Skimming and Lapping, Explained: How Cash Goes Missing Before — and After — It Hits Your Books

Your books balance. Your bank reconciliation ties out. And money is still walking out the door every month.

That is the uncomfortable reality behind two of the oldest cash frauds in small business: skimming, where cash is stolen before it ever enters your accounting records, and lapping, the cover-up technique that keeps the theft hidden for months or years. Organizations lose an estimated 5% of annual revenue to occupational fraud, with a median loss of $145,000 per case and a median scheme length of 12 months before anyone notices, according to the Association of Certified Fraud Examiners' 2024 Report to the Nations. Small businesses get hit hardest — they are the least likely to have an audit, a fraud hotline, or adequate internal controls.

The good news: both schemes leave traces, and the controls that stop them cost almost nothing. Here is how each scheme works, the red flags to watch for in your own numbers, and the simple routines that make your cash nearly impossible to steal quietly.

What Skimming Actually Is​

Skimming is the theft of cash before it is recorded in your accounting system. Because the receipt never enters the books, there is no missing entry to find — the transaction simply does not exist as far as your records are concerned. That is what makes skimming an "off-book" fraud, and what separates it from cash larceny, which is stealing cash after it has been recorded. Larceny creates a mismatch between recorded cash and cash on hand; skimming hides the transaction entirely.

Skimming thrives wherever customers pay in cash. Restaurants, food trucks, car washes, salons, farmers market stalls, and any business with a register drawer are the natural habitat. It is especially common where employee turnover is high, because new hires with questionable backgrounds cycle through cash-handling roles faster than background checks or training can keep up. Each individual theft may be small — a $20 bill here, an unrecorded cash sale there — but stretched over months or years, the losses compound into tens of thousands of dollars.

One uncomfortable footnote: sometimes the person skimming is the owner. Pocketing cash sales also shrinks reported profit and therefore the income tax bill — which converts the theft into tax evasion as well. If you are ever tempted, understand that examiners have purpose-built tools for reconstructing unreported cash income, and the penalties dwarf whatever tax was saved.

The three places skimming happens​

Skimming is not one trick. In practice it falls into three patterns:

• Sales skimming. A cash sale is never rung up. No receipt is issued, no entry is made, and the cash goes into a pocket instead of the drawer. Under-ringing (recording a $50 sale as $30) is a quieter variant of the same idea.
• Receivables skimming. A customer's payment on account is intercepted and pocketed before it is posted. The customer's balance stays open even though they paid — which is exactly the problem lapping exists to solve.
• Refund and discount skimming. A legitimate-looking refund, void, or discount is entered to justify cash leaving the drawer, and the "refunded" cash is kept. Because the entry looks routine, it survives casual review.

Lapping: The Cover-Up That Keeps Skimming Alive​

Lapping is not really a separate theft — it is the concealment method that lets receivables skimming run indefinitely. Here is the mechanics of it, step by step:

1. Customer A pays $1,000. The employee pockets the cash and posts nothing to Customer A's account.
2. Customer B pays $1,200. The employee posts $1,000 of it to Customer A's account (making A look current) and pockets the remaining $200.
3. Customer C pays $900. Part of it gets posted to Customer B's account to keep B from going past due, and the rest disappears.

Each new payment covers the previous theft, like shingles overlapping on a roof — hence the name. The scheme only collapses when payments slow down, a customer complains about a balance they already paid, or someone compares the actual deposits against what was posted.

Lapping flourishes in exactly one organizational condition: a single person controls the whole receivables cycle — opening the mail, receiving payments, posting to customer accounts, and handling customer complaints about billing. As long as one set of hands does all four jobs, the thief can intercept payments, misapply later receipts to cover the gaps, and soothe or suppress the complaints that would expose the pattern. Small businesses land here by default, because a one-person accounting department is the rule rather than the exception.

