Discovering that the chief accountant has embezzled VND 5 billion is a moment when every decision in the next 48 hours carries a price: confront hastily and evidence is deleted and assets dissipated; hesitate and the money keeps flowing. The chief accountant is a uniquely dangerous position in this case type because they hold the very system storing the conduct’s evidence — books, vouchers, software permissions. This article builds the asset-recovery process on three simultaneous tracks: locking evidence and access at once so the file keeps its procedural value; opening the criminal track to use the state’s seizure and freezing tools; and opening the civil and insurance tracks so recovery does not depend solely on the criminal case’s outcome. The order and tempo of these three tracks largely decide how much money finally returns.
Collecting Evidence: Lock the System First, Confront Later
The first job is not summoning the chief accountant for a confrontation, but silently locking the entire evidence surface: back up the accounting software data and server as-is, extract access logs and voucher edit-delete history; revoke the suspect’s system administration rights, digital signature, bank tokens and approval authority; and seal paper vouchers by catalogue with minutes. The reason is the evidence’s procedural value: data extracted after the suspect knows they are discovered, with gaps from deletions, will be contested for integrity in both the criminal case and civil disputes. In parallel, the enterprise brings in an independent audit or investigation unit to rebuild the embezzlement money map: fake expenses, ghost suppliers, circular transfers, beneficiary accounts — this money map is the central document for both the denunciation and the seizure request. Confrontation and working sessions with the suspect happen only after evidence is locked, with HR and counsel present, minuted, and absolutely without detaining the person, holding personal papers or forcing commitments outside the legal frame — err at this step, and the enterprise turns itself into a violator in the very case where it is the victim.
Seizure and Freezing: Two Toolkits on Two Procedural Tracks
The criminal track offers the strongest toolkit: once the case is initiated, investigators apply asset seizure under Article 128 of the Criminal Procedure Code 101/2015/QH13 to secure the civil part’s enforcement and recover criminally derived assets, and account freezing under Article 129 of the same code for money in banks. The practical condition for these measures to move fast is that the denunciation must carry an asset map: which assets the enterprise knows or suspects stand in the suspect’s and relatives’ names, accounts at which banks, which dissipation transactions already occurred — investigators do not find on their own what the enterprise does not point out. The civil track runs independently for the part the enterprise needs to control proactively: suing for compensation and restitution while asking the court to apply interim measures under Article 114 of the Civil Procedure Code 92/2015/QH13, such as freezing accounts and banning transfer of disputed assets — measures requestable right at filing, before the criminal case concludes, and especially vital where investigators may not initiate in time while assets are moving. The two tracks do not exclude each other; the art lies in allocating information so the criminal file is not used as a reason to delay the urgent civil decisions.
Criminal Denunciation, Liability Insurance, and Where Recovered Money Lands
The denunciation should state the conduct by its concrete appropriation structure so investigators frame the charge correctly from the start: for a position-holder in a state-linked organisation, embezzlement of assets under Article 353 of the Penal Code; for a non-state enterprise, appropriation through abused approval and asset-management authority is usually considered under Article 355 on abusing position and authority to appropriate assets, or Article 175 on abusing trust where the structure is lawfully receiving assets then appropriating them. Attached are the independent investigation report, the money map and the asset list proposed for seizure. On insurance: professional liability or employee-fidelity policies may pay the loss caused by an employee’s fraudulent conduct, but clauses usually require early notice, investigation cooperation and a finding of fraudulent conduct — the enterprise must notify upon discovery, not await the investigation’s conclusion. Recovery lands from three cumulative sources: seized and frozen assets handled for restitution to the victim within the criminal case; the shortfall continuing to enforcement under the civil judgment within the criminal case or a separate civil suit; and the insurer’s payment under the policy. Expectation management must be realistic: the rate of recovering the full VND 5 billion depends almost entirely on the speed of asset locking in the first week, before money becomes hard-to-trace assets or is spent.
Scope Compared with Related Topics
This article develops only the distinct angle of “Chief Accountant Embezzles VND 5 Billion: Asset Recovery”. Matters already covered in EXP-6124 “Lộ trình thu hồi sản phẩm lỗi trên toàn quốc:…” are cross-referenced for comparison and are not repeated here; the FAQ below likewise answers only this topic’s own question set.
Frequently Asked Questions
How do I collect evidence?
In lock-first order: back up accounting data and system logs as-is, extract voucher edit-delete history, immediately revoke the suspect’s administration rights, digital signature and bank tokens, seal paper vouchers with minutes; only then bring in independent audit or investigation to rebuild the money flow and hold a confrontation with counsel and HR present. Evidence taken after the suspect learns of the discovery and has deleted data will be contested for integrity on both procedural tracks.
Can assets be seized?
Yes, through two toolkits: in the criminal case, investigators seize assets under Article 128 and freeze accounts under Article 129 of the Criminal Procedure Code 101/2015/QH13 — for speed, the denunciation must carry the asset and account map the enterprise can point out; on the civil track, the enterprise sues and asks the court for interim measures under Article 114 of the Civil Procedure Code 92/2015/QH13 such as account freezing and transfer bans, requestable at filing without awaiting the criminal conclusion.
Can a criminal complaint be filed?
Yes, and file early with a complete file: the independent investigation report, the embezzlement money map and the asset list proposed for seizure. The charge is framed by the case structure: embezzlement of assets under Article 353 of the Penal Code for a position-holder in a state organisation; for a non-state enterprise, usually Article 355 on abusing position and authority to appropriate assets, or Article 175 on abuse of trust. Denunciation is not only about punishing the violator — it is the practical condition unlocking the state’s seizure and freezing tools.
Does liability insurance apply?
Possibly, if the enterprise holds professional liability or employee-fidelity insurance covering employee fraud. Clauses usually require early notice upon discovery, investigation cooperation and a finding of fraudulent conduct — the enterprise should notify the insurer in parallel with the denunciation, not await the case’s end. The part insurance does not pay continues to be recovered through seized assets in the criminal case and civil judgment enforcement.
This article has been quality-reviewed by the FLAW AI Legal Council
