee roster?

2. Insists on handling books alone. "I'll just do it, it's easier." "They won't understand the system." "The CPA makes mistakes when they look at it." Anyone aggressively gatekeeping the books is a concern.

3. Lifestyle inconsistent with salary. New car, new house, expensive vacations, gambling, or kids in private school, on a bookkeeper's salary. Treat it as a reason to review, not proof, since family money or a second household income can explain it.

4. Resists new software or controls. Pushing back on implementing bill pay approval, new accounting software, a controller hire, or outside review. The person with something to hide doesn't want more eyes on the books.

5. Over-involvement in owner's personal finances. "I'll handle your personal bills too." "Let me manage your taxes." Access creep is how small frauds become large frauds.

6. Abrupt defensiveness when asked routine questions. "Why are you asking?" "Don't you trust me?" Routine questions ("what's our current AP balance?") should get routine answers.

7. Unusual familiarity with vendors. Knows the personal lives of specific vendors, especially smaller or local vendors. Especially concerning if those vendors appear to have unusually fast or easy payment terms.

Operational red flags

8. Bank or credit card statements arriving at unusual addresses. Statements redirected to a home address, a PO box you don't control, or "the bookkeeper's office." Statements should always come to the owner (or an independent reviewer) first.

9. You haven't personally reviewed a bank statement in 6+ months. This is the master red flag. If the owner hasn't independently reviewed a statement, comparing to the books, checking for unknown payees, the books are unverifiable.

10. Reconciliations "always perfect" with no adjustments. Bank reconciliations can legitimately have no reconciling items. Compare apparently pristine reports with bank statements and transactions obtained independently; matching totals alone do not establish fraud.

11. Unusual or unexplained journal entries. Large round-number entries. Entries to "suspense" or "miscellaneous." Reversals that don't correspond to real business events. Any CPA or reviewer can spot these; most owners never look.

12. Vendor list has duplicates or near-duplicates. "ABC Supplies" and "ABC Supply" and "A.B.C. Supplies Inc." may be three records for one vendor, or two real vendors and one fake. Dedup audits matter.

13. Checks or ACH payments to employees or "vendors" at employee addresses. A common billing scheme routes payments through fake vendors whose addresses or bank accounts trace back to the perpetrator. Address matching vs. employee records catches this.

14. Petty cash constantly "short" or receipts missing. Small-dollar, chronic theft warning sign. Also common first step before larger schemes.

15. Payroll irregularities. Overtime that doesn't reconcile, ghost employees (people on payroll who don't work there), unusual bonus patterns. Operator check: compare the payroll register to an owner-maintained roster of active employees every quarter.

16. Tax filings you can't access or review. If your bookkeeper or CPA files your returns but won't share copies, logins, or IRS/state correspondence, huge red flag. Every business owner should have direct access to their own tax records.

17. Unusual patterns around year-end or tax season. Books that need "cleanup" at year-end every year. "Adjustments" that show up in December. Or, conversely, the bookkeeper is suddenly "too busy" to produce reports during audit season.

---

The 10 controls that reduce opportunity and improve detection

Start with 10 practical controls consistently applied. They reduce opportunity and improve detection; none guarantees prevention. Here they are.

Control 1: Owner reviews bank statements directly, every month

Bank statements should come to an address you control (often your email, direct from the bank). You open them. You look at the activity before the bookkeeper does.

This will not catch every scheme (payroll padding and vendor-master changes can look normal on a statement), but it removes the ability to hide unknown payees from the first person who reads it.

Control 2: Segregation of duties on check/ACH authorization

Different people should:

• Initiate a payment (bookkeeper entering a bill)
• Approve a payment (owner or controller)
• Execute the payment (bank signs check, sends ACH)

Solo bookkeepers who can do all three are the highest-risk configuration. Bill pay tools (Bill.com, Ramp, BILL Spend & Expense) can enforce approval workflows when configured that way; confirm the approver is not the same person who entered the bill.

Control 3: Require 2-signer approval on any payment over $X

Set a threshold ($5K, $10K, whatever fits your business). Any payment above it needs a second signature or approval. A threshold rule forces a second person to see large payments. It does not stop payments split to stay under the threshold, so pair it with Controls 1 and 4 and look for repeated amounts just below the limit.

