When You Have Proof and Have to Decide What to Do
Why this matters
The evidence is in and the relief does not come. Owners expect the hard part to be finding out, and then discover that the hard part is choosing between five responses that all feel inadequate: fire them, fire them and get the money back on paper, sue, hand it to the police, or claim it. None of them undoes the loss, several of them cost more than the loss, and one of them can turn you from the person who was wronged into the person with a violation.
The decision is genuinely open, and anyone who tells you there is one right answer has not run a shop. What there is, is a small set of considerations that actually decide it and a much larger set that feel like they should. This card is the first group.
What "proof" has to mean before any of this is a choice
Test your file against a hostile reader before you act on it, because every option below is priced off how good the evidence really is, and yours will never look weaker than it does under someone else's reading of it.
Three questions do most of the work. Can a stranger follow the documents to the person without your inference filling a gap? Were the innocent explanations tested on paper rather than in your head? Is the record built from sources the subject could not edit? If any answer is no, what you have is a strong suspicion, which supports a conversation and a control change, not a termination and certainly not a report. See related: Before You Accuse Anyone: The Sequence.
The specific trap is the confession you half got. "He admitted it" usually means he agreed things had got out of hand, in a meeting with no second person and no notes, which is worth very little afterwards and can be recharacterised in an afternoon.
The five options, priced
| Option | What it costs you | What it buys | When it is the right one |
|---|---|---|---|
| Termination alone | The hiring and training cycle; nothing recovered | Speed, finality, minimum exposure | Evidence solid, recovery hopeless, no policy or contract requiring more |
| Termination plus restitution agreement | Drafting; months of collection admin | An admitted debt instead of a disputed fact | The person has income or assets and wants no record |
| Civil claim | Filing, your time, usually counsel above the small-claims ceiling | A judgment, which is permission to collect, not money | A defendant who can pay and will not |
| Criminal referral | Your time cooperating; loss of control of the outcome | A consequence that is not yours to give or withdraw | Strong evidence, a public-harm dimension, or a policy that requires it |
| Insurance claim | Proof-of-loss work; a claim on your record | The only route that pays out in full | You carry crime or employee dishonesty cover and can meet its proof condition |
The rows are not exclusive: the common combination is termination plus a restitution agreement, with an insurance claim alongside where the cover exists. The one that will not work is restitution traded for silence, for the reason in the drafting section below.
What actually decides it
Recovery prospects, which are usually poor. Most internal theft is spent, not saved, and a judgment against someone with no assets is a piece of paper you renew. Ask it bluntly: if this person signed a promise today, what would they pay it from? If the honest answer is nothing, restitution is not an option, it is a way of feeling like you acted.
The message to the crew, the most underweighted factor here, and it cuts both ways. Do nothing visible and the people who suspected something learn it is survivable. Make an example and the people who did nothing wrong learn the shop will go to the police over a disagreement about facts. What a crew reads is not severity, it is consistency and proportion.
Your time. A referral makes you a witness, on somebody else's calendar, for as long as it runs. A civil claim is the same and you are paying for it.
The weakness of your proof, priced as exposure. If the file is thinner than you believe, a termination in an at-will state is usually still lawful, but a defamation claim comes from what you SAY rather than what you did, and a malicious-prosecution claim comes from a report made without probable cause. Both are state-law questions and both are decided on facts, which means your investigation file is the answer to them.
Whether a policy or a contract has already decided it. A crime or employee dishonesty form carries notice duties and a proof condition, and many require notifying the police where you have reason to believe a law was broken; a property-management contract may carry its own notice clause. Read both first, because a route chosen in ignorance of them can cost you the only payout available. See related: The Employee Dishonesty Coverage Most Shops Do Not Carry.
Any reporting obligation you carry. A few licensing and bonding regimes require notice of specified events. This is state and trade specific and is a question for your board or your surety, not for an article.
Two cases, one gate
The gate is recovery: restitution is worth pursuing only where the person can realistically pay, and where they cannot, the choice narrows to termination alone or a referral, decided by whether repetition is a foreseeable harm to somebody else.
Case one. An office administrator with the payroll login raised her own rate three times over fourteen months without authorisation, totalling about 15 percent. Across 30 pay periods that is an overpayment of roughly nine weeks of her gross pay, established by setting the approved rate sheet beside the payroll register, both of which she could not alter retroactively. She has a home, a spouse in work, and no wish for a record.
Recovery is real, so the gate routes to restitution: termination, a signed agreement acknowledging the amount on an eighteen-month schedule, no referral. The crew never saw payroll, and the scheme required an access she will not be given again, so there is no repetition risk to a third party. The real gain is not the money, which arrives slowly; it is that a disputed fact became an admitted debt on the day she signed.
