The core answer
When you suspect an employee of fraud or embezzlement, move in a fixed order. Secure the evidence quietly, put one person in charge, establish the facts in writing and give the employee a chance to respond. Only then decide on suspension, dismissal, recovery and a police complaint. Most cases go wrong early: the employee is confronted before the records are safe, or the file is scattered across HR, finance and the owner.
The rule (Labour Protection Act and Criminal Code). The employer may suspend an employee during an investigation only if the work rules or a collective agreement allow it, by a written order, for no more than seven days (LPA s.116). Dismissal without severance is possible for dishonesty in duty or an intentional criminal offence against the employer (s.119(1)), but the reason must be stated in the termination letter or told to the employee at dismissal. Embezzlement is s.352 of the Criminal Code; it is compoundable (s.356), and the complaint must be lodged within three months of learning of the offence and the offender (s.96).
Our practical view. The three-month clock is the point most owners miss. Decide within days whether a police complaint is a real option, keep a dated record of when management learned the facts, and run the internal investigation so that it supports that decision instead of delaying it.
1. What do we do in the first 48 hours?
- Secure evidence before confronting anyone. Copy or lock accounting files, bank statements, invoices, approval records, system logs and company email. Make a note of who did it and when.
- Limit access quietly. Remove payment authority, system admin rights and signing power in a way that looks routine, and change shared passwords.
- Do not accuse in public. Tell only the people who need to know. Statements to colleagues, customers or on social media can create a defamation claim against the company.
- Do not search personal property without a basis. Reading an employee's private phone, personal email or private accounts is risky under the PDPA and criminal law. Company devices and company accounts are different, but the use policy the employee accepted matters. Ask us before you rely on it. See our guide on employee data and the PDPA.
- Write the date. Record when and how management first learned of the problem. That date feeds the complaint deadline in section 5.
2. Who should investigate?
Use a small fact-finding group of two or three people, or an independent person. Avoid anyone who approved the transactions, is a friend or relative of the employee, or might be a witness. If the owner is personally involved in the events, bring in an outsider.
The group needs a written mandate: what is alleged, what it may inspect, who can see its report, and a target date. Keep one owner for the file. HR, finance and the lawyer each hold part of the picture, so name a single coordinator who holds the master file. Our employee investigations service can run the fact-finding as an independent step.
3. How do we run the investigation?
| Step | What to do | Watch out for |
|---|---|---|
| Define the allegation | One page: what, when, which accounts, which documents | Do not widen it mid-way without recording why |
| Documents | Contracts, invoices, approvals, bank records, handover forms | Keep originals; work on copies |
| Reconciliation | Accountant matches records against bank and stock | Note the method so a third party could repeat it |
| IT logs | Access logs, file changes, email on company systems | Follow the company's written use policy |
| Interviews | Separate interviews, a second person present, written record | Read the record back; ask the person to sign or note a refusal |
| Right to respond | Put the findings to the employee and note the answer | A one-sided file is easy to attack later |
| Report | Facts, evidence, gaps, and what is not proved | Separate facts from opinion |
Treat the interview as fact-finding, not a trial. Do not threaten, hold the person, or take their phone or belongings. Pressure used to obtain a signature can undo a later settlement, and can create its own liability.
4. Can we suspend the employee during the investigation?
Not by default. Section 116 bars suspension during an investigation unless the work rules or a collective agreement give the employer the power. If they do, the order must be in writing, name the offence, last no more than seven days and be notified to the employee before it starts. Pay during suspension follows the rate in the rules or the agreement; check the Act for the minimum before you set it. We do not state it here.
If the investigation ends and the employee did not commit the offence, section 117 requires the employer to pay wages for the suspension period as if the employee had worked, with what was already paid under section 116 counted, plus interest set by the Act. So suspension is not free. If seven days will not be enough, consider limiting access and moving the employee to other duties instead; ask us before you decide. Our guide on when HR should get legal review has the general rules in section 5.
