Federal embezzlement cases are built backward. Investigators often begin with a number that appears to be missing, then reconstruct years of transfers, approvals, expense reports, emails, and accounting entries to decide who had access and why the money moved.

That process can make ordinary business records look more certain than they are. A transfer may be real while the government’s explanation for it is wrong, and an employee may have used an account without intending to steal from it.

The defense begins by testing the financial story, not accepting the label placed on it.

If suspected embezzlement has also triggered an audit or workplace inquiry, an internal corporate investigations attorney can help preserve financial records, identify who should oversee the investigation, and address potential criminal exposure before interviews begin.

Embezzlement is not simply another word for theft

Embezzlement generally involves property that a person could lawfully access or control before allegedly converting it without authority. Theft more often begins with an unlawful taking by someone who did not have authorized possession.

That distinction helps explain why these cases frequently arise from trusted roles. Bookkeepers, executives, bank employees, public officials, benefit-plan fiduciaries, and contractors may all have legitimate access to money that later becomes disputed.

When the allegations involve an owner, officer, or senior executive, an executive misconduct investigation may require independent oversight because the person accused may ordinarily control the records, employees, or reporting structure involved.

Access is not guilt. The government still has to prove the conduct and mental state required by the particular statute charged.

A defense may turn on questions such as:

• Who owned the property: The answer may be less obvious when accounts contain mixed funds or several entities share expenses.

• What authority existed: Written policies, board minutes, contracts, prior approvals, and established practice may contradict the government’s theory.

• What the defendant believed: A mistake, poorly documented loan, compensation dispute, or misunderstanding is not automatically a criminal conversion.

• How the amount was calculated: The government’s total may include authorized payments, duplicate entries, returned property, or transactions outside the alleged scheme.

• Whether the federal statute applies: Each law has its own jurisdictional facts, covered people, thresholds, and penalties.

What makes an embezzlement case federal

There is no single federal embezzlement statute. Federal jurisdiction usually depends on the owner of the property, the defendant’s role, the type of institution involved, or the organization’s connection to a federal program.

Common statutes include:

Mail fraud, wire fraud, bank fraud, false-statement, tax, or money-laundering counts may accompany an embezzlement allegation when the evidence supports their separate elements. An email or electronic transfer alone does not automatically prove a scheme to defraud.

Section 666 is often misunderstood. The government does not have to prove that the specific $5,000 in dispute came from a federal check, but it must establish the statute’s agency, property-value, and federal-benefits requirements.

Likewise, § 641 reaches government property and certain property made under a federal contract. It does not turn every dispute involving a federal contractor or grant recipient into federal embezzlement.

How federal investigators build an embezzlement case

The first sign of an investigation may be an internal audit, a bank inquiry, a request from an inspector general, a grand jury subpoena, or agents arriving for an interview. By then, investigators may already have bank records and information from an employer or former coworker.

Financial cases are usually document-heavy. Investigators may compare bank statements, general ledgers, vendor files, expense reports, tax returns, login records, emails, text messages, and the flow of funds between related accounts.

A spreadsheet is still an argument. Its categories, date range, assumptions, and treatment of legitimate transactions can all be challenged.

Counsel may need to determine:

• Whether transfers were counted more than once

• Whether reimbursements or returned property were credited

• Whether personal and business expenses were consistently classified

• Whether someone else had the same credentials or account access

• Whether the company followed the authorization practices it now claims existed

• Whether an auditor inferred intent from missing or incomplete records

• Whether the alleged loss includes transactions outside the charged period

The defense should preserve the source records before accepting an investigator’s summary. A clean, transaction-level reconstruction can reveal where the government’s theory begins to depend on assumption rather than proof.

Witness, subject, or target: what those labels really mean

People often repeat these terms as if they were formal promises about who will be charged. They are better understood as DOJ classifications that can change as the evidence changes.

The Justice Manual defines “target” and “subject” for grand jury investigations, but prosecutors do not have to give every person a status label before seeking an interview. A person described as a witness should still avoid guessing, minimizing, or trying to explain records without preparation.

A grand jury subpoena is not a criminal charge. It is, however, compulsory legal process with a response deadline, and it may raise issues involving scope, privilege, self-incrimination, record preservation, and the act of producing documents.

What the prosecution must prove

The elements depend on the statute and the indictment. In broad terms, the government must prove the charged connection to protected property or an institution, the prohibited taking or conversion, and the required state of mind beyond a reasonable doubt.

The prosecution may use evidence of concealment, false entries, personal purchases, repeated transfers, or statements about the money to argue intent. The defense can test whether that evidence truly excludes authorization, mistake, shared access, or another reasonable explanation.

Lack of criminal intent

Not every accounting problem is a federal crime. Incomplete records, weak controls, inconsistent reimbursement practices, and business-owner withdrawals may be serious management problems without proving the mental state required for conviction.

