CFE-Financial-Transactions-and-Fraud-Schemes Sample Questions Answers

Detailed Explanation:

Rationale for Correct Answer: EFT fraud involves the unauthorized transfer of money from victims’ accounts using stolen access credentials. A hacker using stolen log-in details to redirect funds is the textbook example.

Analysis of Incorrect Options:

A – Describes identity theft/credit card fraud, not EFT fraud.

C – Describes skimming of card data, not EFT.

D – Describes payroll fraud, not EFT.

Key Concept: EFT fraud = unauthorized access to electronic banking/payment systems.

Detailed Explanation:

Rationale for Correct Answer:This scheme is known as a Turnaround Sale or Flip. The employee secretly purchases an asset their employer needs and then resells it to the employer at a markup, thereby profiting at the employer’s expense.

Analysis of Incorrect Options:

A. Conflict of interest in sale – Too general; does not describe the flipping mechanism.

C. Unauthorized sale – Not an ACFE fraud category in this context.

D. Written sale of unique assets – Not a recognized scheme.

Key Concept: Conflict of Interest scheme — Turnaround Sales/Flips.

Detailed Explanation:

Rationale for Correct Answer: An advance-fee scheme occurs when fraudsters request upfront payments (fees, commissions, or deposits) for services or opportunities that never materialize. The broker taking the fee without providing services is a classic case.

Analysis of Incorrect Options:

A. Bait and switch – Advertising one product/service but delivering another, not applicable here.

C. Split deposit scheme – Involves diversion of payroll or deposits, not loans.

D. Scavenger scheme – Charging for unnecessary services, often debt collection or foreclosure help, not applicable.

Key Concept: Advance-fee frauds as common financial scams.

Detailed Explanation:

Rationale for Correct Answer:ACFE’s occupational fraud surveys consistently show that males are more often the primary perpetrators than females, accounting for approximately 62% of cases compared to 37% for females. This is attributed to higher representation of males in positions of authority and access. Therefore, C. 62 versus 37 is correct.

Key Concept:Demographics of Fraud Perpetrators — gender-based survey findings.

Detailed Explanation:

Rationale for Correct Answer:One form of bid-rigging occurs when colluding vendors agree that one will submit a low bid and later withdraw it, allowing another conspirator to win the contract. This practice is sometimes referred to as “complementary bidding” or the withdrawal of low bids.

Analysis of Incorrect Options:

A. Bribery receipt – Refers to corrupt payments, not collusion.

B. Bid solicitation – The process of inviting bids, not collusion.

D. Contract acceptance – A legitimate procurement step, not fraud.

Key Concept:Bid-rigging through collusion — vendors withdrawing low bids to favor co-conspirators.

Detailed Explanation:

Rationale for Correct Answer:Competitive intelligence refers to the legal and ethical gathering of publicly available information about competitors. It is a legitimate business practice and differs from corporate espionage, which involves illegal or covert methods.

Analysis of Incorrect Options:

B. Government-sanctioned espionage – This describes intelligence operations, not business practice.

C. Identical to espionage – False; competitive intelligence is legal, espionage is illegal.

D. Illegal covert methods – That is espionage, not competitive intelligence.

Key Concept: Competitive intelligence vs. corporate espionage.

Detailed Explanation:

Rationale for Correct Answer: The accounting framework a company must follow depends on the jurisdiction in which it is publicly traded. For example, U.S.-listed companies must follow GAAP, while companies in the EU must use IFRS. Some countries allow or require IFRS, others mandate local GAAP.

Analysis of Incorrect Options:

B – Incorrect; some jurisdictions have their own national GAAP not tied to U.S. GAAP or IFRS.

C – Incorrect; international operations do not mandate IFRS—jurisdictional rules apply.

D – Incorrect; U.S. GAAP is rules-based, IFRS is principles-based (the reverse of what’s stated).

Key Concept: Financial reporting standards are jurisdiction-driven.

Comprehensive and Detailed Explanation

Why the correct answer is: False accounting entry

According to the ACFE Fraud Examiners Manual – Financial Transactions and Fraud Schemes, under Financial Institution Fraud → Types of Embezzlement Schemes, the Manual provides explicit descriptions of relevant banking fraud schemes, including false accounting entries.

The Manual lists False Accounting Entries as a form of embezzlement in which an employee manipulates general ledger accounts or other accounting records to conceal a theft or unauthorized activity:

“False Accounting Entries” are specifically categorized as a type of embezzlement scheme used by dishonest bank employees to hide misappropriated funds.

In this question, the accountant:

Adjusted the bank’s general ledger

With the intent to conceal the theft of customer funds

This aligns exactly with the ACFE definition of false accounting entries, which involve altering legitimate financial records to hide fraudulent actions.

Therefore, the best ACFE-defined description of the scheme is:

→ False accounting entry (Option B)

Why the other options are incorrect

A. Unauthorized withdrawal

The Manual separately defines Unauthorized Withdrawals as a type of embezzlement in which a bank employee directly removes funds from accounts without permission:

“Unauthorized Withdrawals” are listed as a distinct embezzlement scheme involving unapproved removal of customer funds.

However, in this scenario, the defining act is manipulating ledger records, not simply withdrawing funds. The nature of the concealment technique makes false accounting entry the correct classification.