Case two. A parts manager, same quality of evidence, a loss reconstructed from over-ordering and reselling stock that also comes to about nine weeks of his own gross pay. Payroll shows two prior wage garnishments and there are no assets. Six of eight employees watched him leave and two have already been asked by a customer why he is gone.
Recovery is near zero, so restitution buys a plan that defaults in the third month. The gate routes to the second question, and the answer is that his next job is the same role with keys to somebody else's stockroom, which makes repetition foreseeable rather than hypothetical. That is the case for a referral, taken on its own merits rather than as a collection tactic, and the prosecute-or-handle-it card walks the rest.
Notice what did not decide either case: how angry the owner was, or the size of the loss, which is about nine weeks of that person's own gross pay in both. Same magnitude, opposite answers.
The restitution agreement, and the sentence that keeps you out of it
A restitution agreement is a contract. It acknowledges an amount, sets a schedule and says what happens on default, and its value is that it converts a fact you would have to prove into a debt the other side has admitted, which is what makes a later small-claims action short instead of an argument about your inventory records. Have a lawyer draft it; the saving on a home-made one is not proportionate to what it costs you.
The sentence that must never be in it, in any wording, is a promise not to report or not to prosecute. Most states have a compounding offence covering accepting a benefit in exchange for concealing a crime, and many extortion statutes reach a threat to accuse someone of a crime in order to obtain money. Whether your particular draft crosses either line is exactly the question your own attorney answers, and it is the reason the agreement is about the debt and never about the criminal exposure. You are also not in a position to promise it: the charge belongs to the state, not to you, so a promise to withdraw one is a promise you cannot keep.
Two drafting notes that matter more than they look. Do not build the payments as a payroll deduction, because wage deductions are governed by state rules that generally require specific, voluntary, written authorisation. And write the default clause knowing what you will actually do when it is breached, which for most shops is nothing; a clause you will not enforce teaches the other side how to read the rest.
The final cheque is not your collection mechanism
This is where a wronged employer most often creates their own violation, and it feels so reasonable that shops walk into it without pausing. The person took from you, so you hold their last cheque, or you net off what they owe.
Do not. Federal law requires wages to reach the employee free and clear, so a deduction for the employer's benefit that cuts below minimum wage for that workweek or into overtime breaches the FLSA (29 CFR 531.35), and that is only the floor. The state layer is stricter and is where shops actually get caught: most states require specific, voluntary, signed authorisation for any deduction, several prohibit deductions for loss or shortage even with authorisation, and the penalty for a late or short final cheque is typically measured in days of wages rather than in the size of your error. See related: The Final Paycheck Clock and Why It Is a State Question.
The result of getting this wrong is absurd: a solid theft case and a wage claim against you that you will lose, and the two do not net off, because they are separate proceedings under separate statutes. Pay the cheque in full on your state's clock and pursue the loss through one of the five options above.
Unemployment is separate. A discharge for misconduct disqualifies a claimant in most states, but misconduct is defined by state statute and case law and the employer has to show it at a hearing. Contest it on the strength of your file, and remember the hearing is on a record other people can later read.
What you can say afterwards, and to whom
To the crew: little, specifically, and there is an honest version that is neither silence nor detail. Rebuilding the Crew's Trust After a Theft is the card for that.
To a future employer calling for a reference: keep to facts you can prove from documents, because truth is the general defence to defamation everywhere and an opinion about someone's character is not a fact. Many states have reference-immunity statutes granting a qualified privilege to a good-faith, job-related disclosure, which protects the employer who answers carefully and does not protect one who embellishes. In the other direction, Missouri requires a corporation, on a former employee's written request sent by certified mail after at least ninety days of service, to issue a letter stating the nature and duration of the work and the cause of separation (RSMo 290.140), so "we only confirm dates" is not a lawful answer everywhere. Ask your own lawyer what your state does before the call comes, not during it.
To a customer who asks: that the person no longer works for the shop, and nothing else. There is no version of this conversation where adding detail helps you.
References
- Fair Labor Standards Act free-and-clear wage payment, 29 CFR 531.35; state wage-payment and deduction rules, which are stricter and control
- Missouri service-letter statute, RSMo 290.140, as an example of a state that compels a stated cause of separation
- Your commercial crime or employee dishonesty policy's notice and proof-of-loss conditions, and any client contract's notice clause
- See related: Before You Accuse Anyone: The Sequence; Prosecute or Handle It Internally; The Employee Dishonesty Coverage Most Shops Do Not Carry
- See related: The Final Paycheck Clock and Why It Is a State Question; Rebuilding the Crew's Trust After a Theft