How to prevent staff theft: spot missing money and rooms at a small hotel or villa

What the numbers say about staff theft

The Association of Certified Fraud Examiners, or ACFE, studies fraud by employees every two years. Its 2026 Report to the Nations (opens in new tab) is based on real cases. These are global figures across all kinds of businesses, not hotel numbers:

• Most fraud is simple theft. Stealing cash, goods or services showed up in 90% of cases.
• Small businesses lose more per case. Firms with fewer than 100 employees had a median loss of USD 126,000.
• Speed matters. According to the ACFE key findings (opens in new tab), fraud caught within 6 months had a median loss of USD 40,000. Schemes that ran for more than 5 years passed USD 1.1 million.

The same report links better results to simple owner habits: reviewing the numbers, watching the data and surprise checks.

How do you protect guests' belongings?

Good owners protect guests' things as well as their own money. This is normal good practice for hotels and villas anywhere in the world. A new cleaner, a helper on a busy day or a contractor can all enter a room. Clear routines keep valuables safe. They also protect honest staff, because everyone knows the rules.

The two most important steps are simple. Put a safe in every room or villa, one that guests set with their own code. Then tell every guest to keep passports, cash and laptops in it.

A safe-and-key routine you can copy

1. Before arrival. Check that the in-room safe opens and locks, and that the batteries are fresh. Leave it open for the guest.
2. At check-in. Show the guest the safe. Say: "There is a safe in your wardrobe for passports, cash and laptops. You set your own code." Put the same line in your welcome message and guidebook.
3. Start of each shift. Hand room keys or door codes to named staff only. Write down who has which key in a key log.
4. Cleaning. Clean when the guest is out, after a "please clean" sign or a quick message. Pair a new cleaner with a senior staff member for the first weeks.
5. End of each shift. Collect every key and tick it back in the key log.
6. When someone leaves. Change door codes the same day.
7. Anything found. Write it in a lost-and-found logbook with the date, the room and who found it.

Before you hire, ask for an ID card, call a past employer and ask for a police record letter (SKCK) where that is normal.

Eight ways money leaks at a small hotel or villa

Theft at a small property usually looks like small gaps that repeat. Here are the eight most common ones.

1. Cash walk-ins that never get entered. A guest walks in at 22:00, pays cash for one night, and leaves early. If no booking is created, the money never existed on paper.
2. Guests paying a staff member directly. A guest is told to send a bank transfer or a QRIS payment to a personal account "because the machine is broken". Our guide on how tourists pay hotels in Indonesia (opens in new tab) explains which payment routes belong to the business.
3. Out-of-service rooms that get sold. A room is marked out of service for "repairs", which takes it off sale, and then it is sold quietly for cash. Read our post on controlling out-of-service rooms (opens in new tab) for a tight process.
4. Fake discounts. The guest pays the full rate. The booking shows a lower rate, and someone keeps the difference.
5. Late check-out and extension fees that go missing. A guest stays an extra night or leaves at 16:00 and pays at the desk, but the booking is never changed. Our guide to who can approve a stay extension (opens in new tab) covers the rules.
6. OTA payout gaps. An OTA booking is marked as a no-show or cancelled, but the guest actually stayed and paid at the desk. Or someone with extranet access changes the bank details for payouts. Our post on OTA costs in Indonesia (opens in new tab) explains how OTA money flows.
7. Linen, amenities and minibar stock. Towels, toiletries, drinks and snacks leave in small amounts that nobody counts.
8. Commissions that go to the wrong pocket. Drivers, tour sellers and spas often pay a fee for each guest sent their way. If your rule says that fee belongs to the business, it is a leak when it goes to one staff member.

Split the money jobs between people

The single best control is splitting duties. That means the person who takes the money is not the only person who records it, and not the person who checks it. In plain words, no one person holds every key.

You do not need a big team for this. Even with three people, you can split jobs. Here is one way a 6-person villa team in Seminyak might do it:

If you are the only manager, you become the checker. A front desk shift handover also helps, because the next person counts what the last person left. Our front desk handover guide (opens in new tab) shows what to hand over at the end of each shift.

Write the rules down in one short page. For example: "Only the manager approves discounts over 10%." When the rule is written, a broken rule is easy to spot and easy to talk about.

The daily match: a ready-to-copy template

This is the one habit that finds missing money and missing rooms. Once a day, you put two lists side by side and match them by hand: yesterday's bookings list in Kiyo, and the money you actually received, from your bank app, your transfer records and the cash you counted. It takes about ten minutes for a small property.

Copy this table into a sheet. Here it is filled in for a made-up three-bedroom villa in Canggu, Bali, for one day. The numbers are illustrative only.