C. Moving money from inactive accounts

The Manual defines:

“Moving Money from Customers’ Dormant or Inactive Accounts” as a scheme in which employees transfer funds from inactive accounts to themselves.

In this question, the stolen funds come from an active customer account, so this option does not apply.

D. Unauthorized disbursement of funds

The Manual includes:

“Unauthorized Disbursement of Funds to Outsiders” as another type of financial institution fraud.

This refers to payments made to external parties without authorization—not to ledger manipulation to hide theft.

Again, the defining characteristic in the scenario is the use of false ledger entries, which makes Option B the most accurate according to ACFE terminology.

Detailed Explanation:

Rationale for Correct Answer:The phases of the bidding process include:

Presolicitation (need recognition/specification stage),

Solicitation (inviting bids),

Submission (vendors submit bids).There is no standard phase called Postsolicitation.

Analysis of Incorrect Options:

A. Presolicitation – Valid phase.

C. Solicitation – Valid phase.

D. Submission – Valid phase.

B. Postsolicitation – Not recognized as a formal bidding stage.

Key Concept:Bidding process phases — presolicitation, solicitation, submission.

Detailed Explanation:

Rationale for Correct Answer: Departures from GAAP may be justified if compliance produces misleading results, if the transaction is immaterial, or if the costs exceed benefits. However, simply departing from GAAP because assets would be understated and liabilities overstated is not an acceptable reason; GAAP requires faithful representation even if results are unfavorable.

Analysis of Incorrect Options:

A – Cost-benefit considerations are valid grounds in practice.

C – Materiality is a recognized exception to strict GAAP application.

D – Preventing misleading statements is a valid justification.

Key Concept: GAAP exceptions are limited to cost-benefit, immateriality, and preventing misleading reporting.

Detailed Explanation:

Rationale for Correct Answer:According to the Fraud Examiners Manual (2020 International Edition), offenders can be categorized into types. Absconders are individuals who commit fraud and immediately flee with the proceeds (“take the money and run”). They differ from long-term violators who maintain their frauds for extended periods while concealing them. Thus, the correct answer is A. Absconders.

Analysis of Incorrect Options:

B. Long-term violators – These offenders commit frauds over a long period and often maintain their positions of trust while continuing the scheme.

C. Offender types – Too vague; not a specific classification.

D. None of the above – Incorrect, since “Absconders” directly matches.

Key Concept:Offender Typologies — distinguishing between absconders and long-term violators in occupational fraud.

Detailed Explanation:

Rationale for Correct Answer:Weak or poor collection and recording procedures create opportunities for employees to skim. Without strong controls over cash receipts and documentation, employees can divert funds without detection.

Analysis of Incorrect Options:

A. Revenue sources and recording procedures – Too general; it is weak procedures that matter.

C. Internal audits and recording procedures – Audits help detect fraud, not enable it.

D. Register manipulations and recording procedures – Describes concealment, not the root cause.

Key Concept:Control weaknesses enable skimming.

Rationale for Correct Answer:Traditional bribery laws historically applied only to government officials. When bribery occurs in the private sector (commercial setting), it is known as commercial bribery. Modern laws and internal company codes address this as well.

Key Concept:Commercial bribery vs. government bribery.

Detailed Explanation:

Rationale for Correct Answer: Properly shredded documents using a cross-cut shredder are very difficult to reconstruct, making them not a common medium for information leaks. By contrast, shareholder reports, executive speeches, and workstation displays often contain sensitive data that can be exploited by competitors or fraudsters.

Analysis of Incorrect Options:

A – Shareholder reports can reveal strategy and financial vulnerabilities.

C – Executive speeches sometimes unintentionally disclose sensitive plans.

D – Information left visible at workstations is a known security risk.

Key Concept: Protection of proprietary information against espionage and fraud.

Detailed Explanation:

Rationale for Correct Answer:Gross profit = Net sales – Cost of Goods Sold (COGS). This is the correct definition, as per standard accounting principles.

Analysis of Incorrect Options:

A. Gross revenue – Defined as total sales before deductions, not after.

B. Net profit – Net profit is after all expenses (operating, interest, taxes), not before.

D. Operating expenses – Appear after gross profit, not at the top.

Key Concept: Income statement structure and key definitions.

Detailed Explanation:

Rationale for Correct Answer:This definition matches corruption, a broad category of occupational fraud in which employees use their influence in business transactions to gain personal benefit, in violation of their duties. Corruption schemes include bribery, conflicts of interest, illegal gratuities, and extortion.

Analysis of Incorrect Options:

A. Conflict of interest – A subtype of corruption, but narrower in scope.

C. Bribery – Also a subtype, but the definition given covers the broader category.

D. Overbilling – A billing scheme under fraudulent disbursements, not corruption.

Key Concept:Corruption as defined in the Fraud Tree.

Detailed Explanation:

Rationale for Correct Answer:Fraudulent schemes involving returns and allowances can be detected by analyzing accounts for unusually high transactions in these categories. This is a common red flag for concealment of theft or manipulation of sales.

Analysis of Incorrect Options:

A. Allowances by vendors – Too narrow, not a standard analytic test.

B. Disposals of allowances than reorders – Not a recognized search method.

D. None of the above – Incorrect, since option C is valid.

Key Concept:Returns and allowances analysis for fraud detection.

