Can You Fire an Employee for Stealing? What to Do First

The short answer, then the real question

Yes. In 49 states, employment is at-will, which means you can end it for any lawful reason or no reason at all, and theft is about as defensible a reason as exists. Montana is the outlier — once an employee clears their probationary period there, you need good cause, and theft is good cause. So the legal answer is boring and the same almost everywhere.

The question that actually decides how this goes is different: can you fire them in a way that doesn't cost you more than the theft did? Because that's where small businesses lose. Not on the firing itself, but on what happened in the hours around it — evidence that got destroyed, a final paycheck handled wrong, something said to the wrong person. The theft was $4,000. The wage claim, the unemployment appeal, and the attorney's retainer are what turn it into $20,000.

What “proof” has to mean for you

You are not a prosecutor and you do not need to prove this beyond a reasonable doubt. The standard that protects an employer in almost every forum that matters — an unemployment hearing, a wrongful termination claim — is a documented, good-faith investigation that reached a reasonable conclusion. You looked, you wrote down what you found, you gave the person a chance to explain, and you decided honestly.

That standard cuts both directions, and this is the part people miss. You can be wrong and still be fine, if the investigation was real. You can be right and still lose, if you fired on a hunch and built the file afterward. Contemporaneous notes are worth more than a confession you can't evidence.

The order to do it in

The instinct on the morning you find out is to confront the person immediately. Resist it for about two hours. Almost everything that goes wrong here goes wrong because the confrontation happened before the preservation.

1. Preserve the evidence before anyone knows you know. Export the reports, screenshot the records, pull the edit logs, save the emails. Someone who realizes they're caught deletes things, and in most payroll and time systems they still have access to do it until you cut it off. If the fraud ran through payroll, the payroll audit checklist is the fastest way to scope how far it goes before you tip anyone off.
2. Cut system access, then talk. Not the reverse.
3. Suspend with pay instead of firing on the spot. This is the single most useful move in the whole sequence and hardly anyone does it. A paid suspension pending investigation ends the immediate risk, costs you a few days of wages, and buys you the time to be right. It also reads to a judge or a hearing officer as an employer who was careful rather than one who was angry.
4. Interview the employee, and actually listen. Ask open questions, take notes, let them respond to the specifics. Occasionally you get an explanation that holds up. More often you get an admission, and an admission given in a calm conversation is worth far more later than one extracted in a shouting match.
5. Have a second person in the room.A witness, taking their own notes. Every disputed termination eventually becomes one person's account against another's.
6. Decide, document the reason in one sentence, and be consistent with it.The reason you write down on day one is the reason you are stuck with. Employers who add new justifications later look like they're constructing a case, and that perception is what wrongful-termination claims are built on.

The final paycheck is where employers sue themselves

Here is the trap, and it catches people who did everything else right. You cannot simply deduct what was stolen from the final paycheck.

Under federal wage law you owe payment for hours actually worked, and deductions that push someone below minimum wage are prohibited outright. On top of that, most states regulate deductions for losses, shortages, and theft specifically, and a fair number effectively prohibit them even when the employee's guilt is obvious. California is the strict end of that spectrum. Some states require written employee authorization contemporaneous with the deduction, which a person you just fired is not going to sign.

Timing is the other half. Several states require the final paycheck immediately on an involuntary termination rather than on the next regular payday — California is again the sharp example — and the penalties for being late are calculated per day. Look up your own state's rule before the termination meeting, not after it. Pay everything owed, on time, and pursue the money through the channel built for it.

Unemployment, and whether it's worth contesting

Discharge for misconduct generally disqualifies a former employee from unemployment benefits, and theft is misconduct under any state's definition. But it is not automatic. The claim gets filed, you get a notice, and if you ignore the notice the benefits are granted and your experience rating goes up.

Whether to contest is a real business decision rather than a moral one. Contesting means a hearing, which means your investigation gets examined by someone neutral — fine if you ran it properly, unpleasant if you didn't. Weigh the rate impact against the hours. Plenty of owners who were entirely in the right decide it isn't worth the day.

Whether to involve the police

Genuinely optional, and genuinely consequential. Filing a report starts a process you no longer control: prosecutors decide whether to charge, the timeline is theirs, and the employee may become considerably less willing to repay anything once criminal exposure is on the table.

Arguments for filing anyway: an insurance claim under employee dishonesty coverage usually requires it, restitution ordered by a court has teeth that a private repayment agreement doesn't, and a pattern thief moves on to the next employer either way. If there's a policy in play, read what employee dishonesty coverage actually pays for before you decide, because the sublimits surprise people. And if money left the building electronically in the last few days, the reporting order matters more than the termination does — the window for recalling a wire is measured in hours.

What you say afterward

Very little, to very few people. Two rules cover most of it:

• To the rest of the team: that the person no longer works here. Not why. The urge to explain — partly to justify yourself, partly to deter the next person — is the urge that produces defamation claims.
• To a reference check:dates of employment and job title. Some states give employers qualified immunity for good-faith reference statements, but the safe practice is the same everywhere, and “we don't comment beyond dates and title” is understood by everyone who does this professionally.

Then ask the harder question

Firing the person closes the case and fixes nothing. Whatever they exploited is still open for the next person who notices it, and the replacement inherits the same access. The ACFE's 2026 data puts the median payroll scheme at 13 months before detection, which is a statement about controls rather than about honesty. If one person could both add an employee and release the payroll run, start with segregation of duties. If it came in through the time clock, the time theft version of this guide covers the wage-law wrinkle that makes those terminations different.

One last thing, said plainly: none of this is legal advice, and the state-by-state variation on final pay and deductions is wide enough that a twenty-minute call with an employment attorney before the termination meeting is cheap insurance. Cheaper than the wage claim, certainly.