5. Can we file a criminal complaint, and by when?
Section 352 of the Criminal Code covers a person who has possession of another's property (or property co-owned with others) and dishonestly converts it to themself or a third party. Section 353 covers dishonestly acting contrary to duty in managing another's property, causing financial damage. Theft is a separate offence. Which offence fits depends on the facts, such as whether the employee was entrusted with the money.
Section 356 makes the embezzlement chapter compoundable. Under section 96, for a compoundable offence the injured person must lodge a complaint within three months of knowing of the offence and the identity of the offender; otherwise the right to prosecute lapses. When time starts to run in a given case can be argued, so do not rely on the latest possible date. Decide early.
Filing a complaint (ร้องทุกข์) means giving the facts and documents to the police or the inquiry official. It starts the process; it does not guarantee a charge, a conviction or recovery of the money. Prepare a short chronology, the evidence index and a statement of the loss. Because the offence is compoundable, a settlement can end it, so decide how you will treat any repayment offer before you file.
6. Can we dismiss without severance?
Section 119(1) allows dismissal without severance for dishonesty in duty or an intentional criminal offence against the employer. Section 119, paragraph 2 adds a drafting rule: if the termination letter does not state the facts that are the reason, and the employer does not tell the employee the reason at dismissal, the employer cannot rely on that reason later.
So the letter should say what the employee did, when, and which section 119 ground applies. Do not send it until the evidence file is complete. For dismissal law generally, see our guides on employee dismissal rights and defending a Labour Court claim as an employer. Warning letters matter when the ground is a work-rule breach (s.119(4)); see our article on warning letters.
7. How do we get the money back?
| Route | How it works | Caution |
|---|---|---|
| Voluntary repayment | Employee agrees to repay, ideally in a written agreement | Draft carefully; no threats or coercion |
| Salary deduction | Only within the legal limits | See salary deductions; we do not repeat the rule |
| Civil claim | Sue for the loss in court | Needs proof of the amount and of the employee's act |
| Complaint plus settlement | Criminal complaint, then a negotiated payment | Compoundable offence; do not promise to drop a complaint to obtain a signature |
A written acknowledgement of debt should state the facts, the amount reached by the reconciliation, the payment schedule and what happens on default. A signature obtained by threat or pressure invites a challenge. Have the document reviewed before the employee signs.
8. What about confidentiality and defamation?
Limit the file to the investigation group. Tell other staff only that "a review is under way" if they must know anything. Do not name the employee in group chats, client emails or social posts. If a customer or bank must be told, state facts only, in writing, and after taking advice.
9. Checklist
- Evidence copied and locked; access limited quietly
- Dated record of when management learned of the facts
- One coordinator; written mandate for the investigators
- Allegation defined in writing
- Reconciliation done by someone independent of the transactions
- Interviews recorded in writing; employee's response noted
- Suspension used only if the work rules allow it; written order within seven days
- Decision on a police complaint made inside the three-month window
- Dismissal letter states the facts and the ground; evidence file complete
- Recovery route chosen; any acknowledgement of debt reviewed
- Prevention fixed: dual approval, rotation, reconciliation, access rights
After the case, close the control gap that allowed it. Our guide on internal controls covers prevention.
Further reading
- When HR should get a lawyer to review
- Employee dismissal rights in Thailand
- Defending a Labour Court claim as an employer
- Anti-bribery and internal controls
- Employee warning letters
Secure the evidence quietly, keep one dated file, and decide early on the three-month criminal complaint window, because the investigation should support your options, not use them up.
We help business owners and HR teams with internal investigations, employment documents and complaint preparation. For an initial consultation, call +66 92 254 2045 or send us the details. See also employee investigations, HR documents, labour compliance, criminal matters and labour matters.
This guide is published by Suwanvara Law Firm — a Khon Kaen law firm established in 1986. General information only, not legal advice on a specific matter.