Why Small Businesses Are the Easiest Targets​

Fraud examiners have studied this pattern for decades, and the verdict is consistent: small businesses remain the most vulnerable to occupational fraud. Three structural reasons explain why:

• No segregation of duties. With two or three office employees, the same person often receives cash, records it, reconciles the bank account, and follows up on past-due balances. Every one of those pairings is an opportunity to steal and cover it up in the same sitting.
• No independent review. Small businesses are the least likely to have an internal or external audit. Without a second set of eyes on the cash cycle, a scheme can run for its full 12-month median lifespan — or far longer.
• No reporting channel. Most occupational fraud is detected through tips, yet small businesses rarely have a hotline or any formal way for employees, vendors, or customers to report suspicions. The people most likely to notice something wrong have nowhere to say it.

None of this requires a large staff or an expensive system to fix. The controls below are sized for businesses where the owner is also the controller, the auditor, and the HR department.

Red Flags You Can Spot in Your Own Books​

You do not need forensic training to notice the early symptoms. Watch for these patterns:

Customer complaints about payments you "never received"​

This is the classic lapping tell. A customer insists they paid, produces a canceled check or transfer confirmation, yet their account shows a balance — or shows their payment applied to the wrong invoice. One such complaint is a clerical error. A cluster of them, especially handled quietly by the same employee, is a pattern worth investigating.

Receivables aging that drifts while sales hold steady​

If revenue is flat or growing but an increasing share of receivables slides into the 60- and 90-day buckets, ask why. In a lapping scheme, customer accounts perpetually lag reality because each payment is diverted to cover an earlier theft. Compare your days sales outstanding month over month; a slow, unexplained climb deserves an explanation.

A widening gap between cash and non-cash sales​

Track the ratio of cash sales to card and electronic sales over time. Electronic payments are hard to skim because the processor's records exist independently of your books. If the cash share of revenue shrinks while foot traffic and card sales hold steady, some of that cash may be leaving before it is recorded.

Discounts, voids, credits, and write-offs that spike​

Skimming through fake refunds needs bogus offsetting entries. Pull a monthly report of all voids, discounts, returns, and credit memos — who entered them, for which customers, and in what amounts. A concentration of round-number credits issued by one employee, or write-offs of small balances that customers swear they paid, merits a closer look.

The employee who never takes a day off​

This one is behavioral rather than numerical, but examiners flag it constantly. A lapping scheme requires daily maintenance — every absence risks a substitute posting receipts correctly and breaking the chain. An employee who refuses vacations, resists cross-training, and insists that only they can handle "their" accounts may simply be conscientious. Combined with any flag above, it stops being a compliment.

The Proof-of-Cash Test: Your Strongest Detection Tool​

The single most powerful technique for catching these schemes is the proof of cash — a four-column bank reconciliation that auditors have used for generations. A standard bank reconciliation only ties your ending book balance to the bank's ending balance. A proof of cash goes further: it reconciles the beginning balance, the total receipts, the total disbursements, and the ending balance, checking that the book and bank figures agree in every column, both across and down.

Why does that matter? Because skimming and lapping break different columns in revealing ways:

• Unrecorded deposits (cash received but never booked) show up when bank receipts exceed book receipts for the period.
• Unrecorded or misrecorded disbursements surface when the disbursement columns disagree.
• Timing games — deposits recorded in the wrong period to cover a gap — break the reconciliation across consecutive months, which is why examiners run the proof over several periods rather than one.

A simpler companion test catches lapping directly: compare the detail of recorded cash receipts against the validated duplicate deposit slips from the bank. In a lapping scheme, the total deposited may look right while the customer-by-customer detail is wrong — Customer B's check sitting in the deposit for Customer A's account. Nobody running a scheme can alter the bank's copy of the deposit slip, so that comparison is the control that cannot be talked away.

You can run a simplified version of both tests yourself each month. Export your cash receipts journal, pull the bank's deposit images, and confirm that every deposit's date, amount, and payer detail matches what your books say. An hour of disciplined comparison beats a year of trusting the totals. If your records live in a plain-text ledger, the habit is even easier to keep — every entry is searchable, diffable, and version-controlled, so a receipt that was altered after the fact leaves a visible trail. The Beancount documentation walks through ledger workflows that make this kind of month-end verification routine rather than heroic.

