Employee embezzlement: when the loss comes from inside.
Finding out that a trusted person took money or assets from your company is one of the hardest moments in running a business. What you do in the first days determines how much you can recover and which legal tracks remain open. This guide walks through the offense in plain language, the warning signs and the three legal routes to respond.
Guide · Current as of August 2026
What counts as breach of trust.
Abuso de confianza (criminal breach of trust, Mexico's embezzlement offense) is, in short, disposing of something that was handed to you in trust. An employee receives money, merchandise or equipment because of their position or a specific assignment and, instead of using it for the purpose it was given, takes it for themselves. The company entrusted it to them; they disposed of it as if it were their own.
It resembles other offenses, and telling them apart matters, because it changes what must be proven and how the case is pursued. In theft there was no handover: the person takes the asset without anyone giving it to them. In fraud, they obtain the money or the asset through deception, by making the company believe something false. And administración fraudulenta (fraudulent management) is the territory of whoever administers the company's assets (a manager, an attorney-in-fact, an accountant with signing authority) and runs them for their own benefit and to the company's detriment.
The exact label depends on the analysis of the case and on the legislation that applies in each Mexican state. What holds in general: breach of trust, fraud and fraudulent management are usually prosecuted only upon a querella, that is, a criminal complaint filed by the company itself, so the case moves only if the company formally asks for it. If the company does not act, no one will act on its behalf.
What a diversion looks like before it blows up.
Ghost vendors
Invoices from companies nobody on the team knows, repeated addresses, services no one can point to. Inflated invoices from real vendors count too.
Petty cash and expenses without support
Expenses in round numbers, receipts that never arrive, reimbursements that approve themselves. Cash is the oldest leak and the hardest to trace.
Inventory that never adds up
Shrinkage that grows without explanation, frequent inventory adjustments, differences that are always resolved on paper and never in the warehouse.
Reconciliations nobody reviews
The same person records, pays and reconciles. If nobody cross-checks the bank statements against the books, a diversion can live there for years.
The one who never lets go of their area
Never takes vacation, never delegates and gets uncomfortable when someone asks about their numbers. That absolute control of the area is exactly what keeps a diversion from coming to light.
The first days decide the case.
Preserve evidence without altering anything
Back up email, systems and accounting before moving anything. Control access carefully and without raising alarms. No deleting, editing or tidying files: evidence is only as good as it is intact.
Quantify with an audit
You need to know how much, since when and how. A solid accounting report supports the criminal complaint, the termination and the lawsuit; without a firm number, all three tracks limp.
Do not confront or fire in the heat of the moment
Confronting the employee too early hands them the chance to make evidence disappear. And on the labor side the clock runs from the moment you learn of the misconduct, so every move is made with the deadline in view.
Review powers of attorney, signatures and access
If the person holds notarized powers of attorney, signs on bank accounts or has system keys, their capacity to do damage is still alive. Revoking them is part of the strategy and is timed deliberately, so no one is alerted ahead of schedule.
Define the overall strategy with counsel
Criminal, labor and civil are coordinated, and the order of the pieces matters as much as the pieces themselves. Deciding what goes first is exactly the work of the first days.
Three legal tracks and what each one achieves.
The criminal track
It is prosecuted upon a criminal complaint filed by the company: without one, it does not start. It seeks sanctions for the person responsible and pushes for compensation of the loss. Filing it or not is a strategic decision, with costs and timelines measured beforehand.
The labor track
It allows a termination with cause, without liability for the employer, for loss of trust or lack of integrity. The window to do it is short and runs from the moment you learn of the misconduct, which is why the order of the steps matters.
The civil track
It goes after the money: recovering what was diverted and the damages it caused. It can be directed against the employee and, depending on the case, against those who benefited from the diversion.
So it cannot happen again.
Internal controls
No one records, pays and reconciles at the same time. Cross reconciliations, unannounced cash counts and a periodic external review close most of the doors.
Limited powers of attorney
Powers capped by amount and by subject matter, reviewed every year and revoked the same day someone leaves the role. A broad, forgotten power of attorney is a risk waiting to happen.
Clear, signed policies
Travel expenses, petty cash, purchasing and conflicts of interest in writing. A signed policy makes it easier to prove the breach in court and undercuts the classic that is not how I understood it.
Criminal compliance
Companies can also face criminal liability for what their people do. A serious compliance program reduces that risk and puts in writing how to react to a diversion, before it happens.
The firm's line on criminal matters.
Our criminal practice is preventive and corporate: first we work so the problem never happens, through controls, limited powers of attorney and compliance programs. When it has already happened, we defend the company's assets within the law and with absolute confidentiality: we lay out the options, we measure the risk of each one and the client decides. What we do not do is use criminal law to intimidate, or turn the criminal complaint into a collections tool. When one is filed, it is because the case supports it and it serves the company.
In criminal matters, discretion is also strategy.
What clients ask in these cases.
Is it still a crime if the employee already paid the money back?+
Paying it back does not erase the act: the offense was committed the moment they disposed of what was not theirs. Returning the money can weigh on the compensation of the loss, on the negotiation and on the company's decision to file the criminal complaint or not. The labor misconduct does not disappear with the reimbursement either.
How much time do I have to act?+
It depends on the track, and in all of them it pays to move early. On the labor side, the window to terminate with cause is short and runs from the moment the employer learns of the misconduct, not from when the diversion happened. On the criminal and civil side the deadlines are longer, but evidence and account balances go cold fast.
Can I fire the employee immediately?+
You can, but it is almost never a good idea. Firing on the spot alerts the person, makes it easier for evidence to disappear and leaves you building the case in a rush. First you preserve and quantify; the termination comes later, well documented and within the deadline.
Do I need to file a criminal complaint before I can terminate?+
No. The labor and criminal tracks are independent: you can terminate with cause for dishonesty or loss of trust without any criminal complaint involved. What you do need is to document the cause, because in a labor trial the employer is the one who has to prove it.
What if it was the accountant or an executive holding powers of attorney?+
The case changes size. Someone who manages company assets with formal authority may fall under fraudulent management, and those same powers let them keep causing damage until they are revoked. Revoking powers of attorney and notifying the banks is among the first moves, with timing set by the strategy.
How do you charge for this service?+
The firm's white collar criminal advisory is handled fully remotely and with strict confidentiality. First we run a diagnosis of the case and, based on it, we set a fixed fee in writing before we start. No surprises on the invoice.
Let's talk before moving the first piece.
If you have detected a diversion, or the numbers just do not add up, write to us. We review the case with you by video call, under strict confidentiality, and tell you which tracks are open and in what order it makes sense to think about them. The firm's criminal services are fully remote, supported by our labor and civil practices.