Control 4: Vendor onboarding requires owner approval

New vendors can't be added to the payment system without owner approval. Require a W-9, a real address, and a purpose. With this control, a fake vendor has to get past a second person before it can receive a payment.

Control 5: Monthly reconciliation review by a second party

Monthly if possible, and once a quarter at minimum, a CPA, fractional CFO, or controller independently reviews the bank and credit card reconciliations. Not just the summary, actual underlying reconciliation with detail.

Control 6: Mandatory vacation

Bookkeepers and anyone with financial authority must take at least 1 full week of consecutive vacation per year. Someone else covers their duties. Coverage creates an independent view of work that would otherwise stay with one person. Follow applicable employment rules and arrange reliable handoff; time off is not a test of someone’s honesty.

Control 7: Annual independent review or audit

At $1-5M revenue, consider an "agreed-upon procedures" engagement from a CPA, scoped to tests you choose (for example vendor master changes, a payroll roster match and reperformed bank reconciliations). At $5M+, consider a review or audit. A review is not designed to detect fraud, and an audit gives reasonable assurance about material misstatement, not a guarantee that theft is found. Fees here are an illustrative planning assumption, not measured prices: roughly $2-5K for a narrow procedures scope and $10-25K for a review or audit at that size. Get scoped quotes.

Control 8: Background checks on finance hires

Before hiring a bookkeeper, controller, or AP manager, run a background check. A clean check is not clearance, because many people who commit occupational fraud have no prior record. Credit checks (where legal and with required notices) can flag personal financial stress, a commonly cited fraud motivator.

Control 9: Owner has independent login access to all financial systems

Never be the owner who "doesn't have the QuickBooks login" or "forgot the bank credentials." Independent admin-level access to QuickBooks, banks, credit cards, and payroll. You verify this works monthly.

Control 10: Fraud insurance (employee dishonesty coverage)

Business insurance policies often have employee dishonesty or "crime" coverage riders. As an illustrative planning assumption, not a quoted rate, a $500K-$1M limit may cost on the order of $500-2,000/year; premiums depend on carrier, headcount and controls. Coverage pays subject to limits, deductibles, exclusions and notice and proof-of-loss deadlines, so read the policy. Ask your broker for a quote this week.

---

The checklist: 15-minute monthly fraud check

Treat 15 minutes as a starting checkpoint for a small account set. Complex payroll, multiple banks or a suspicious item needs more time and a qualified reviewer.

• Open and review the bank statement yourself (not via the bookkeeper's forwarded copy)
• Scan for unknown payees: anything that doesn't look familiar, google it or ask about it
• Spot-check 3 random payments: click through to the check image or ACH detail; verify the purpose
• Review credit card statement the same way
• Compare total payroll on statement to what you expect (+/- 5% sanity check)
• Check vendor list: has any new vendor been added this month? Was it approved?
• Confirm account balances against what your bookkeeper's reports say
• Review any wire transfers or large one-time transactions personally

Repeat monthly, document the items checked, and assign each exception an owner and follow-up date. The routine does not promise detection in a particular month.

---

What to do if you find something

If you suspect fraud:

Do NOT

• Confront the employee immediately
• Delete anything (document everything)
• Share suspicions widely inside the company
• Destroy or overwrite logs when restricting access. If money is actively at risk, contact the bank and qualified legal or forensic help promptly; preserve evidence while securing accounts

Do

• Hire a CPA or forensic accountant to confirm the scope (get a scoped quote; fees vary with the number of accounts and years reviewed)
• Consult with an employment attorney on termination procedures
• Notify your fraud insurance carrier if you have employee dishonesty coverage (most require timely notice)
• File a police report where appropriate, and ask your CPA whether to submit IRS Form 3949-A (an optional information referral) and how the loss affects your own return
• Consider civil recovery. Recovery is often partial, but a civil judgment preserves your options; ask your attorney about limitation periods
• Review what controls failed and fix them before the next hire

The hard truths

1. Prosecution is a separate decision. Some owners prefer termination + restitution agreement to criminal case (which is public, slow, and embarrassing).
2. Recovery is often low. Many victims recover only part of the loss or nothing. Plan as if the money may not come back, which is why prevention and insurance notice deadlines matter.
3. The emotional cost can be as hard as the financial loss. Betrayal by a trusted employee is genuinely traumatic. Budget for your own support (therapy, peer groups) if this happens to you.

