From discovery to recovery: A legal roadmap for employee embezzlement cases

Employee embezzlement remains a persistent and costly threat to California businesses. By the time such theft is uncovered -- let alone prosecuted -- the monies are often long gone, spent on shopping sprees, vacations or gambling. Companies are frequently left with little recourse beyond filing an insurance claim, or, in the absence of coverage, absorbing the financial loss themselves.

Yet it would be a mistake to assume that recovery is always futile. With swift legal action and the right strategy, businesses can often reclaim a meaningful portion of the stolen funds -- especially when the embezzlement involves substantial amounts. This article explores that recovery strategy in the context of California law, outlines best practices, and examines the benefits and potential risks of involving law enforcement.

 Moving fast to recover funds

The first step in recovering embezzled assets is to launch a swift yet discreet investigation. Maintaining confidentiality is critical. Once the employee learns of the inquiry, the likelihood of successful recovery drops sharply. The initial phase should include requesting banking and accounting records, and conducting interviews of outside vendors without tipping off the employee. 

If the employee learns of the investigation, they may attempt to destroy evidence or conceal assets before legal action can be taken. The objective is to build rock-solid evidence of fraud for use in litigation and to identify assets that can be frozen or seized. The challenge is to balance protections against further theft with efforts to recover the funds that have already been stolen.

The two primary tools for recovering funds are a prejudgment writ of attachment and a temporary restraining order. To maximize the chances of recovery, these remedies should be requested concurrently with the filing of the complaint. While both tools accomplish the same objective -- one is a legal remedy, the other is an equitable one -- each is appropriate for different circumstances.

 Prejudgment writ of attachment

A prejudgment writ of attachment is a legal order to seize an asset pending final resolution of a case. The purpose of the writ is to preserve an asset to later satisfy a judgment. In an embezzlement case, the writ can be used to seize an employee's house, car or bank account. When issuing writs, federal courts generally follow the law of the states where they are located. Fed. R. Civ. P. 64(a).

In theory, writs of attachment are available only for contract claims. Employers who have employee handbooks or codes of conduct with provisions requiring honesty and stewardship of company property can rely on them when seeking a writ of attachment. Yet even without such explicit contractual provisions, writs of attachment are available for breach of an "implied contract," which California law deems created when property has been acquired through fraud. See Klein v. Benaron, 247 Cal. App. 2d 607 (1967); Suzuki Motor of Am., Inc. v. Mullion, No. 8:17-cv-00903, 2017 WL 7410992, at *3 (C.D. Cal. Aug. 15, 2017). This means that any fraud case can become a breach of contract case, thereby making a writ of attachment available in most employee embezzlement cases.

The other main requirement for a writ of attachment is that the seizure be for an ascertainable amount. Cal. Civ. Proc. Code § 483.010. This requirement should be easy to satisfy in an embezzlement case so long as some effort has been expended to investigate and quantify the amount of the theft. The application would then request a seizure in that amount.

On the evidentiary front, the moving party must prove that they are more likely than not to prevail on their contract claim. Cal. Civ. Proc. Code § 481.190. The moving party must support their motion with affidavits, which must be based on personal knowledge, and any documentary evidence must be authenticated and otherwise admissible. See Lydig Constr., Inc. v. Martinez Steel Corp., 234 Cal. App. 4th 937, 944 (2015).

This is where many litigants stumble. To minimize the burden of drafting and executing multiple affidavits, companies might be tempted to centralize that knowledge in one or two affiants. That is a mistake. Even though writs of attachment hearings do not feature live testimony, approaching affidavits as if they were part of trial testimony maximizes the chances of success.

In most circumstances, notice will have to be given to the employee before the writ will issue, and the employee will have the opportunity to file opposition papers. Proceeding ex parte (on an expedited basis) is permitted only if the employer can show through affidavits that "great or irreparable injury" would result if normal notice were given. Cal. Civ. Proc. Code § 485.010.

An aggressive attempt to seize employee assets will face some barriers. California has a homestead exemption, which protects $600,000 of equity in a primary residence (adjustable for annual inflation from 2022). Cal. Civ. Proc. Code § 704.730. Any spousal interest will also be free from attachment.

Temporary restraining order

A TRO is a broader and more flexible remedy than a writ of attachment. It also has more requirements.

A TRO is designed to freeze the status quo on an emergency basis. In an embezzlement case, a TRO can be used to freeze an employee's bank and brokerage accounts to ensure that assets are not further dissipated. A court can impose a constructive trust to ensure that stolen funds are recovered.

An employer seeking a TRO must satisfy the same elements as a preliminary injunction: (1) that it is likely to succeed on the merits, (2) that it is likely to suffer irreparable harm in the absence of relief, and (3) that the balance of equities tips in its favor. If proceeding in federal court, there is an added element of the injunction being in the public interest.

The main difference between a TRO and a writ of attachment is the need to demonstrate irreparable harm. An employer can often satisfy this element by claiming that the employee is continuing to spend and conceal the stolen funds, and that the employee will otherwise have insufficient assets at the end of a lawsuit to make the employer whole. While the employer may not have direct proof of how the employee is spending stolen funds, a judge will often infer from the nature of the scheme that the funds are either being spent or concealed.

