Lapping in accounting is an embezzlement scheme where an employee steals an incoming customer payment and hides the shortage by applying a later customer’s payment to the first customer’s account, then a third customer’s payment to the second, and so on. It works only when one person controls both the cash coming in and the accounts receivable ledger, so every effective defense targets that overlap: watching for timing gaps and adjustments the scheme leaves behind, running confirmations that go around the employee, and separating the duties that made the theft possible in the first place.
How the Scheme Works
The cycle starts when an employee pockets a payment meant for Customer A’s invoice. That leaves an immediate hole. The company received money, but Customer A’s balance still looks unpaid, and an overdue notice would expose the theft quickly.
So when Customer B’s payment arrives the next day, the employee credits it to Customer A’s account instead. Customer A is now clean, but Customer B carries the shortage. Customer C’s payment covers Customer B, Customer D’s covers Customer C, and the chain continues. Each stolen dollar requires a fresh payment from another customer to plug the previous gap.
As theft accumulates, the web of misapplied payments grows. The perpetrator has to maintain a shadow record of which accounts carry fake balances and which incoming payments are being rerouted where. That is where lapping becomes fragile. The scheme demands constant hands-on management, and one missed day, one unexpected audit, or one customer calling to ask why their payment wasn’t posted can unravel it.
Red Flags in the Records
The clearest sign is a consistent gap between the date a payment arrives and the date it hits the bank. In a healthy process, receipts reach the deposit within a day or two. When someone is lapping, payments sit in limbo while the employee figures out how to reroute them. A pattern of three-, four-, or five-day delays across multiple accounts is worth investigating.
Frequent unexplained adjustments are another signal. Write-offs, small credits, and balance reductions that don’t correspond to any customer dispute or return often show up when the fraudster can’t immediately find a new payment to plug the gap. The adjustment zeroes out a balance temporarily without any real money moving.
Customer complaints deserve special attention. If a client contacts your company insisting they already paid an invoice that still shows as outstanding, that is direct evidence something went wrong between receipt and posting. One complaint is a clerical error. Several across different accounts suggest someone is intercepting payments before they’re recorded.
Accounts receivable aging reports can also expose the pattern. Lapping tends to push receivable balances into older buckets. If your 60-day and 90-day categories are growing without a matching change in your customer base or credit terms, someone may be cycling payments through accounts rather than applying them properly.
Red Flags in the Employee
Employees running lapping schemes guard their territory. They resist cross-training, decline help from coworkers, and insist on personally handling every step from opening mail to posting entries. Someone managing a floating shortage of misapplied payments cannot afford to let an outsider see the ledger.
Refusal to take time off is the single most reliable behavioral indicator. Federal Reserve supervisory guidance is direct on this point: most embezzlement schemes require the wrongdoer’s continuous presence, and requiring employees in sensitive positions to be absent for a minimum of two consecutive weeks lets pending transactions clear under someone else’s oversight.1Board of Governors of the Federal Reserve System. SR 96-37 (SUP) Supervisory Guidance on Required Absences from Sensitive Positions An employee who always has an excuse to skip vacation is waving a red flag.
How to Confirm Lapping
Suspicion is not proof. Confirming lapping requires procedures that test whether payments were applied to the right accounts at the right time, and that put the answer outside the suspected employee’s control.
Positive Confirmation Letters
The auditor sends letters directly to a sample of customers asking them to verify their outstanding balance. Customers respond to the auditor, not the company, so the employee has no chance to intercept the reply or explain away a discrepancy. When a customer’s reported balance differs from the ledger, the auditor traces the mismatch through individual transactions to see which payments were misapplied.2Public Company Accounting Oversight Board. Comparison AS 2310 with ISA 505 and AU-C Section 505 Under auditing standards, external confirmation is essentially required for accounts receivable unless the balance is immaterial or the auditor’s risk assessment is low enough to justify other procedures.
Receipt-to-Posting Gap Analysis
Pull the timestamp when a payment was received (mail log, lockbox record, or electronic deposit) and compare it against the timestamp when the payment was posted to a customer’s account. Legitimate payments post within hours or a day. Lapped payments show multi-day gaps because the employee held them while shuffling balances. A spike in the average gap for one employee’s transactions, compared with others handling the same work, narrows the investigation fast.
Benford’s Law on Manual Entries
Benford’s Law predicts that the leading digits of naturally occurring financial data follow a specific distribution, with the digit 1 appearing first about 30% of the time and higher digits appearing progressively less often. Manual journal entries used for adjustments and corrections are well suited to this test. Deviations from the expected pattern, especially unusual clustering just below an auditor’s testing threshold, can flag fictitious entries used to disguise lapping.
Daily Deposit Reconciliation
The simplest confirmation is also one of the most effective. Have someone other than the cash handler compare the total on the daily bank deposit slip against the total in the daily cash receipts log before anything is posted. When the two numbers don’t match, money moved between receipt and deposit. Doing this daily rather than monthly catches lapping before the employee has time to cover the gap with a new payment.
