The old adage that an ounce of prevention is worth a pound of cure is certainly true when it comes to fraud against your business. The expenses associated with effective fraud prevention protocols is quite minor compared to the cost of cleaning up the mess after a successful fraud scheme has been exposed. One measure that is often helpful in preventing fraud is to monitor your employees. But, there are limits to the type and scope of monitoring you can do without violating your employees’ privacy rights.

You might recall the 2006 scandal at Hewlett-Packard that erupted when it was revealed that chairwoman Patricia Dunn had directed the company’s general counsel to engage a team of independent security experts to investigate board members and journalists to identify the source of an information leak. Investigators employed a technique known as pretexting, where they essentially impersonated the subjects of the investigation to obtain their phone records. Eventually, many figures in the scandal, including Dunn, faced state and/or federal criminal charges, including conspiracy and wire fraud. So, breaking the law to spy on employees is definitely a bad idea.

But, how far can you go in monitoring employees without crossing the line? A recent article by Thomson Reuters discusses allowable actions under federal law, but cautions that individual “state laws may be more restrictive”:

• Electronic activities monitoring — Generally an employer cannot monitor its employees’ use of electronic devices (including Internet use) without their knowledge. However, “you can monitor if you have a legitimate business need to do so,” and you can monitor electronic communications when one party consents.
• Phone call monitoring — An employer may monitor “business-related phone conversations to and from the workplace.” But, personal phone calls are off-limits and you “must hang up as soon as it’s apparent the call isn’t work-related.”
• Physical searches — Such practices call for “extreme caution.” If it’s necessary to perform a body search, you must not “threaten or apply physical force or prevent the employee from leaving the room or workplace.” Results of such a search must be kept confidential, or you expose your company to liability for slander or libel.
• Surveillance — It’s permissible to install cameras in the company’s offices and production areas, but stay out of restrooms and locker rooms, where there is an expectation of privacy. Keep surveillance records confidential by limiting access to “individuals who must know the information to properly perform their duties.”

Employers have a legitimate interest in maximizing productivity and minimizing losses due to employee misconduct, including, but not limited to, deliberate fraud. Reasonable monitoring of employee conduct is therefore within your rights. But, to be on the safe side, you should develop your policies with the assistance of a knowledgeable employment law attorney.