How to read it:

1. Every "Yes" is closed. Money and booking agree.
2. Every "No" gets one question today. Ask kindly and write down the answer. Most gaps are honest mistakes, like a transfer under a family member's name.
3. "Waiting" rows carry forward. Keep them on the sheet until the payout lands in your bank.
4. Used rooms with no booking matter most. In this example, Rp3,800,000 is unexplained and one room night has no booking at all. On a Rp1,300,000 nightly rate, that is about Rp5,100,000 to follow up from a single day.

See the bookings list you would match against in the demo

Give every person their own login

A shared login is one of the biggest risks at small hotels. If the whole desk uses one password, you can see that a booking was changed, but not who changed it. Honest staff lose protection too, because nobody can prove it was not them.

1. One login per person. Every staff member, including part-timers, gets their own account in your hotel system.
2. Only the screens they need. A cleaner does not need prices. A front desk agent does not need payout settings.
3. Two-factor login. Two-factor authentication, or 2FA, asks for a 6-digit code from an app like Google Authenticator (opens in new tab) on top of the password. A stolen password alone is then not enough.
4. Owner-only finance access. Keep bank details, payout settings and OTA finance pages with the owner, or one trusted person with 2FA.
5. Remove leavers on day one. When someone leaves, close their login the same day. Change any OTA extranet passwords they knew.

Do the same for each OTA extranet, such as Booking.com, Traveloka TERA or tiket.com TIX. Our guide to hotel staff system access (opens in new tab) walks through who should see what.

See per-person access and 2FA settings in the demo

A 20-minute weekly owner check

Look at a few key things every week, at a time your team does not expect. It takes about 20 minutes, even from your phone if you live abroad:

1. Rooms cleaned vs rooms booked. Ask housekeeping how many rooms were cleaned after a stay. Compare it with the number of bookings. More cleaned rooms than bookings is a red flag.
2. Cancellations and changes. Open five cancelled or changed bookings. Who changed the dates or price, and why?
3. Cash marked paid vs cash in the bank. Add up the bookings marked as paid in cash. Compare that with the cash that reached the bank.
4. OTA extranet settings. In each OTA extranet, check the bank details and the list of users have not changed.
5. Out-of-service rooms. Look at every room marked out of service. Is there a real repair note behind it?
6. Discounts and access. Check discounts against your written rule. Look at the list of logins and remove anyone who no longer works for you.

Once a month, do one check without warning. For example, count the linen store, or call two recent guests to confirm what they paid. Our posts on the weekly revenue review (opens in new tab) and following up arrival deposits (opens in new tab) add more detail on the money side.

How Kiyo helps with staff theft

Software does not stop theft. Your habits do, and the right system keeps the records.

• Every person gets their own login. Starter includes 3 team members, including the owner; Pro and Business have unlimited seats, so there is no reason to share a password.
• Preset roles with per-person tab access. You give each person a preset role, such as Front Desk or HK Supervisor, then switch single tabs on or off for them. Cleaners only see housekeeping. Housekeeping tools are on the Business plan; see the plan comparison (opens in new tab).
• 2FA for any user. Each user can switch on 2FA with an authenticator app.
• Billing and payout access is off by default. The owner grants it one person at a time, and that person must have 2FA first.
• History on every booking. Each booking shows who changed the dates, the total, the status, the payment method or a refund and its reason, and when.
• Walk-ins go on the same calendar. Reception adds a walk-in as a booking. Kiyo then closes that room on your other connected channels.
• Bahasa screens. Staff can work fully in Bahasa Indonesia.

When you sign up with Kiyo, our team also gives you advice on setting up safety routines like the safe-and-key steps above, while we set up your rooms and channels.

Your next step: book a demo and open one booking's history to see who changed what.

Plans start from Rp40k per room per month (opens in new tab). Free setup, pay from go-live, 14-day money-back guarantee.

See who changed each booking in the demo

Frequently asked questions

How do I prevent staff theft at a small hotel?

To prevent staff theft at a small hotel or villa, compare two lists every day: the bookings in your system and the money that actually reached your bank account or your hand. Use the daily match template above.

How do I know if my staff are stealing?

Look for patterns, not single events. More rooms cleaned than rooms booked, many cancelled bookings by the same person, or cash that does not match the bank are common signs. Use the 20-minute weekly check above to spot them.

What should I do if a guest says something is missing?

Stay calm and kind, and take it seriously. Write down what is missing, where the guest last saw it, and when. Ask the guest to check the safe, their bags and the room again with a staff member, because most items turn up. Then check your key log, the cleaning times and the lost-and-found logbook. If the item is still missing, help the guest report it to the local police for their insurance. Do not blame any staff member without facts.

How do I protect guests' valuables in my villa?

Put a safe in each villa or room, tell guests about it at check-in, and control who holds the keys. The safe-and-key routine above takes a few minutes a day.

Should every room have a safe?

Yes, it is good practice. A safe that guests set with their own code keeps passports, cash and laptops out of sight. It also protects your staff from doubt if something goes missing.

What should I do if I find theft?

Collect the booking records and payment proofs first. Do not accuse anyone in front of others. Get local legal advice before you take action.