Detailed Explanation:

Rationale for Correct Answer:Technical security controls include software- and hardware-based measures such as application security, firewalls, and encryption. Application security protects against vulnerabilities in the programs employees use.

Analysis of Incorrect Options:

B. Human audits – Administrative control, not technical.

C. Penetration testing – A detective measure/test, not a control itself.

D. Data security – A broad goal, not a specific technical control.

Key Concept: Technical security controls for preventing cyberfraud.

Detailed Explanation:

Rationale for Correct Answer:The matching principle under GAAP requires that revenues and the corresponding expenses incurred to generate those revenues be recorded in the same period. Failing to do so misstates income and violates accrual accounting.

Analysis of Incorrect Options:

B. Revenue and Income statement – The income statement is a report, not an item to be matched.

C. Income statement and Long-term contracts – Long-term contracts follow special rules (percentage of completion, completed contract), not the general matching principle.

D. Capitalized expenses and Liabilities – Not part of the matching principle.

Key Concept:Matching Principle — recording related revenues and expenses in the same period.

Detailed Explanation:

Rationale for Correct Answer:Conflict of interest cases are difficult to detect because the transactions often appear legitimate on their face. However, they can be prevented more effectively through proactive controls such as disclosure requirements, vendor vetting, and employee training. The Fraud Examiners Manual (2020) emphasizes that prevention mechanisms are more effective than detection when it comes to conflicts of interest.

Analysis of Incorrect Options:

B. False – Incorrect because detection is challenging; prevention is comparatively easier.

Key Concept: Prevention vs. detection in Conflict of Interest schemes.

Detailed Explanation:

Rationale for Correct Answer: Blank plastic cards are a common basis for counterfeit card production. Fraudsters encode stolen magnetic stripe or chip data onto blank cards.

Analysis of Incorrect Options:

A – False; holograms are designed to be difficult to reproduce.

B – False; high-speed printers and embossers make counterfeiting easier, not harder.

D – Incorrect, since A and B are false.

Key Concept: Counterfeit card fraud methods.

Detailed Explanation:

Rationale for Correct Answer:Common skimming schemes include unrecorded sales, theft of incoming checks, and understating sales/receivables. “Fraud & Cost” is not a recognized skimming scheme and appears to be a distractor.

Analysis of Incorrect Options:

A. Unrecorded sales – A classic skimming method.

C. Theft of checks through the mail – Another recognized skimming approach (incoming receivables).

D. Understated sales and receivables – A concealment method within skimming schemes.

B. Fraud & Cost – Not a scheme classification.

Key Concept:Skimming schemes vs. unrelated distractors.

Detailed Explanation:

Rationale for Correct Answer:Cash larceny involves stealing cash after it has been recorded. Mark stole $50 directly from the register after recording sales, which is a cash larceny scheme.

Analysis of Incorrect Options:

A. Paul’s scheme – This is skimming (off-book theft), not larceny.

B. Emily’s scheme – This is a lapping scheme (concealing theft of receivables), not pure larceny.

C. Sarah/Jenna – This is an overstated refund scheme (fraudulent disbursement), not larceny.

Key Concept: Cash larceny vs. skimming vs. fraudulent disbursements.

Detailed Explanation:

Rationale for Correct Answer:Management may overstate financial statements to (B) meet performance criteria, (C) trigger bonuses/compensation, or (D) show growth to enhance valuation for sale.However, when seeking to comply with debt covenants, management typically understates liabilities or expenses — not overstates performance. Thus, A is not aligned with overstatement motives.

Analysis of Incorrect Options:

B, C, D – All are recognized motives for overstating business performance.

A. Comply with debt covenants – More linked to manipulation of liabilities (often understatement), not overstatement of revenue.

Key Concept:Motives for overstatement in financial statement fraud.

Detailed Explanation:

Rationale for Correct Answer: Failing to write off obsolete inventory inflates reported inventory, overstating assets and potentially net income. Fraudsters may leave unusable goods on the books to make financial statements appear stronger.

Analysis of Incorrect Options:

A – An allowance for sales returns relates to revenue recognition, not inventory overstatement.

B – Relates to accounts receivable, not inventory.

C – Applying lower of cost or NRV reduces inventory to fair value, not overstates it.

Key Concept: Overstating assets through improper inventory valuation.

Detailed Explanation:

Rationale for Correct Answer:The ACFE describes occupational fraud and abuse as an expense of doing business because organizations inevitably face losses from it, just as they incur other operating costs. This framing emphasizes the importance of prevention and detection to minimize this “expense.”

Analysis of Incorrect Options:

A. Equity – Residual ownership interest, not relevant here.

B. Balance sheet – A report, not a cost.

D. Financial record – Too vague.

Key Concept:Occupational Fraud as a Cost of Business.

Rationale for Correct Answer:Fraud investigations can be highly costly to organizations. The process often involves external forensic examiners, legal proceedings, employee time, and disruption of operations. While necessary, investigations represent a significant resource commitment in terms of both time and financial cost.

Key Concept:Fraud Investigation Costs — deterrence vs. response strategies.

