Who Actually Steals From Small Businesses, and Why It Matters When You Buy One

The finding most people get backwards

Ask a buyer who they would worry about in a small business and the answer is usually the bookkeeper. One person, unsupervised, touching every transaction. It is a reasonable instinct and the data does not support it.

The Association of Certified Fraud Examiners publishes a study every two years called the Report to the Nations. The Occupational Fraud 2026: A Report to the Nations edition covers 2,402 real cases across 143 countries, with a median loss of $104,000 per case. It is the largest sustained dataset on occupational fraud that exists, and it breaks results down by the perpetrator's level in the organisation.

Employees commit the most schemes. Owners and executives commit the most expensive ones, by a wide margin: the median loss when an owner or executive is behind it is more than nine times the median loss when an employee is.

Same organisations. Same control environments. Nine times the damage.

Why the gap is about access, not character

The nine-times figure is not a claim that owners are less honest than the people who work for them. It is a claim about what each role can reach.

Most control systems work by splitting a transaction across people. One person can request a payment, a different person approves it, a third records it, and a fourth reconciles the account afterwards. None of the four can move money and make the movement look ordinary without the cooperation of at least one other.

An owner of a small business routinely holds all four. They can set up the vendor, approve the invoice, sign the payment and decide which account it is coded to. There is no colleague in the chain to notice, because there is no chain.

That is also why owner schemes run longer. Employee schemes are usually caught by a control or a colleague. An owner scheme has to be caught by an outsider: a lender, an auditor, an acquirer, or eventually a tax authority. Outsiders arrive infrequently and look at summaries.

The two numbers that matter more than nine times

The headline ratio gets quoted. The two figures underneath it are the ones that change what you actually do.

Duration: a median of twelve months. Half of all schemes in the study ran longer than a year before anyone found them. That is not a story about clever concealment. It is a story about nobody looking.

Cost scales with duration, steeply. Schemes caught within six months carried a median loss of $40,000. Schemes running five years or more passed $1.1 million. The method does not change much across that range. The clock does.

84% showed a behavioral warning sign first. Living beyond apparent means, an unwillingness to share duties, unusual closeness to a vendor, refusing to take holiday. In more than four out of five cases something was visible before the money was found. Detection failure is overwhelmingly a failure to act on a signal, not an absence of one.

For a buyer, that last figure reframes the whole exercise. You are not looking for something hidden with great skill. You are looking for something nobody had a reason to examine.

What this means when you are the one buying

Strip the transaction back to what it actually is.

You are being handed a set of financial records. Those records were prepared by, or under the direction of, one person. That person has signature authority on the accounts, holds the logins, decides who becomes a vendor, and is the only individual with a complete picture of what normal looks like in the business.

They prepared those records for you, knowing what you would use them for.

This is not an accusation, and the overwhelming majority of the time nothing improper has happened. It is a description of the control environment you are inheriting, and it is the same control environment the ACFE data identifies as producing the most expensive outcomes when something does go wrong.

Two consequences follow.

The first is a diligence consequence. Verification that depends on the records themselves is weaker than it looks, because the records and the person are not independent sources. This is the same reason a discrepancy matters more for what it implies than for its size, which is the argument in a $500,000 problem against a $417 lie. Bank statements, tax returns filed with a government, customer confirmations and third-party contracts are independent. A profit and loss statement exported from the accounting system is not.

The second is an operational consequence. Whatever concentration exists on the day you close is the concentration you own on day one, alongside every other hidden liability you inherit. If one person held everything and that person is leaving, you have to rebuild the function, not just the relationships.

The four things one person usually holds

Run this on any deal you are looking at. It takes a conversation, not a data request, and the answers are the beginning of your first-ninety-days plan whether or not anything is wrong.

Concentration across all four is common, is not evidence of anything, and is worth writing down.

How to test it without accusing anyone

The useful checks are the ones that work from outside the records.

Start at the bank, not the ledger. Records can be coded to say anything. Money movement leaves a counterparty. Pull the five largest deposits in each of the last three years and name the customer behind each one. Then pull the largest recurring payments and name the company on the other side.

Look for money without a customer. Revenue that came from somewhere other than a customer has no invoice, no order, no sales tax and no name attached. That is a shape you can see from a bank statement whatever the ledger says about it, and it is the core of verifying revenue without trusting the seller.

Ask about the absences. In the study, an unwillingness to take holiday or to let anyone else cover the role is one of the most common warning signs. It is also a perfectly ordinary feature of a committed owner-operator, which is exactly why it is a weak signal on its own and a useful one alongside others.

Notice what happens when you raise something. The response to a question is information. An honest error produces documentation and then an explanation that follows from it. The reverse order, where an explanation arrives immediately and the documentation never quite materialises, is a reason to widen your sample rather than a verdict about a person.

Control concentration belongs on the same list as the other red flags that kill deals, and it is the one most often mistaken for ordinary owner-operator commitment.

Scope, stated plainly

The ACFE study measures occupational fraud inside organisations generally, and is based on the ACFE 2025 Global Fraud Survey of Certified Fraud Examiners conducted between July and September 2025. The cases caused more than $3.4 billion in total losses. The sample is cases reported by Certified Fraud Examiners, which means every case in it was discovered and investigated, and schemes that were never found cannot be in the data.

It is not a study of business sellers. No equivalent dataset exists for people selling small businesses, and none of the figures above should be described as the rate at which sellers misstate anything.

The application to diligence is ours. What the data supports is narrow and still useful: the role with the most access and the least oversight is the one associated with the largest losses, and in an owner-operated business that role belongs to the person handing you the numbers.