Intent is usually proved through circumstances rather than a confession. That makes contemporaneous documents especially important: emails requesting approval, compensation agreements, expense policies, loan records, and evidence that the transaction was openly recorded rather than hidden.

Authorization or a good-faith belief in authority

A defendant may have had express permission, authority created by their role, or a good-faith belief that the transaction was allowed. The precise defense and jury instructions depend on the statute and controlling case law, so “the owner knew” is not a complete legal analysis by itself.

Course of dealing can matter. If the business routinely approved expenses informally or corrected transfers after the fact, the government should not be allowed to present a later-written policy as if it governed every earlier transaction.

An unreliable loss or tracing analysis

The amount alleged in an indictment is not self-proving. A forensic review may show that the total includes legitimate compensation, business expenses, transfers between accounts owned by the same victim, taxes, interest, investigative costs, or money already returned.

Loss disputes can affect charging negotiations, restitution, forfeiture, and sentencing in different ways. Those numbers may overlap, but they are not always calculated under the same rules.

Failure to prove the federal connection

The government must establish the jurisdictional facts in the selected statute. For § 666, that includes the defendant’s status as an agent, the $5,000 property threshold, and more than $10,000 in covered federal benefits during the relevant one-year period.

For § 656, the government must connect the defendant and property to an institution covered by the statute. For § 664, it must establish that the property belonged to a qualifying employee benefit plan or connected fund.

Federal sentencing involves more than the loss amount

The statute determines the maximum punishment. The sentencing court then calculates an advisory Guidelines range and considers the broader factors in 18 U.S.C. § 3553(a) before imposing a sentence.

Many federal theft, fraud, and embezzlement offenses use USSG § 2B1.1. Loss can create a large increase, but the final calculation may also depend on criminal history, victim impact, role, obstruction, acceptance of responsibility, sophisticated means, and abuse of trust.

Actual loss and intended loss

Under the 2025 U.S. Sentencing Guidelines Manual, § 2B1.1 uses the greater of actual loss or intended loss. Actual loss is reasonably foreseeable financial harm that occurred, while intended loss is the financial harm the defendant purposely sought to cause, including harm that was impossible or unlikely to occur.

This does not mean prosecutors may select the largest imaginable number. The court must make a reasonable estimate from evidence, and intended loss turns on the harm the defendant purposely sought to inflict.

Credits against loss

The Guidelines generally credit money or property returned before the offense was detected. Detection occurs at the earlier of discovery by a victim or government agency, or the point when the defendant knew or reasonably should have known detection was imminent.

Money paid after detection may still support restitution, acceptance, remediation, or a request for a lower sentence. It usually does not reduce the § 2B1.1 loss figure under the standard credit rule.

Other enhancements require their own proof

The government may seek a two-level sophisticated-means enhancement when the defendant intentionally engaged in or caused especially complex conduct used to execute or conceal the offense. Repetition, a large total, or ordinary electronic transfers do not by themselves answer that question.

The victim enhancement can apply based on the number of victims, mass marketing, or substantial financial hardship. Courts should examine the actual effect on the people or organizations involved rather than treating every account entry as a separate victim.

An abuse-of-trust enhancement under § 3B1.3 requires professional or managerial discretion that significantly helped commit or conceal the offense. The Guidelines specifically say the enhancement does not apply to an ordinary bank teller merely because the teller handled money.

That distinction can be important for bookkeepers and other employees. The court should examine real discretion, supervision, duties, and how the role affected the alleged offense—not rely on a title alone.

The Guidelines are advisory, and the applicable edition can depend on the offense dates and ex post facto rules. A responsible sentencing analysis uses the correct manual and calculates each adjustment before discussing likely outcomes.

Repayment, restitution, forfeiture, and fines are different

These terms are often treated as if they describe the same money. They serve different purposes and can produce overlapping financial obligations.

• Repayment: Money voluntarily returned before or during the case. Its effect depends on timing and what the payment covers.

• Restitution: A court-ordered obligation intended to compensate legally recognized victims for covered losses.

• Forfeiture: A transfer of property to the government based on a statutory connection between the property and an offense.

• Fine: A financial punishment imposed as part of the criminal sentence.

The Mandatory Victims Restitution Act generally requires restitution for qualifying Title 18 property crimes with an identifiable victim who suffered financial loss. Statutory exceptions and causation rules still matter, and the restitution figure may differ from the Guidelines loss calculation.

Repayment should be documented and credited so a victim does not recover the same unpaid loss twice. Full repayment can reduce or satisfy the remaining restitution balance, but it does not erase a completed offense or require prosecutors to decline charges.

Criminal forfeiture is not automatic under every embezzlement statute. The government must identify a valid forfeiture law and establish the required link to the property it seeks.

Other consequences may reach beyond the sentence

A federal financial conviction can affect employment, professional licensing, government contracting, immigration status, insurance coverage, and the ability to serve in a fiduciary role. The exact consequence depends on the offense, profession, governing board, and applicable regulations.