Detailed Explanation:

Rationale for Correct Answer: Synthetic identity theft occurs when fraudsters combine real identifiers (e.g., SSN, tax ID) with fictitious details to create a “new” identity. This differs from traditional identity theft, where a real person’s identity is used in full.

Analysis of Incorrect Options:

B. Simulated identity theft – Not a standard fraud classification.

C. Traditional identity theft – Uses a complete stolen identity, not a hybrid.

D. Criminal identity theft – Involves using someone else’s identity when charged with a crime.

Key Concept: Synthetic identity theft as an evolving form of fraud.

Detailed Explanation:

Rationale for Correct Answer: A high percentage of coding outliers (e.g., using higher-paying diagnosis or procedure codes more often than peers) is a red flag of upcoding or fraudulent billing. This signals possible abuse of reimbursement systems.

Analysis of Incorrect Options:

A – Fewer claims would not suggest fraud.

C – Matching documentation is expected, not suspicious.

D – Low profits may indicate inefficiency, not fraud.

Key Concept: Health care fraud detection through data analytics and coding anomalies.

Detailed Explanation:

Rationale for Correct Answer:By double-entry accounting rules, every accounting entry affects at least two accounts (debit and credit). Fraudulent entries must also follow this rule, meaning manipulation will show up in at least two categories on the financial statements.

Analysis of Incorrect Options:

A. One – Impossible in double-entry accounting.

C. More than two – Possible, but not always; the minimum is two.

D. None of above – Incorrect since “at least two” is correct.

Key Concept:Double-entry accounting ensures at least two accounts are affected in every transaction, including fraudulent ones.

Detailed Explanation:

Rationale for Correct Answer:The balance sheet summarizes account balances from the ledger at a specific date, presenting assets, liabilities, and equity. It reflects the organization’s financial position and is derived from ledger balances.

Analysis of Incorrect Options:

B. Income statement – Summarizes revenues and expenses, not all ledger balances.

C. Financial statement – A general term, but the specific answer here is balance sheet.

D. General journal – Book of original entry, not a summary.

Key Concept:Balance sheet as a summary of ledger accounts.

Detailed Explanation:

Rationale for Correct Answer:Skimming is difficult to detect because the stolen cash is never recorded (“off-book”). Therefore, it is often discovered by accident — such as customer complaints, discovery of missing deposits, or unexpected reconciliations — rather than through audits or routine controls.

Analysis of Incorrect Options:

A. Internal audits – Effective for many frauds but weak at uncovering skimming because records appear normal.

C. Internal controls – Preventive controls may deter but cannot detect unrecorded theft.

D. Occupational frauds – Too broad and not a detection method.

Key Concept:Detection of Skimming — most often accidental.

Detailed Explanation:

Rationale for Correct Answer: A major red flag of a Ponzi scheme is when the promoter has custody and control over investor funds with little to no independent oversight. This centralization allows them to use new investor money to pay old investors while concealing losses.

Analysis of Incorrect Options:

A – Ponzi operators usually pressure investors to reinvest, not take payouts, to keep funds circulating.

C – Schemes often involve overly complex or secretive strategies, not simple ones.

D – Realistic fluctuations based on markets suggest legitimate investing, not a Ponzi scheme (which typically reports steady, unrealistic returns).

Key Concept: Ponzi schemes rely on lack of oversight, unrealistic returns, and control of funds by promoters.

Detailed Explanation:

Rationale for Correct Answer: A kickback scheme occurs when vendors make payments to employees of a purchasing organization in exchange for steering business their way. Here, Bob steered contracts to Oak Company and received a percentage of profits, a textbook kickback arrangement.

Analysis of Incorrect Options:

B. Illegal gratuity scheme – Involves rewards after a decision, without a prior agreement. Here, the agreement was prearranged.

C. Diversion scheme – Refers to diversion of assets, not procurement favoritism.

D. Economic extortion scheme – Involves coercion of the vendor; this was voluntary bribery.

Key Concept: Bribery and kickbacks as forms of corruption.

Detailed Explanation:

Rationale for Correct Answer:This statement is True. ACFE research shows that external audits, while valuable, are generally not effective at detecting fraud quickly. Organizations with only external audits often experience higher median losses and longer-lasting schemes compared to those with stronger internal controls and fraud-specific detection mechanisms. External audits are not designed to catch fraud; their focus is on financial statement accuracy.

Key Concept:Effectiveness of External Audits in fraud detection versus prevention and internal controls.

Detailed Explanation:

Rationale for Correct Answer:The SEC’s Staff Accounting Bulletin (SAB) 104 outlines four criteria for revenue recognition:

Persuasive evidence of an arrangement exists.

Delivery has occurred or services have been rendered.

The seller’s price is fixed or determinable.

Collectability is reasonably assured.

“Timings have been met” is not one of the recognized criteria, making C the correct answer.

Analysis of Incorrect Options:

A, B, D – All are required conditions.

C – Not part of SAB 104.

Key Concept:Revenue recognition criteria under SAB 104.

Comprehensive and Detailed Explanation

Definition of Upcoding (ACFE Manual Reference)

The ACFE Manual identifies upcoding as a type of health care billing fraud in which the provider submits a claim for a more expensive or more complex service than what was actually provided.

