It really depends on overall situation. For example:
* He works for different company that I don't know at all thus don't care about - I would just drop the contact with him, or keep it to minimum. No confrontation, no moralizing, no explanation because I have nothing to gain and nothing to lose. You are simply not a White Knight, Savior, Moralist... you are not trying to save or correct the whole world, you are not a preacher who teaches others to behave...
* We work for the same company, but I don't really care much about the company overall: I would try to make a 'hinting' distinction between myself and him, then walk away. For example: Raise my eyebrows and say something simple like "Dude, you shouldn't really do it, that's not legal", then sort of start blocking any further attempts for friendship. I would still have to see that person because we work together, and I would maintain sort of professional friendship, yet at the same time I would distance myself from that guy on personal level. In this scenario I may not gain much by saying something to the supervisors, but I may lose a lot by being his friend. I am not a White Knight, but at the same time I am protecting myself, my job, my name...
* We work for the same company, and I really care a lot about the company (I want to stay there long time and perhaps I am climbing the ladder and want to become supervisor myself): I would do/say the same as above and I would probably let him know that I am seeking higher position within the company. This way he should get the message "beware". Plus I would be seeking friendship among the supervisors. I would also try some 'hinting' to the supervisors without directly pointing to that guy: Hey guys, how do you do ABC? How do you manage XYZ? And what if somebody is using company credit cards for personal purposes, how would you deal with it? The 'hint' should be strong enough so the supervisor should start thinking something like: "Ah, good point, I better check the credit card expenses again, just to make sure that nobody is abusing it". Then he/she would ideally find out on his/her own that somebody is abusing the cards... If they don't find out it's probably that they don't care enough... Think about it, if it was your company and your money, and you were giving credit cards to your employees - wouldn't you check the spending here and there? I would. I am also not a Savior, but I do give lots of shit about my job, my true friends, or great professional associates...
-----
So I went from "I don't care at all" approach to being more involved, perhaps more assertive, based on the situation I am in. Generally speaking, I am usually avoiding direct confrontations as I rather try to practice Peace and Abundance Mentality: "Hey, you are a cool dude (or cute girl) but there is just something that doesn't vibe. So, have a Nice Life...". At the same time, if it was my company or company of my close friend that I care about, I would become more confrontational: "Dude, you can't do that. How much did you spent? When? Why didn't you use your money?" Then let him explain. I would definitely tell my FRIEND or my good professional associate...
The reason is, I believe that you always want to keep your "good friends" or "good professional associates" close, you always want to show that you care and that you are concerned. Ideally do the same for the company you work for (even if shitty company), even though you are not really doing it for them - you are doing it for you, you are building true VALUES such as Honesty for your Name...
Build true Values first, and the Right friends will eventually show up - without you seeking them...