Unreported diverted funds may also create tax exposure because illegally obtained income is generally taxable. That does not mean every embezzlement investigation becomes a tax prosecution, but tax returns and unexplained deposits may become part of the evidence.

Businesses can face their own concerns, including insurance notices, employment decisions, audits, civil claims, and preservation duties. Our guide to internal corporate investigations explains why a company and an employee accused of financial misconduct may need separate counsel even when their interests initially appear aligned.

What to do after learning about an investigation

The goal is to preserve options and reliable evidence. Trying to “fix” records or settle the matter informally can create more risk than the original transaction.

• Preserve records: Keep financial files, emails, messages, devices, calendars, contracts, and approval records in their original form.

• Record government contact: Write down who contacted you, the agency involved, what was requested, and any deadline without adding speculation.

• Do not alter the accounting: A correction made after an inquiry may be misunderstood and can destroy useful metadata.

• Avoid coordinated explanations: Do not ask coworkers what they plan to say or suggest a shared account of events.

• Do not consent on the spot: A request to search a phone, computer, office, or account deserves legal review unless agents present a warrant requiring immediate compliance.

• Get advice before an interview: A voluntary conversation with federal agents can create separate exposure if a materially false statement is made.

You have the right to decline a voluntary agent interview and ask for counsel. Do not lie, destroy evidence, instruct someone else to withhold information, or ignore a subpoena.

If you received a subpoena, target letter, interview request, or notice that your employer has opened an internal investigation, contact Keith & Lorfing before giving statements or producing records on your own.

If the inquiry began at work, remember that company counsel represents the company unless counsel expressly agrees otherwise. Your interests may overlap at first and separate later.

How Keith & Lorfing approaches federal embezzlement defense

Keith & Lorfing brings a trial lawyer’s approach to financial cases: identify what the government must prove, trace each important number to its source, and prepare disputed facts for the possibility of a courtroom.

Russell Lorfing previously served as a federal prosecutor in Lubbock, and our team includes multiple former federal and state prosecutors. Our attorneys have more than 75 years of combined experience and have handled more than 500 jury trials.

Those facts do not guarantee a result. They inform how we assess witness statements, financial proof, government charging decisions, and the sentencing record.

Depending on the case, our work may include:

• Communicating with agents or prosecutors before charges

• Responding to subpoenas and preserving responsive records

• Reviewing bank, accounting, payroll, and tax evidence

• Working with a qualified forensic accountant when needed

• Challenging authorization, intent, federal jurisdiction, and loss calculations

• Preparing for negotiations, trial, restitution proceedings, or sentencing

• Coordinating related employment, licensing, or business concerns

Frequently asked questions

Does paying the money back prevent federal charges?

No. Repayment may reduce the unpaid harm and may be relevant to charging, plea discussions, restitution, acceptance, or sentencing, but it does not erase an offense that prosecutors believe is complete.

Timing also matters under the Guidelines. Property returned before detection may reduce loss under § 2B1.1, while repayment after detection generally does not receive the same loss credit.

Can a first-time offender receive probation?

Sometimes, but first-offender status does not create a right to probation. The statute of conviction, offense classification, Guidelines range, criminal history, and § 3553(a) factors all matter.

Federal law bars probation for an individual convicted of a Class A or Class B felony. Because a felony violation of § 656 carries a 30-year maximum and is generally a Class B felony, probation is not an authorized sentence for that conviction; other embezzlement statutes may be classified differently.

Is the amount in the indictment the final loss amount?

No. The indictment states an allegation, and the amount may be tested through records, expert analysis, plea negotiations, trial, restitution proceedings, and sentencing.

The Guidelines loss, restitution amount, and forfeiture demand may use different legal rules. Counsel should review each number separately rather than accepting one total for every purpose.

Can agents charge me for lying even if they cannot prove embezzlement?

A materially false statement made knowingly and willfully in a matter within federal jurisdiction can create exposure under 18 U.S.C. § 1001. The statement does not have to be under oath.

That is why an unprepared effort to “clear things up” can make the case worse. You may decline a voluntary interview and ask to speak with a lawyer.

Do I need a lawyer before I am charged?

Pre-charge representation may be most valuable when agents request an interview, a subpoena arrives, an employer begins an internal investigation, or counsel learns that prosecutors view someone as a subject or target. Those events can create decisions about statements, document production, privilege, and preservation before an indictment exists.

An attorney cannot promise that early involvement will prevent charges. Counsel can help you respond deliberately and avoid surrendering rights or creating new problems.

Will a conviction cost me my professional license?

It may, but the result is not automatic for every profession. The licensing board will consider its governing law, the offense, reporting duties, and whether the conduct relates to professional fitness.

Licensing concerns should be identified early because a plea agreement or factual admission can affect a later administrative case. Criminal counsel may need to coordinate with a lawyer who handles the specific license involved.