Controls That Stop Lapping Before It Starts
Detection is important, but prevention is cheaper. Every effective control below targets the single point of failure that lapping depends on: one person controlling both incoming cash and the receivable ledger.
Segregation of Duties
The person who opens the mail and logs incoming checks should never be the same person who posts payments to customer accounts.3UCLA Business and Finance Solutions. Segregation of Duties (Preventive and Detective) A third person should handle the monthly bank reconciliation. This three-way split means no individual sees the full transaction lifecycle from receipt to recording to reconciliation. Small businesses that cannot staff three separate roles should at least have an owner or manager review the daily deposit against the receipts log independently.
Lockbox Banking
A lockbox arrangement removes employee contact with payments almost entirely. Customers mail checks to a secure post office box managed by the bank, and the bank collects, processes, and deposits the payments directly. The company receives deposit data and remittance images electronically. Because no employee touches the payments, there is nothing to intercept and no window in which to reroute funds.
Mandatory Consecutive Vacations
Require employees in cash-handling and receivable-posting roles to take at least two consecutive weeks off each year, with a substitute processing the work during the absence. If a lapping scheme is running, the substitute will encounter misapplied payments, unexplained adjustments, or customer complaints that the original employee had been managing in real time. The Federal Reserve enforces this minimum absence for banking employees in sensitive positions because the scheme collapses without the perpetrator’s daily intervention.1Board of Governors of the Federal Reserve System. SR 96-37 (SUP) Supervisory Guidance on Required Absences from Sensitive Positions
Customer Statements Sent Independently
Monthly account statements mailed to customers by someone outside the accounts receivable department create an external check on the ledger. When a payment has been diverted to cover another account, the affected customer sees an inflated balance on the statement and contacts the company. The employee cannot suppress a complaint that lands on someone else’s desk.
Digital Audit Trails
Modern accounting systems can log every entry with a timestamp, the user who made the change, and the original versus modified values. Turning these logs on and restricting who can override or delete entries makes lapping far harder to run. The employee can still misapply a payment, but the trail shows exactly when and by whom. Automated alerts for unusual patterns, such as the same user posting an abnormally high number of manual adjustments, add a real-time layer that passive reviews miss.
Pre-Employment Screening
Before placing someone in a position with access to cash receipts and financial records, a background check can surface prior fraud convictions or financial distress that raises theft risk. Federal law requires employers to provide a clear written disclosure and obtain the applicant’s written consent before pulling a consumer report for employment purposes.4Office of the Law Revision Counsel. United States Code Title 15 – Section 1681b Background checks do not prevent fraud on their own, but they are a low-cost filter that occasionally catches what interviews miss.
What to Do When You Find It
The instinct on discovering employee theft is to confront the person immediately. That is usually a mistake. The first priority is preserving evidence before the employee realizes the scheme has been identified.
Lock down access to the accounts receivable system, email accounts, and any physical files the employee controls. If your accounting software has audit logs, export them before anyone can alter the records. Copy relevant bank statements, deposit slips, customer correspondence, and adjustment reports. The investigation needs to document what was changed, when, and by whom.
If the suspected loss is substantial, bring in an attorney before taking any other steps. Investigations conducted at the direction of legal counsel can be protected by privilege, which matters if the case ends up in court. A forensic accountant can reconstruct the flow of misapplied payments, quantify the total loss, and produce documentation that holds up in both civil and criminal proceedings.
Filing a police report creates an official record of the theft and is often a prerequisite for insurance recovery. Many fidelity and commercial crime policies require prompt notification after discovery of a loss, and failing to report can jeopardize your claim. Keep the insurer informed of material developments throughout the investigation.
Criminal Exposure
Lapping that involves mailing fraudulent invoices or account statements can be prosecuted as mail fraud, which carries a maximum of 20 years in federal prison.5Office of the Law Revision Counsel. United States Code Title 18 – Section 1341 Frauds and Swindles When the scheme uses electronic transfers, email, or any wire communication, it can be charged as wire fraud, with the same 20-year maximum.6Office of the Law Revision Counsel. United States Code Title 18 – Section 1343 Fraud by Wire Radio or Television When the fraud affects a financial institution, the maximum rises to 30 years and a fine of up to $1,000,000 under either statute. State embezzlement and theft charges often run in parallel.
Deducting the Loss
Businesses that lose money to a lapping scheme can generally deduct the unrecovered theft loss under federal tax law. The deduction is allowed for any loss sustained during the taxable year that is not compensated by insurance or other reimbursement, and a theft loss is treated as sustained in the year the taxpayer discovers it, not the year the theft occurred.7GovInfo. United States Code Title 26 – Section 165
To claim the deduction, keep documentation that the property was stolen, when the loss was discovered, and whether any reasonable prospect of recovery exists through insurance, civil action, or restitution. If inventory was affected, the loss can be taken either through an adjustment to cost of goods sold or as a separate theft loss deduction, but not both. Losses on business or income-producing property have remained deductible without the disaster-related restrictions that apply to personal theft losses through 2025.8Internal Revenue Service. Publication 547 (2025) Casualties Disasters and Thefts