The larger the theft, the easier it is to establish irreparable harm. If the amount of the theft dwarfs the employee's salary, the employer can argue that it is highly unlikely that at the end of the lawsuit the employee will have sufficient funds to satisfy a judgment.  

By contrast, delay in seeking a TRO, particularly after the employee has learned that their employer has discovered the theft, can make it harder to satisfy this element. A judge will think any dissipation has already occurred and the employer will suffer no further harm by being forced to seek recovery at the lawsuit's conclusion.

Notwithstanding these added challenges, the main hurdle will still be demonstrating success on the merits. While in theory, the standard of proof for both is similar, courts have more latitude to accept some hearsay as part of a TRO and preliminary injunction. This relaxed evidentiary requirement should not be viewed as a license for sloppy drafting or speculative leaps.

Employers should strive to put forward only affiants with personal knowledge of the facts but should not fear if certain evidentiary gaps require reliance on evidence that, for example, cannot be properly authenticated. Given that TROs are pursued on an ex parte basis, with little opportunity for the employee to respond, courts are reluctant to grant them unless the evidentiary showing is compelling.

One final feature available with a TRO is that they may be obtained on a no-notice basis. Courts are particularly reluctant to issue a disruptive remedy like a TRO freezing an employee's assets without notice, yet may be willing to do so if the court is left with little doubt about the employee's guilt and believes there is a substantial danger of imminent fraudulent transfer if the employee were given a day or two notice of an impending TRO hearing.

Another key difference is that TROs are -- as their names imply -- temporary. A preliminary injunction hearing must be held within 14 days in federal court and within 15 to 22 days in state court. See Fed. R. Civ. P. 65(b)(2); Cal. Civ. Proc. Code § 527(d)(1). A court need not hear live testimony before converting a TRO to a preliminary injunction, but an employer's witnesses should be prepared to testify live in the event an employee, in contesting the TRO, puts forward evidence that contradicts certain witnesses.

When to choose each remedy

If urgency is a priority, and the threat of asset dissipation real, a TRO is a better tool, as judges are more accustomed to issuing them quickly. TROs can also cover a wider range of assets. However, a writ of attachment is a better tool if the employer wants a secured interest in a valuable and identifiable asset, as the writ creates a lien when served by the sheriff or U.S. Marshalls. Cal. Civ. Proc. Code § 488.500. Then, if the employee files bankruptcy during the pendency of litigation, the lien ensures that the employer has priority over later creditors. It is also possible to begin a case with a TRO and then follow-up with a writ of attachment to secure the recovery until the case's conclusion.

Reporting embezzlement to law enforcement

Another route to recovering funds is through criminal restitution. Both the state and federal criminal systems guarantee victims the right to recover stolen monies through restitution. But a prerequisite for restitution is a criminal conviction, which can take years (if ever), at which point all assets have been dissipated. So an employer should not rely primarily on criminal restitution to recover funds.

In theory, prosecutors can seize stolen funds before a conviction, or even before charges are filed, pursuant to a warrant based on probable cause on the basis that they are forfeitable proceeds of crime. Then, prosecutors can request that these funds be returned to victims after conviction is obtained. The challenge is that prosecutors (whether state or federal) will rarely act at the speed necessary to seize assets before they are dissipated. And, on the federal side, there are tracing requirements in forfeiture, requiring that the seized funds be directly derived from the stolen money. 21 U.S.C. § 853(a); 18 U.S.C. § 982(a)(1)-(2). Substitute assets -- i.e., those not traceable to the theft -- cannot be seized pretrial if the defendant needs those funds to pay for criminal defense counsel. Luis v. United States, 578 U.S. 5 (2016)

However, there are still advantages to reporting law enforcement concurrent with pursuing civil litigation.

First, there are always exceptions to the rule of prosecutors not acting expeditiously to recover funds, depending on the prosecutor's bandwidth and the relationship between outside counsel and the prosecutor's office.

Second, an active criminal investigation will make it challenging for the employee to continue to fight in civil litigation, given the risk of self-incrimination.

Third, criminal restitution orders are not dischargeable in bankruptcy, whereas default judgments or stipulated judgments (where many civil cases alleging embezzlement end up) could be if they include no factual admissions about fraud.

Fourth, publicizing a criminal conviction of a former employee can deter potential embezzlers at that company.

Fifth, on the federal side, a U.S. Attorney's Office's Financial Litigation Unit can collect on a restitution order many years down the road and then remit funds to the victim (an arrangement that can save on attorneys' fees for the victim).

The reporting calculus is more complicated for public companies if the loss is significant or the perpetrator is in a key financial position (i.e., the controller or CFO), either of which could trigger a reportable event under the securities laws. But, even then, a timely report to law enforcement that results in prosecution is a strong signal to shareholders that internal wrongdoing at the company is taken seriously and all avenues for potential recovery are pursued.

Conclusion

Shock and a sense of betrayal often accompany episodes of employee embezzlement. Employers should not let these initial reactions curdle into resignation and assume that stolen monies are never recoverable. Taking swift, coordinated action not only improves the odds of financial recovery, but can reinforce a culture of vigilance and integrity within the company.