# How can a small business owner or their accountant catch an employee or bookkeeper using a company credit card, or a card the owner doesn't know about, for personal purchases?

**Short answer:** Never pay a card statement without the receipts behind it, and make sure the statements come to someone other than the person who uses or pays the card. The ACFE counts making personal purchases with company funds as a fraudulent disbursement, and in its Occupational Fraud 2026 report billing schemes, which include invoices for personal purchases, were the most common kind of fraudulent disbursement: 21% of 2,402 cases, a median loss of $90,000, a median 14 months before detection, and 28% of cases at organizations with fewer than 100 employees against 18% at larger ones. A three-part ACFE Fraud Magazine series on misuse of an organization's credit describes the two patterns small organizations miss: an authorized card used for personal items, hidden because the bill was paid from the statement alone with receipts missing, and an unauthorized card ordered from the bank in the organization's name, with the statements taken out of the mail. The controls are a written ban on personal use, receipts for every charge, a reviewer who doesn't hold the card, limits per card, and a periodic check with your bank of every card issued on your accounts.

## Checklist
1. Write down that company cards are for business purchases only, with no cash advances, and have each cardholder sign it. Keep a log of every card issued and who holds it.
2. Don't pay a card balance from the statement alone. Match each charge to an itemized receipt first; the receipt says what was bought, the statement doesn't.
3. Have the statements sent, or made available online, to the owner or someone who neither holds the card nor approves the payment, and have that person do the monthly review.
4. Ask your bank and card issuers for a list of every card and authorized user on your business accounts, and compare it with your log. A card you didn't know about is how the unauthorized-card cases in the Fraud Magazine series worked.
5. Set a limit on each card and watch for purchases split to stay just under an approval limit, round-dollar charges, cash advances, repeat charges at the same merchant, and merchants that have nothing to do with your business.
6. Look at each cardholder's spending over time for jumps in amount or frequency, and check that items bought for the business are actually on the premises.
7. Treat missing receipts as a finding, not an inconvenience. In the Fraud Magazine cases, missing or destroyed receipts were how the personal purchases stayed hidden.
8. Keep your own dated record of each statement you approved and how many charges had receipts, outside the accounting software, so a later payment without that review stands out.

## How do employees hide personal purchases on a company credit card?
- The ACFE's 2026 glossary defines a fraudulent disbursement scheme as one where an employee distributes organizational funds or manipulates a payment function for a dishonest purpose, giving making personal purchases with company funds as an example. Its billing scheme definition includes invoices for personal purchases, such as an employee buying personal items and submitting an invoice for the employer to pay.
- Part one of the Fraud Magazine series says organizations should never pay employee charges on the bank's monthly statement without the accompanying receipts, because the receipts are what show whether a purchase was for business. In one case a city clerk-treasurer who processed all the city's disbursements, including the city card, bought $5,319.16 of personal items, mostly at a computer store; the city paid each month from the statement, and the receipts for those purchases were missing because she had destroyed them.
- The same article describes unauthorized cards. A small water district's office manager, who opened the mail, asked the bank on district letterhead for a card in the district's name and later for a higher limit; nobody at the district had authorized either, and it later said the authorizing signatures were forged. He took the statements out of the mail and charged $18,284.03 of personal spending, including cash advances, in about three and a half months. In another case a fire district chief obtained a card in the district's name and paid it personally to hide it; it was found only when the district changed signatories on its bank accounts.

## What does the ACFE 2026 report say about billing scheme losses?
- Occupational Fraud 2026: A Report to the Nations covers 2,402 cases investigated between January 2024 and September 2025. Billing schemes appeared in 21% of cases with a median loss of $90,000, lasted a median 14 months, and lost a median $6,400 a month.
- Billing schemes appeared in 28% of cases at organizations with fewer than 100 employees and 18% at larger organizations, one of the largest gaps by organization size in the report.

