What to Do When an Employee Misuses a Company Card

Most misuse isn't what founders fear it is

When founders imagine company card misuse, the mental image is often deliberate fraud — someone systematically siphoning money from the business. In practice, across small UK teams, the far more common pattern is careless rather than dishonest: a personal coffee tapped on the wrong card out of habit, a free trial that quietly converted to a paid subscription nobody cancelled, or a purchase that felt work-adjacent at the time but wasn't, on reflection, a business cost.

This distinction matters because it changes the right first response. Treating an honest mistake as if it were theft — with suspicion, formality and an immediate disciplinary letter — damages trust across the whole team far more than the mistake itself, and tends to make people more secretive about future errors rather than more careful. Reserve the harder response for situations that genuinely warrant it.

Prevention: the controls that actually reduce misuse

Most modern business debit and prepaid expense cards let you set a per-transaction limit, a monthly limit, or restrict spending to specific merchant categories — travel, subscriptions, office supplies — directly from an app, often instantly and per card. Setting these limits based on what a role actually needs, rather than issuing every card with the same generous ceiling, closes off a large share of accidental overspending before it happens.

Card locking is another underused control: the ability to freeze a card instantly from an app if it's lost, if an employee is on leave and shouldn't be spending, or if you simply want to pause spending on a specific card while you check something. Building the habit of using these controls actively, rather than leaving every card open all the time by default, is a cheap and largely invisible layer of prevention.

• Set per-transaction and monthly limits matched to the role, not a flat figure for everyone.
• Restrict merchant categories where the card provider allows it.
• Freeze cards during leave or when an employee is between roles.
• Review and adjust limits when a role or responsibility changes.

Detection: catching problems early rather than at month end

A monthly reconciliation catches most problems eventually, but by then a subscription may have run for three months, or a pattern of small personal purchases may have quietly become a habit. A short, regular review — even fifteen minutes a week glancing through recent transactions on a shared dashboard — catches issues within days, when they're easier to address as a small correction rather than a larger, more awkward conversation.

Look specifically for round or repeated amounts that suggest a recurring subscription, transactions outside normal working hours or locations, and any purchase category that doesn't obviously match the person's role. None of these are proof of anything on their own, but they're worth a quick, low-key check-in — 'saw this one, can you remind me what it was for?' — which usually resolves the question in seconds.

Having the conversation when something looks wrong

When a transaction genuinely looks like personal spend or a clear policy breach, have the conversation privately and factually, starting from curiosity rather than accusation: describe the transaction, ask what it was, and listen to the answer before forming a conclusion. Most of the time this resolves the question immediately — it was a genuine mistake, a mix-up between cards, or something that was in fact business-related but not obviously so from the transaction line alone.

If the answer confirms it genuinely was personal spend, ask for repayment and agree a clear timeline, and use the moment to check whether the policy or the card controls need tightening rather than treating it purely as an individual failing. If the pattern repeats after this conversation, that's the point at which a more formal process — a written warning under your usual disciplinary procedure — becomes appropriate.

Start every card query from curiosity, not accusation — 'what was this one for?' resolves far more cases than 'why did you spend company money on this?'

When misuse is deliberate and serious

Occasionally, misuse is clearly deliberate — a pattern of concealed personal spend, false claims, or use of the card after it should have been removed. This is a genuinely different situation from an honest mistake and should be treated as such: gather the evidence calmly, follow your formal disciplinary process rather than confronting the employee informally first, and take specific employment law advice before dismissing anyone, since getting the process wrong can create an unfair dismissal risk even where the underlying conduct was genuinely serious.

If the amounts involved are significant, or you suspect the situation may constitute fraud, take advice from a solicitor experienced in employment matters before deciding your next step. This is one area where acting too quickly, without the right process, can create more legal exposure for the business than the original misuse did.

Removing access without drama

Once a genuine problem is confirmed, or an employee is leaving the business, remove card access immediately and treat it as a routine process step rather than a dramatic gesture — most modern business cards let you freeze or cancel a card instantly from an app, with no need to physically retrieve anything. Delaying this because it feels awkward is one of the more common, avoidable gaps in small-team financial controls.

Build 'remove card access' into your standard leaver checklist as a matter of course, alongside removing system logins and building access, so it happens every time by default rather than being remembered case by case under pressure.