Dental embezzlement warning signs owners miss

Collections were fine last quarter, production was up, and yet the bank balance at month end feels thinner than it should. Nothing is obviously wrong. That is usually how this starts.

This page is about patterns in the data, not people. Every sign below has an innocent explanation most of the time. The point is to know which reports to open and what a normal week looks like in them, so that an abnormal week stands out.

What does embezzlement look like in the numbers?

Across all industries, the ACFE Report to the Nations (2024) found a median loss of $145,000 per case and a median of 12 months between the start of a scheme and its discovery. Most cases were detected by a tip, not by a report. That is the gap this page tries to close: the practice owner who looks at the right screen once a week does not need to wait for a tip.

In a dental office the money moves through four places: the day sheet, the adjustment ledger, the deposit, and the insurance payments. Each one leaves a trace in the practice software.

Which signs show up in payments?

• A payment posted, then deleted the same day. In Open Dental the deletion lands in securitylog with the user and the time. In Eaglesoft the original row in transactions_header stays, with status changed from A to D and a mirror row marked V. In Dentrix admin.payment_view has no user column, so a deleted payment is only visible by comparing today’s rows with yesterday’s.
• Cash payments that fall as a share of total payments while patient volume stays flat. Pull payments by type for the last twelve months and look at the cash line on its own.
• Payments posted after hours or on days the office is closed. The time stamp is the tell, not the amount.
• Patient accounts that show a balance, then a courtesy adjustment, then a cash payment that never appears on the deposit slip.

Which signs show up in adjustments?

Adjustments are the easiest place to hide a missing payment, because a write-off makes a balance disappear without any cash moving.

• Adjustments entered by one user far more often than by anyone else with the same job.
• Adjustment types that do not match the account: a PPO write-off on a fee-for-service patient, or a “courtesy” on a patient who paid in full.
• Adjustments posted on the same day as a payment on the same account, by the same user.
• A rise in total adjustments as a share of production, month over month, with no change in payer mix.

The write-off report page shows how to split contractual adjustments from courtesy ones and run them by user.

Which signs show up in the audit trail?

Open Dental writes a row to securitylog for most permission-gated actions, with UserNum, LogDateTime, PatNum and the workstation name in CompName. Dentrix has no general audit table over SQL; its Audit Trail Reports in Office Manager are the only view. Eaglesoft keeps an audit in Utilities, and transactions_header.user_id points at a provider, not at the person who typed the entry.

Things worth noticing in whichever log you have:

• Log-ins under one user name from two workstations at the same time.
• A single user who edits completed procedures weeks after the visit.
• Gaps: a week where the log shows almost nothing from a workstation that is normally busy.
• Any edit to a security setting or user permission that the owner did not ask for.

Which signs are about behaviour, not data?

These are weak on their own and they are not evidence of anything. They become worth a look only when a data sign above is also present.

• Someone who never takes a full week off and insists on doing the deposit personally.
• A refusal to let anyone else run end of day.
• Bank statements that always arrive opened.

Treat these as reasons to look at the reports, nothing more.

What should an owner do with a sign?

1. Do not confront anyone. Most signs have ordinary causes: a training gap, a payment posted to the wrong account, a plan that was set up incorrectly.
2. Pull the underlying rows yourself. The day sheet, the adjustment list by user, the deposit slip and the bank statement for the same dates.
3. If the rows do not reconcile, call your accountant and, if the gap is material, a forensic accountant who works with dental offices. Preserve the audit log before anything else; do not change user permissions yet.
4. Keep notes with dates. Memory of “it felt off in March” is not useful six months later.

What Calibic adds

Protect is LIVE. It keeps a private, read-only copy of payment and adjustment changes from Open Dental, Dentrix and Eaglesoft, with the before and after values and the time stamp, and it raises a small number of alerts rather than a flood. In our own audit of about 1.4 million change events across three practices (anonymised example, internal audit, October 2026) the old rule set raised 5,959 alerts; the calibrated set raised 15. Calibic never writes to the practice software and it does not name a culprit. It shows what changed, who the software says did it where that is recorded, and when.

Where the software does not record the actor, Calibic says so. Dentrix payments, for example, are observable but not attributable.

See how the prevention controls fit around this, then look at the Protect product page.