Employee Theft Investigations in Colorado

01The Colorado picture

Where Insider Losses Show Up in Colorado Businesses

Insider theft follows trust and opportunity. In Colorado that often means a longtime bookkeeper at a family construction company in Douglas County, a manager at a Denver restaurant group who controls voids and comps, an office administrator at a medical practice who also handles deposits, or a seasonal supervisor at a mountain resort with access to cash and rental inventory. Cash-heavy businesses carry extra exposure. Our Castle Rock investigators and Denver team see each of these settings.

Losses usually surface sideways: a vendor calls about a payment that never arrived, an outside accountant notices a pattern, a coworker mentions an expensive new truck, or cash deposits drift lower during one employee's vacation and recover when they return. By then the scheme may have run for years. A structured investigation tells you how much, how long and who, and our shock audits can capture records unannounced before anyone has time to adjust them.

02State law

How Colorado Law Treats Theft by an Employee

Colorado's general theft statute, C.R.S. § 18-4-401, covers knowingly obtaining, retaining or exercising control over anything of value of another without authorization or by deception, which reaches most embezzlement. As read in the 2025 statutes, the offense class rises with value: under $300 is a petty offense, $2,000 to under $5,000 a class 6 felony, $20,000 to under $100,000 a class 4 felony and $1 million or more a class 2 felony. That is why our loss schedules total amounts precisely. Our felony defense investigators know how prosecutors read those figures.

Two features matter for long-running schemes. Thefts committed twice or more within six months may generally be aggregated into a single count, and thefts from the same victim under one scheme can be aggregated too, so small transactions can add up to a felony. On the civil side, C.R.S. § 18-4-405 lets an owner whose property was taken by theft seek the greater of $200 or three times actual damages, plus costs and reasonable attorney fees. Our litigation support for attorneys builds the record for both paths.

• Offense class rises with the value taken
• Aggregation within six months or one scheme
• Civil theft claims for up to three times damages
• Attorney fees and costs recoverable in civil theft

03Method

Building the Case Before Anyone Is Confronted

The order of steps matters. We first secure the records that prove the scheme: bank statements, check images, vendor master files, payroll registers, point-of-sale logs, card statements and system access logs. Copies are preserved before the suspected employee knows anything is happening. We then reconstruct transactions, identify patterns and test innocent explanations. Our compliance audit team handles the control review that often runs alongside.

Only when the documents tell a coherent story do we recommend interviews, starting with people who are not suspects. The interview with the suspected employee comes last, planned with counsel, conducted respectfully and documented carefully. We never threaten prosecution to obtain repayment, which can create legal problems of its own. When observation outside work would help, such as confirming that diverted product is being sold, our employee surveillance team documents it lawfully from public places.

04Patterns

Embezzlement Schemes We Investigate in Colorado

Most schemes fall into familiar families. Billing schemes run payments to a shell vendor the employee controls, often with a name close to a real supplier. Payroll schemes add ghost employees, inflate hours or keep former staff on the books. Check schemes alter payees or forge signatures. Point-of-sale schemes use refunds, voids and employee discounts to pocket cash. Card schemes run personal charges through the company account. A shell vendor registered with the Colorado Secretary of State can sometimes be traced through our corporate collusion investigations.

Inventory diversion is the physical cousin: product leaves through returns, scrap, deliberate miscounts or deliveries to friendly buyers. In each family, the evidence is in the records long before anyone confesses. We test the pattern statistically, tie it to user IDs and shifts, and quantify the shortfall. Where physical product left the building, our workplace theft investigations handle the on-site side, and our stolen equipment team helps trace serialized items.

• Shell vendor and billing schemes
• Ghost employees and padded hours
• Altered or forged checks
• Refund, void and discount abuse

05Illustrative scenarios

Two Hypothetical Employee Theft Investigations in Colorado

The following examples are hypothetical, written to show how an investigation unfolds. A Greeley equipment dealer notices parts margins falling. Record review shows a parts manager voiding sales after customers pay cash, about $1,800 a month for two years, which aggregates into a felony-level loss. In a second example, a Colorado Springs property management firm finds a bookkeeper paying a vendor whose bank account matches her own. Our Greeley investigators and Colorado Springs team handle settings like these.

A third hypothetical: a Summit County ski shop sees rental fleet counts drop each spring. Point-of-sale data shows a supervisor closing out rentals as damaged and reselling the equipment online. In each example the work produces the same deliverable: a schedule of losses by date and method, the records behind each line and a summary that counsel, a prosecutor or an insurer can follow. Our stolen car and vehicle team handles the cases where company vehicles disappear.