Although the exact term “upcoding” appears within the health care fraud discussions, the broader category is part of Financial Transactions and Fraud Schemes concerning fraudulent billing practices. The manual describes fraud schemes in which the perpetrator:

Bills for services not provided,

Bills for more expensive services than were actually delivered, or

Uses codes that misrepresent the level or nature of medical procedures.

Upcoding specifically involves:

Billing for a higher-cost procedure than what was actually performed, by using a code representing a more expensive service.

Why Option D Is Correct

Dr. Raul advised a patient with a small fracture to use crutches, but he submitted a claim using a code indicating that he placed a cast on the patient.

Actual service: Advice and crutches

Billed service: Application of a cast (more expensive procedure)

This is a textbook example of upcoding, as the provider is using a higher-cost CPT code to obtain greater reimbursement than the service warrants.

Why the Other Options Are Incorrect

Option A – Not Upcoding

Cindy receives a payment to undergo an unnecessary procedure, which is then billed fraudulently.

This is medically unnecessary services fraud, not upcoding.

Option B – Not Upcoding

Dr. Loomis uses three procedure codes instead of one.

This is an example of unbundling, which involves billing separate codes for procedures that should be billed as a single package.

Option C – Not Upcoding

Landon inflates the amount of a medical bill he wants reimbursed.

This is billing inflation or overstatement, but not misrepresentation via coding.

ACFE Manual Supporting Reference

The Manual’s section on fraudulent billing schemes discusses cases where perpetrators misrepresent medical procedures, including using false or inflated codes to obtain higher reimbursements.

Detailed Explanation:

Rationale for Correct Answer: A ghost employee scheme occurs when someone (real or fictitious) is added to payroll, and paychecks are diverted to the fraudster. The key requirement is that the “ghost” is listed on payroll records.

Analysis of Incorrect Options:

A – The ghost may be fictitious or a real former employee.

B – Employment classification is irrelevant.

C – A ghost could be a current, terminated, or entirely fictitious employee.

Key Concept: Payroll fraud – ghost employee schemes.

Detailed Explanation:

Rationale for Correct Answer:Simply holding two jobs without disclosure is not inherently a conflict of interest unless the roles compete, overlap, or present divided loyalties. The other options all describe undisclosed financial or relational interests that conflict with the employer’s best interest.

Analysis of Incorrect Options:

A. Harriet’s stock ownership – Direct financial conflict.

C. Jennifer’s board positions – Competing loyalties between competitors.

D. Ernest hiring his brother – Nepotism without disclosure is a conflict.

Key Concept: Conflict of interest schemes in corruption.

Detailed Explanation:

Rationale for Correct Answer:Larceny by fraud (often termed “theft by deception”) occurs when someone unlawfully obtains another’s property by deception rather than by direct taking. As defined in fraud examination principles, deception can involve: (1) creating or reinforcing a false impression, (2) failing to correct a false impression, or (3) failing to disclose material facts such as liens or adverse claims. Because all three scenarios represent deceptive means to unlawfully take property, the correct answer is D. All of the above.

Analysis of Incorrect Options:

A, B, C each describe valid examples of fraud by deception but individually do not fully capture the concept.

D encompasses the totality of recognized deceptive practices under larceny by fraud.

Key Concept:Fraud by deception as an element of theft and misappropriation.

Detailed Explanation:

Rationale for Correct Answer:Deliberate writing of vague specifications is a type of corruption scheme where an employee intentionally drafts unclear requirements. This forces later amendments, which can be manipulated to favor a particular vendor.

Analysis of Incorrect Options:

B. Need recognition – Involves unnecessary purchases, not vague specifications.

C. False specification – General but not precise; “vague specifications” is the correct technical term.

D. Bid-splitting – Breaking contracts into smaller amounts to avoid approval controls, not related to vague specs.

Key Concept:Specification schemes in procurement corruption.

Detailed Explanation:

Rationale for Correct Answer:The statement is false. Cressey’s fraud triangle and Albrecht’s fraud scale both emphasize that fraud is more likely when pressures are high, opportunities are present, and integrity is low. Conversely, when pressure and opportunity are low and integrity is high, the likelihood of fraud is greatly reduced.

Analysis of Incorrect Options:

A. True – Incorrect, it directly contradicts the fraud triangle and fraud scale models.

B. False – Correct, because under the conditions stated, fraud occurrence is less likely.

Key Concept:Fraud Scale Variables — Pressure, Opportunity, Integrity.

Detailed Explanation:

Rationale for Correct Answer:Cash larceny involves the theft of incoming cash after it has been recorded. Strong segregation of duties is critical to prevent concealment. By separating cash deposit responsibilities from bank reconciliation duties, one employee cannot both steal funds and cover their tracks.

Analysis of Incorrect Options:

A. Restricting substitution – Weakens controls; job rotation and cross-training help prevent fraud.

C. Same register use – Reduces accountability, making theft harder to trace.

D. Surprise cash counts – Strong detective control, but not as preventive as segregation of duties.

Key Concept: Preventing cash larceny through segregation of duties.

Detailed Explanation:

Rationale for Correct Answer: Finding personal checks in the cash register is unusual, but it does not specifically indicate a register disbursement scheme (such as false refunds or voids). The other options are classic red flags for such schemes.

