How to become a whistleblower?
Good things rarely come to whistleblowers. Most of the time, absolutely nothing happens [to the accused] and occasionally really bad things happen to the whistleblower in the forms of retribution, blacklisting, defamation/slander lawsuits, etc.  Laws protecting whistleblowers tend to be ineffectual at best.

You need to evaluate the benefit/risk ratio yourself. 

That being said, if you were to whisteblow, there are several levels you can do it at:


University office of research integrity/ethics. For example:  http://research.ubc.ca/ethics/british-columbia

** While this involves a private company, the PI may  also have an affiliation with a university 
National office of research integrity. For example in the USA: http://ori.hhs.gov/

**  In Canada: http://www.acaho.org/?document&amp;id=164
Funding agency whistleblower hotline

** Canada: http://www.rcr.ethics.gc.ca/eng/policy-politique/framework-cadre/


Good luck. 




[That all being said: the situation you describe is likely to yield at most a   reprimand from the funding agency if the girlfriend  was actually  working while receiving a salary (and thus it wasn't embezzlement only nepotism). I'm assuming the company already knows -- private companies tend to be more lax about these things compared to public (and even private) universities which receive a majority of the funding from the state.]