06Recovery

Getting Stolen Funds Back After the Investigation

Recovery usually comes from several sources. Many businesses carry crime or employee dishonesty coverage, and insurers generally want a clear loss schedule with supporting records, which is exactly what our work produces. A criminal case may lead to a restitution order. A civil claim, including Colorado's civil theft statute, can reach the employee's assets, and small claims court handles disputes up to $7,500 while county court hears civil claims up to $25,000. Our asset investigations, with a $1,000 minimum, find what can be recovered.

Speed improves recovery. Stolen funds are often spent on vehicles, real estate, travel or transfers to relatives, and tracing them while the trail is fresh matters. We identify assets acquired during the scheme period and document their source when records allow. When the employee has left the state or gone quiet, our debtor skip tracing locates them, and our Colorado process servers serve the civil complaint.

07Prevention

Controls That Stop the Next Insider Loss

Most schemes exploit the same gaps: one person who both records and reconciles transactions, vendor files anyone can edit, no review of voids and refunds, and owners too busy to read bank statements. Simple controls close them: separate duties, require dual approval for new vendors, review exception reports weekly and have someone outside accounting open bank statements. Our risk audit team builds a control plan sized to your business, with audits starting at $1,200.

Hiring also matters. Colorado's Chance to Compete Act bars criminal history questions on the initial application, but employers may still obtain a publicly available criminal background report later in the process, and the Employment Opportunity Act generally allows credit information only where it is substantially related to the job, such as roles with authority to issue payments. Our Colorado employee background checks follow those rules, and Pueblo investigators support southern Colorado employers.

Services

Employee theft services in Colorado

• Embezzlement investigationVendor payments, checks and transfers traced to identify shell vendors, altered payees and diverted deposits, with every transaction tied to supporting records.Learn more
• Payroll fraud reviewPayroll registers, schedules, timekeeping and badge data compared to find ghost employees, padded hours and former staff still drawing pay.Learn more
• Point-of-sale analysisVoids, refunds, discounts and no-sale events analyzed by user and shift, then linked to footage and card data when the system preserves it.Learn more
• Inventory diversionShipping, receiving, scrap and sales records reconciled to find where product leaves the system and who handled each missing load or order.Learn more
• Company card misuseCard statements, receipts and expense reports reviewed to separate personal charges from business spending and total them by month for recovery.Learn more
• Loss schedule preparationA dated schedule of losses by method, with the records behind each line, prepared for prosecutors, insurers and civil theft claims in Colorado.Learn more
• Interview planningWitness and subject interviews sequenced with counsel, conducted respectfully and documented carefully, without threats or promises that could backfire later.Learn more
• Asset tracing for recoveryVehicles, property and transfers acquired during the scheme identified and documented so counsel can pursue restitution or a civil judgment.Learn more
• Controls and hiring reviewDuty separation, vendor controls, exception reporting and Colorado-compliant screening practices are reviewed to prevent the next insider loss, starting at $1,200.Learn more

How it works

How a Colorado insider theft engagement runs

1. 01

   Quiet scoping

   You describe the warning signs to Delator leadership in confidence. We agree on the records to secure, the people who should know and the scope and price in writing.

2. 02

   Secure and reconstruct

   Records are preserved before the suspected employee is alerted, then transactions are reconstructed, innocent explanations are tested and the loss is quantified by date and method.

3. 03

   Interviews and confirmation

   Interviews begin with people who are not suspects, and the subject interview comes last, planned with counsel and documented, with observation added only when warranted.

4. 04

   Report and recovery

   You receive the loss schedule, supporting records and a narrative summary, organized for an insurance claim, a police referral, a civil theft claim or all three.

Compare

Common insider theft types in Colorado and how we document them

Statewide coverage

Insider theft investigations across Colorado

We investigate employee theft for businesses in every Colorado county. Denver, Aurora and the Tech Center bring professional services, health care and hospitality cases, and Thornton and the north metro add distribution and retail. Weld and Larimer counties see agricultural and equipment dealer losses, mountain resort towns see seasonal cash and rental schemes, and Grand Junction serves Western Slope businesses. Remote record analysis works anywhere. See the Colorado investigations home page or our Georgia process serving overview for multistate service needs.

• Denver
• Aurora
• Castle Rock
• Colorado Springs
• Greeley
• Pueblo
• All of Colorado

FAQ

Frequently asked questions

Every service

Investigations available in Colorado

Every service below is available in Colorado and across Colorado, run by the same Delator Group leadership that manages our Tennessee casework. Choose a service to read how it works in Colorado.

Service areas

Private investigators across Colorado