Analysis of Incorrect Options:

A – Missing transaction numbers suggest manipulation.

C – Excessive voids near approval limits indicate fraud concealment.

D – Allowing cashiers to void their own sales creates opportunity for abuse.

Key Concept: Register disbursement schemes and their red flags.

Detailed Explanation:

Rationale for Correct Answer:When a tangible asset is stolen (removed from the books), a debit entry would be missing its corresponding credit, leaving the books out-of-balance. Fraudsters often conceal this imbalance by falsifying entries (e.g., creating fictitious expenses or adjusting asset accounts).

Analysis of Incorrect Options:

A. Journal Entries – Too general; not the condition of the books.

C. False debits – A concealment method, but not the direct result.

D. None of all – Incorrect because “out-of-balance” is accurate.

Key Concept:Concealment of asset theft and impact on accounting records.

Detailed Explanation:

Rationale for Correct Answer: A draw request is used by construction developers to obtain loan funds for work completed. If lien releases are missing, it suggests subcontractors may not have been paid, and the developer might be misrepresenting completed work—an indicator of loan fraud.

Analysis of Incorrect Options:

A – Omission of personal account statements isn’t unusual for a draw request.

B – Change orders are common in construction projects.

D – Multiple inspection reports support validity, not fraud.

Key Concept: Loan fraud detection through supporting documentation review.

Detailed Explanation:

Rationale for Correct Answer: Biometric authentication (fingerprints, facial recognition) is one of the strongest defenses against identity theft. It prevents unauthorized logins even if passwords are compromised.

Analysis of Incorrect Options:

A – Password reuse should be avoided altogether, not just limited.

B – Updates should be installed promptly, not annually.

C – Personal information should rarely, if ever, be transmitted via email, even with reputable companies.

Key Concept: Identity theft prevention through strong authentication.

Detailed Explanation:

Rationale for Correct Answer:Baiting is a social engineering tactic where fraudsters leave infected flash drives or storage media in public areas, hoping victims will plug them in, unknowingly installing malware. This is an accurate description.

Analysis of Incorrect Options:

A. Pharming – Involves redirecting users from legitimate websites to fraudulent ones, not mail redirection.

B. Dumpster diving – Searching physical trash for sensitive information, not computers from resellers.

C. Shoulder surfing – Observing someone’s screen or keystrokes, not access exploitation.

Key Concept: Identity theft techniques.

Detailed Explanation:

Rationale for Correct Answer:Fair value is defined as the price an asset would fetch in an orderly transaction between willing market participants. It reflects current market conditions, not historical cost.

Analysis of Incorrect Options:

A. Absolute value – Mathematical concept, not accounting.

C. Cost value – Historical cost, not current market.

D. Material value – Not a recognized accounting term.

Key Concept:Fair Value Measurement under GAAP/IFRS.

Detailed Explanation:

Rationale for Correct Answer:This statement is False. Research in occupational fraud consistently shows that when employees believe there is a strong likelihood of being caught, they are less likely to engage in theft or deviant behavior. Deterrence theory emphasizes that perceived certainty of detection is one of the most effective controls against occupational fraud.

Key Concept:Deterrence through perceived detection.

Detailed Explanation:

Rationale for Correct Answer: A disproportionate increase in COGS without a corresponding increase in sales is a red flag for inventory theft or misappropriation. Theft reduces ending inventory, which artificially inflates COGS, while sales remain unchanged or grow modestly.

Analysis of Incorrect Options:

A – Warranty liabilities affect expenses, not COGS.

B – Fewer sales would reduce both revenue and COGS proportionally, not cause a large disparity.

C – Sales returns reduce revenue, not inflate COGS.

Key Concept: Using analytical review to detect inventory theft via COGS anomalies.

Detailed Explanation:

Rationale for Correct Answer:The correct answer is A. Fiduciary Capacity. According to the Fraud Examiners Manual (2020 International Edition), a fiduciary relationship exists when a person is entrusted with the property or affairs of another and is obligated to act in the best interest of that person, rather than for their own benefit. Fiduciary capacity is a key legal concept in fraud examinations, particularly in cases involving breaches of trust, embezzlement, or misappropriation.

Analysis of Incorrect Options (Distractors):

B. Embezzlement – Embezzlement is the wrongful appropriation of assets by a person entrusted with them. While it often arises from a fiduciary relationship, it describes the act of theft, not the capacity in which the person acts.

C. Conversion – Conversion refers to the unauthorized use or control over another’s property, a civil wrong, but it does not describe the relationship of acting on another’s behalf.

D. None of the above – Incorrect, since “fiduciary capacity” directly fits the definition in the question.

Key Concept:Understanding fiduciary duty and fiduciary capacity, which form the legal foundation for identifying when a person has a duty to act on behalf of another, often forming the basis for fraud-related legal claims.

Detailed Explanation:

Rationale for Correct Answer:In double-entry accounting, a debit increases assets and expenses while decreasing liabilities and equity. Debits are entries on the left side of an account.

Analysis of Incorrect Options:

A. Journal Entries – General record of transactions, not the specific effect.

C. Credit – Opposite effect: increases liabilities/equity, decreases assets/expenses.

D. None of all – Incorrect because “debit” is the recognized effect.

Key Concept:Debit rules in double-entry accounting.