---

Three fictional teaching scenarios

These fictional teaching scenarios illustrate control failures, not Level client outcomes.

Fictional scenario 1: A near-duplicate vendor receives unauthorized payments

In a fictional example, a clerk adds a vendor whose name differs from a real supplier by one letter. Unauthorized payments of $2K each month for a year total $24K. An independent reviewer compares new vendor records, invoice support and the receiving account before approving another payment. Recovery is not assumed.

What failed: No vendor onboarding controls. No second reviewer. No audit.

Fictional scenario 2: A check reaches the wrong payee

In this fictional example, an office manager intercepts a vendor check and changes its payee. The owner obtains the check image directly from the bank and compares its payee with the approved invoice, rather than relying on a forwarded summary.

What failed: Owner never reviewed bank statements and check images directly; the fictional case does not establish what vacation or signing controls existed.

Fictional scenario 3: A ghost employee receives $60K in wages

A fictional payroll clerk adds a person who never works for the business. Gross pay of $30K a year for two years totals $60K, before employer taxes. Comparing employee names, IDs and payment details with an independently maintained active roster exposes the mismatch.

What failed: No payroll reconciliation vs. HR records. No annual review of active employee list by the owner.

---

Bookkeeper vs. outsourced firm vs. platform, risk comparison

Risk ratings below are qualitative judgments about segregation of duties, not measured fraud rates. Cost figures are illustrative planning assumptions for a small business, not market survey data.

The punchline: outsourced or platform-based bookkeeping can reduce fraud risk when it is set up so that no single person has end-to-end control. That benefit depends on the setup, not the label: confirm who can add vendors, release payments and change bank details, and keep reviewing statements yourself.

---

FAQ

How common is bookkeeper fraud really? ACFE respondents estimate that organizations lose about 5% of revenue to occupational fraud each year. It is an expert estimate, not a measured loss or probability for your business. The 2026 report’s median case loss is $104K; the 2024 report’s was $145K. Different investigated-case samples do not establish a change in the incidence of bookkeeper fraud. Use the findings to prioritize controls, not to accuse an employee or book a presumed loss.

What's the single most effective fraud prevention control? Start with an independently obtained bank statement, then verify payees against approved bills and vendor changes. Statement review can miss a ghost employee paid through ordinary payroll or an apparently legitimate vendor, so also reconcile employee rosters and payment permissions. Budget time for your account and transaction volume.

Do I need fraud insurance if I have a small business? Ask your broker whether employee dishonesty or crime coverage fits your risks. A policy pays subject to its limits, deductible, exclusions and notice deadlines. Obtain a scoped quote.

My bookkeeper has been with me 10 years and I trust them completely. Am I being paranoid? No. Long tenure is not evidence of theft. Apply the same independent checks to every person with payment authority, including the owner. The controls also help protect an honest employee from false suspicion.

What about using AI-powered accounting to prevent fraud? Spend, bill pay and bank platforms (Ramp, Brex and others) often offer features that help: audit trails, approval workflows, vendor validation and anomaly alerts. Confirm which features your plan includes and that they are turned on. None of them eliminate the need for controls, but configured roles can reduce single-person control when the preparer cannot also approve and release the payment.

If I find fraud, do I have to prosecute? No. Decisions about employment action, restitution, civil recovery and criminal referral depend on the facts and legal advice. Consult a lawyer before deciding. Either path, discuss IRS Form 3949-A, an optional tax information referral, with your CPA or attorney if there is suspected tax-law noncompliance. Separately confirm reporting duties, evidence preservation and how a substantiated loss affects the business’s return.

---

Worried about controls in your business but don't want to have an awkward conversation with your bookkeeper? Book a confidential call. We'll discuss your current controls and priorities on the first call. A risk review and help implementing the 10 controls follow an agreed engagement and access to the relevant records. Many of the controls above can be set up without new software.

Related reading

• Bookkeeping cleanup playbook
• When to hire a CFO vs a bookkeeper
• What real CFO work looks like
• Bookkeeper vs accountant vs CFO

Source: ACFE Occupational Fraud 2026: A Report to the Nations, global cost of fraud, organization size (Figure 22), behavioral red flags and methodology. ACFE’s case statistics are separate from Level’s research across 2,200+ contractors and $13.25B in job revenue; that contractor research does not measure fraud incidence or loss.