## What controls stop personal purchases on company credit cards in a small business?
- A 2002 Journal of Accountancy column on personal purchases lists misusing company credit cards as one of four ways employees buy things for themselves with company money, and recommends a clear ban on personal purchases, not letting the same employee originate and approve purchases, separating approval from payment and receiving, a maximum purchase limit per employee, checks for purchases just under approval limits, checks for deliveries to outside or employee home addresses, review of each employee's buying habits, and careful control of company cards, with particular attention to round-amount purchases.
- In a small business that usually means the owner keeps two jobs no matter who handles the books: reviewing each card statement against its receipts, and approving the payment. The person who holds a card or pays the bill shouldn't do either for their own card.

## Ask Rightshold (free, no key)
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code (one-click setup: https://www.rightshold.com/start?ref=seo), then ask: "Before my bookkeeper pays this month's company card statement, ask me to approve the payment: the statement reference, the amount, and how many of the charges had receipts. Wait for my yes or no."

```json
{
  "tool": "request_human_approval",
  "arguments": {
    "action": {
      "type": "card_statement_payment",
      "statement_ref": "CARD-0412-2026-10",
      "amount_cents": 384215,
      "charges_count": 37,
      "charges_with_receipts": 35,
      "unreceipted_cents": 12890
    },
    "summary": "Approve paying the October company card statement (2 charges still without receipts)",
    "expires_in_minutes": 1440
  }
}
```
- Needs an API key. Only the owner's account key can decide (decide_human_approval); delegated agent keys are refused. The signed, timestamped decision goes on Rightshold's ledger.
- Before the payment goes out, verify_human_approval (free, no key) checks the approval id against the payment as it stands. A different amount gives a different hash, so it won't match.
- To keep a dated record of each reviewed statement, seal it on a mirror ledger (REST, your API key): POST /v1/mirror-ledgers/{id}/entries with type payment, invoice_ref set to your statement reference and amount_cents, plus your own fields such as approval_id and unreceipted_cents. GET /v1/mirror-entries/{id} is free to check.
- Use card and cardholder references, not names or card numbers; entries with identity fields are refused.

_Rightshold doesn't connect to your bank, card issuer or accounting software, and it can't see card charges, find cards you don't know about or detect fraud. It records the approvals and statement reviews you send and lets anyone check them later, so it only helps if the card bill isn't paid without a matching approval. ACFE figures are from Occupational Fraud 2026; the cases are from a 2012 ACFE Fraud Magazine article and a 2002 Journal of Accountancy column. Not legal, audit, employment or accounting advice; if you suspect theft, talk to your accountant, a fraud examiner or a lawyer before confronting anyone._

## Sources
- [ACFE: Occupational Fraud 2026: A Report to the Nations (billing 21%, $90,000 median, 14 months, $6,400 per month; 28% vs 18% by organization size; glossary)](https://www.acfe.com/en-us/-/media/files/acfe/pdfs/rttn/2026/2026-report-to-the-nations.pdf)
- [ACFE Fraud Magazine: Using an Organization's Credit to Commit Fraud, Part 1 (2012)](https://www.acfe.com/fraud-magazine/all-issues/issue/article?s=2012-janfeb-frauds-finer-points-credit-fraud)
- [Journal of Accountancy: Billing Schemes, Part 4: Personal Purchases (2002)](https://www.journalofaccountancy.com/issues/2002/oct/billingschemespart4personalpurchases/)

## Related
- [How to catch fake or duplicate expense reimbursement claims in a small business](https://www.rightshold.com/answers/how-to-catch-fake-or-duplicate-expense-reimbursement-claims-in-a-small-business)
- [How to spot a fake vendor in your accounts payable](https://www.rightshold.com/answers/how-to-spot-a-fake-vendor-in-your-accounts-payable)
- [How to stop check tampering with positive pay at a small business](https://www.rightshold.com/answers/how-to-stop-check-tampering-with-positive-pay-at-a-small-business)
- [How to spot signs someone is hiding theft in your bank reconciliation](https://www.rightshold.com/answers/how-to-spot-signs-someone-is-hiding-theft-in-your-bank-reconciliation)

_Not legal advice. Updated 2026-11-11. JSON: https://www.rightshold.com/answers/how-to-catch-an-employee-using-the-company-credit-card-for-personal-purchases.json_