Detailed Explanation:

Rationale for Correct Answer: One of the strongest internal controls against fraudulent billing schemes (such as shell companies, inflated invoices, and kickbacks) is to require competitive bidding. This ensures transparency, reduces favoritism, and makes it harder for employees and vendors to collude.

Analysis of Incorrect Options:

A – Fraud tips are valuable, but routing them only through supervisors may suppress reporting; hotlines are more effective.

B – Combining purchasing and payment increases fraud risk by reducing segregation of duties.

D – Outsourcing negotiations does not directly prevent billing fraud.

Key Concept: Internal controls and segregation of duties in preventing billing schemes.

Detailed Explanation:

Rationale for Correct Answer:Employees authorized to grant discounts may exploit this by issuing false discounts. They pocket part of the customer’s payment while recording a reduced sale amount, making the books appear balanced.

Analysis of Incorrect Options:

B. Recording a discount on sale procedure – A legitimate process, not fraud.

C. Internal discount sales audits – A control, not a scheme.

D. None of the above – Incorrect since false discounts are a recognized method.

Key Concept:False discount schemes as a skimming method.

Detailed Explanation:

Rationale for Correct Answer: Under accrual-basis accounting, revenues are generally recognized when earned (often upon delivery of goods or services), not necessarily when cash is received. Similarly, expenses are recorded when incurred, not when paid. This provides a more accurate picture of performance and financial position.

Analysis of Incorrect Options:

A – This describes cash-basis accounting, not accrual-basis.

B – Accrual accounting is more complex, not simpler.

C – Focuses on earned revenues and incurred expenses, not immediate cash flow.

Key Concept: Accrual accounting matches revenues with expenses in the period they occur.

Comprehensive and Detailed Explanation (Based on the ACFE Fraud Examiners Manual – Financial Transactions and Fraud Schemes)

In the Identity Theft chapter of the Financial Transactions and Fraud Schemes section, the ACFE Manual explains that there are two primary methods of committing identity theft:

Traditional identity theft

Synthetic identity theft

These are listed under “Methods of Committing Identity Theft” (1.803), immediately followed by “Types of Identity Theft Schemes” (1.804) such as financial identity theft and criminal identity theft.

1. Why the correct answer is Traditional identity theft (Option B)

In traditional identity theft, the perpetrator uses the real, complete identity of another person—such as their name, government identification number, and birthdate—to impersonate that person for fraudulent purposes. This is exactly what is happening in the question:

The fraudster uses a real victim’s name, government identification number, and birthdate to open a credit card account in the victim’s name.

This matches the Manual’s categorization where traditional identity theft involves misuse of actual personal identifying information (PII) belonging to a real individual, rather than fabricating an identity. The Manual then explains that this stolen identity is often used in financial schemes, such as obtaining credit cards, loans, or other financial benefits, which falls under financial identity theft as a type of identity theft scheme.

So, in ACFE terms, the method is traditional identity theft, and the scheme type is financial identity theft (using another person’s identity to obtain credit or other financial benefits).

2. Why the other options are incorrect

Option A – New account identity theft

“New account identity theft” is a descriptive phrase sometimes used in practice to describe opening new credit accounts in another person’s name, but the ACFE Manual’s formal categorization focuses on:

Methods of committing identity theft:

Traditional identity theft

Synthetic identity theft

Types of identity theft schemes:

Financial identity theft

Criminal identity theft

Medical identity theft

Insurance identity theft

Tax identity theft

Employment identity theft

Business identity theft

“New account identity theft” is not one of the defined method categories in the Manual; the described conduct is captured under traditional identity theft (method) and financial identity theft (scheme type). Therefore, this option does not align with the ACFE’s terminology tested on the CFE exam.

Option C – Synthetic identity theft

The Manual distinguishes synthetic identity theft as a different method. Under “Methods of Committing Identity Theft” (1.803), it explains that synthetic identity theft involves combining real elements of identity (for example, a genuine government identification number) with fabricated or unrelated information (such as a made-up name, date of birth, or address) to create a partly fictitious identity.

In the question, the fraudster is not creating a hybrid or composite identity. They are using all of the real victim’s identifying information (name, government ID number, birthdate) and posing directly as that person. That is traditional, not synthetic.

Option D – Criminal identity theft

Under “Types of Identity Theft Schemes” (1.804–1.805), the Manual describes criminal identity theft as a scheme where a fraudster gives someone else’s identifying information to law enforcement or in criminal justice contexts, so that the victim’s identity is attached to the criminal record or charges.

Typical examples include:

Giving another person’s name and identification details when stopped or arrested

Causing warrants or criminal records to be issued in the victim’s name

In the question scenario, the fraudster is not interacting with law enforcement or shifting criminal records to the victim. Instead, they are opening a credit card account, which is a financial use of the stolen identity. Therefore, it fits financial identity theft as a scheme type, but traditional identity theft as the method.

Detailed Explanation:

Rationale for Correct Answer:Filing a claim shortly after a policy begins is a classic red flag of potential insurance fraud, as it may indicate the loss occurred before coverage or is fabricated.

