Hiscox’s researchers studied publicly available data on nearly 400 U.S. federal court cases in which employee fraud was alleged that either became publicly known or were active in the federal system during 2016. The cases involved public and private corporations, limited liability companies, municipal and government agencies, nonprofit organizations and Native American tribal businesses.

Funds theft was the most common embezzlement scheme, showing up in more than one third of all cases. It was followed by check fraud (22.1 percent). Seventy percent of all check fraud occurred at companies with fewer than 100 employees.

Despite the alarming levels of embezzlement taking place, it isn’t top of mind for many small-business owners. When asked, “What is the most critical issue facing your business?” only 1 percent said the threat of crime or vandalism in the CNBC/SurveyMonkey Small Business Survey of 2,030 self-identified small-business owners ages 18 and up. Among these owners, 1,423 had 0–4 employees; 225 had 5–9 employees, 243 had 10–49 employees and 128 had 50 or more employees.

Interestingly, in Hiscox’s study, financial services firms had the highest total losses across industries. They collectively lost more than $120 million in 2016. One case went on for 41 years and involved $2.5 million stolen at a bank.

High-loss cases often took place in schemes where an employee repeatedly diverted small sums of money over time, making the theft extremely difficult to detect. In 28.7 percent of cases, the employee theft took place for more than five years.

“A lot of people think embezzlement is one big score and it’s over with,” said Karpp. But that’s not always the case. Some cases involved the theft of small amounts of money over many years, he said.

Those small amounts can really add up. The average loss for cases that continued for five years or more was $2.2 million, and for cases lasting 10 years or more the loss was $5.4 million.

So how can small-business owners protect themselves? One way is by instituting checks and balances, said Karpp. Never let one person have end-to-end control of funds, he said, adding, “If they are an authorized signatory on a check, don’t let them print a check out on the system.”

Hiscox also recommends that smaller businesses have bank statements for their business accounts sent directly to the owner’s home. “That way, the owner can take a look at them and make sure there isn’t anything suspicious,” he said. Otherwise, an employee might be able to cover up unusual transactions in the company’s books.

So who is embezzling? There is no definitive profile, but Hiscox found the median age of perpetrators was 48 for women and 49 for men. In cases of funds theft, 56 percent of the perpetrators were women.

Often, there are tip-offs in employees’ behavior, Hiscox found. Employees may, for instance, make extravagant purchases that would not be affordable for someone of their financial means. “I’ve seen a case where an employee showed up in a new luxury car every three to six months and made up a story about flipping cars,” said Karpp.

Nonetheless, it can be hard to identify embezzlers, because they often demonstrate behaviors that a good employee would show. For instance, Hiscox found that they tend to be curious about how the company works and want to be the go-to people to solve system problems. “They are diligent and ambitious,” said Karpp. “They come in early. They are working late. They never take a vacation.”

But their reasons for camping out at their desks aren’t to help the company — it is to cover up fraud. “A lot of cases get discovered when the employee is on vacation,” said Karpp. Employers who discover embezzlement may need to hire a certified fraud examiner or legal counsel to help them with the investigation, he said, adding, “If you end up terminating the employee, you should press charges and publicize it within your company. That will show employees you take fraud seriously and help repair any damage to company culture that exists when employees are found stealing.”

Many business owners never recoup their losses and are forced to simply move on. Max Agrad said he and his business partner at Voxel Worlds, a three-employee start-up in Washington, D.C., which makes a mobile virtual-reality solution for the real estate industry, were deceived by a former employee who was hiring overseas technology contractors for them through one particular company.

Agrad became suspicious when a search-engine optimization contractor reached out to ask why he had not been paid his $90 — far less than the $500 he understood that Voxel Worlds was paying the contractor. After deciding to look for several contractors himself and soliciting bids on his own instead of relying on the employee, Agrad concluded the company had been greatly overcharged. “The bids were about one third of what we were being told to pay,” he said.

Agrad claims the company his employee was using to find the talent ended up being a front operation the employee owned. Agrad estimates that his company lost $37,000 before firing the employee, but he and his partner, James Boisvert, decided to move on without pressing charges. They’re now occupied with bigger and better things, like serving a big account they just won and going after new business.

“We accepted this as a business lesson,” said Agrad.

— Elaine Pofeldt, special to CNBC.com