Controls That Make Both Schemes Nearly Impossible​

Prevention beats detection on cost every time. None of these controls requires hiring anyone:

Split the cash cycle, even with two people​

The golden rule: the person who handles incoming cash must not be the person who records it, and neither should reconcile the bank account. In a tiny office, split duties this way instead:

• The owner (or a second employee) opens the mail and logs every check received before handing payments to the bookkeeper for posting.
• Bank statements go to the owner unopened — or the owner reviews them online before the bookkeeper reconciles.
• Customer statements and past-due notices are prepared or at least reviewed by someone other than the person posting payments.

Even partial segregation forces a would-be thief to collude rather than act alone, which stops the great majority of schemes before they start.

Require vacations — and rotate the work during them​

Mandatory consecutive time off (five business days is the standard recommendation) with someone else performing the absent employee's duties is one of the highest-return controls in existence. Most lapping schemes surface within days of the perpetrator's absence, because the substitute posts receipts honestly and the concealed shortages pop into view immediately.

Use pre-numbered receipts and daily deposit tie-outs​

Issue a pre-numbered receipt for every payment received, and have someone independent verify that the receipt sequence has no gaps and that each day's receipts match that day's deposit exactly. Skimming depends on transactions that leave no trace; a gapless receipt sequence means every missing receipt is itself evidence.

Push customers toward traceable payments​

Every payment that arrives by card, ACH, wire, or lockbox creates a third-party record your books must agree with. Offer electronic payment options prominently, consider a bank lockbox so customer checks never pass through your office at all, and treat a customer base that insists on paying in cash as a risk to manage rather than a convenience to preserve.

Count cash by surprise, and review the exception reports​

Unannounced cash counts keep register drawers honest. A monthly owner review of voids, refunds, discounts, credit memos, and written-off balances — asking "show me the supporting document for each of these" — closes the refund-skimming path. Neither task takes long, and both are dramatically more effective when employees know they happen but not when.

Add a backstop: fidelity coverage and a reporting channel​

A fidelity bond or employee-dishonesty insurance policy will not prevent theft, but it converts a discovered loss from a business-ending event into a recoverable claim. And set up even an informal reporting channel — an email address or suggestion box monitored only by the owner — so employees and customers who notice something have somewhere to say it. Tips remain the most common way fraud gets caught.

What to Do If You Suspect It Is Happening​

If the red flags are pointing at someone, resist the urge to confront them immediately. A hasty accusation tips off the suspect, risks a wrongful-termination or defamation claim if you are wrong, and can destroy evidence if you are right. Instead:

1. Quietly secure the records. Preserve bank statements, deposit slips, receipt books, the accounting file, and any relevant emails before anything can be altered or deleted. Work from copies.
2. Run the tests yourself first. The receipt-to-deposit comparison and a proof of cash over several months will usually confirm or clear your suspicion quickly.
3. Bring in outside help. A CPA experienced in fraud examination — ideally a Certified Fraud Examiner — can quantify the loss in a way that holds up with insurers and law enforcement. Involve legal counsel before interviewing the suspect or involving police.
4. File the claim and fix the control. Notify your fidelity insurer promptly, then close the gap that allowed the scheme — usually by splitting the duties described above — so the next hire inherits a system that does not rely on trust alone.

Keep Your Cash Accounted For From Day One​

Skimming and lapping both exploit the same weakness: cash movements that nobody independently verifies. The fix is not suspicion of your team — it is a routine where every receipt is recorded, every deposit is tied out, and the person recording is never the only person checking. Start those habits now, while amounts are small and the books are simple, and they scale with you instead of breaking under growth.

Clear, complete financial records are the foundation every one of these controls rests on. Beancount.io provides plain-text accounting that gives you complete transparency and control over your financial data — no black boxes, no vendor lock-in. Get started for free and see why developers and finance professionals are switching to plain-text accounting.