Analysis of Incorrect Options:

B. One prior claim in five years – Not unusual by itself.

C. Small electronics/jewelry – Common theft items, not automatically suspicious.

D. Recently purchased items with receipts – Strong documentation actually supports legitimacy.

Key Concept: Insurance fraud red flags.

Detailed Explanation:

Rationale for Correct Answer: Being prompted to install unfamiliar software is a red flag for malware or unauthorized access, often indicating that attackers are attempting to establish persistence in the system. This is a classic indicator of a compromised network.

Analysis of Incorrect Options:

A – Standard security measure, not a red flag.

C – Data from supplier countries is normal if consistent with business operations.

D – Access denial to files outside a user’s role is a normal access control, not an intrusion sign.

Key Concept: Cyberfraud detection – identifying intrusion indicators.

Detailed Explanation:

Rationale for Correct Answer:While asset misappropriation schemes are usually committed by lower-level employees, financial statement fraud is most often committed by senior management. This is because executives have the authority to override controls, direct accounting policies, and influence financial reporting for personal gain (bonuses, stock prices, or to conceal poor performance).

Analysis of Incorrect Options:

A. Organized criminals – May commit fraud, but financial statement fraud specifically requires authority over reporting.

B. Mid and lower-level employees – Lack sufficient authority to materially alter financial statements.

D. All of the above – Incorrect, as financial statement fraud is overwhelmingly associated with senior management.

Key Concept:Management override — financial statement fraud perpetrated by those with the authority to manipulate reports.

Detailed Explanation:

Rationale for Correct Answer:One of the most effective ways to protect proprietary information is educating employees about nondisclosure agreements (NDAs) at onboarding and again during exit. This ensures awareness of confidentiality obligations.

Analysis of Incorrect Options:

A. Changing locks/codes every 3–5 years – Reasonable security but insufficient for safeguarding proprietary information.

B. Classifying data by years of service – Not a sound security practice; access should be based on role and need-to-know.

D. Requiring notes/drafts – Increases risk of information leaks, not protection.

Key Concept: Proprietary information protection.

Detailed Explanation:

Rationale for Correct Answer: Smishing (SMS phishing) uses fraudulent text messages to trick victims into clicking malicious links or revealing credentials. This matches Cynthia’s scenario.

Analysis of Incorrect Options:

A. Vishing – Voice phishing by phone call, not text message.

C. Catfishing – Fake online persona in social contexts, not financial fraud via text.

D. Pharming – Redirecting users to fake websites via DNS manipulation, not text messages.

Key Concept: Social engineering methods—email (phishing), phone (vishing), text (smishing).

Detailed Explanation:

Rationale for Correct Answer:This statement is False. Shrinkage is a general term for unaccounted-for inventory losses, and it can indeed result from theft, errors, damage, or waste. To say shrinkage does not result from theft is misleading because theft is one of its primary causes.

Analysis of Incorrect Options:

A. True – Incorrect, as theft is often a major contributor to shrinkage.

B. False – Correct, since shrinkage can include theft.

Key Concept:Shrinkage includes theft as a cause of unexplained inventory loss.

Detailed Explanation:

Rationale for Correct Answer:Shrinkage refers to discrepancies between physical inventory counts and perpetual inventory records. Causes include theft, errors, waste, or fraud. It is one of the most common indicators of asset misappropriation.

Analysis of Incorrect Options:

A. Altered inventory – Not a recognized accounting term.

B. Account receivable – Unrelated to inventory.

D. Write-offs – A corrective accounting entry, not the variance itself.

Key Concept:Inventory shrinkage as a red flag for fraud.

Detailed Explanation:

Rationale for Correct Answer:Fraudsters may solicit bids from fictitious suppliers (phony vendors) to create the illusion of competition. This ensures that the favored vendor wins while maintaining the appearance of a legitimate competitive bidding process.

Analysis of Incorrect Options:

B. Solicit transactions from fictitious vendors – Incorrect phrasing; bids, not transactions, are solicited.

C. Solicit bid-splitting… – Bid-splitting is a different fraud scheme, not part of solicitation.

D. None of the above – Incorrect, since A is accurate.

Key Concept:Phony bid solicitation as a corruption tactic in procurement.

Detailed Explanation:

Rationale for Correct Answer:Journal entries record business activity, and credits increase equity (while debits reduce equity). Thus, journal entries and credits are the mechanisms that directly affect the equity account.

Analysis of Incorrect Options:

A. Journal Entries & Debit – Debits decrease equity, not increase.

B. Journal Entries & Transactions – Transactions are general; credits specify the effect.

D. None of all – Incorrect since option C is correct.

Key Concept:Equity changes recorded through journal entries and credits.

Detailed Explanation:

Rationale for Correct Answer:According to SAB 104, revenue recognition requires persuasive evidence of an arrangement. This does not exist if there is no written contract, purchase order, or verbal agreement supporting the transaction.

Analysis of Incorrect Options:

A. Revenue and expenses don’t match – Violates matching principle, not persuasive evidence.

C. Timings not meet properly – Refers to delivery/performance, not evidence of arrangement.

D. Capitalized expenses and liabilities – Irrelevant to revenue recognition.

Key Concept:Revenue recognition requirement: Persuasive evidence of an arrangement.