CFE-Fraud-Schemes-and-Financial-Crimes Certified Fraud Examiner -Fraud Schemes and Financial Crimes Questions and Answers

Detailed Explanation:

Rationale for Correct Answer: By definition, financial statement fraud is intentional . Errors or accidents in reporting are not fraud; they are mistakes. Fraud requires deliberate misrepresentation to deceive users of financial statements.

Analysis of Incorrect Option:

A. True – Incorrect because it includes “accidental” misstatements, which fall outside fraud.

Key Concept: Intentional misstatement is the defining element of financial statement fraud.

Detailed Explanation:

Rationale for Correct Answer:

Rationale for Correct Answer: Fraud investigations can be highly costly to organizations. The process often involves external forensic examiners, legal proceedings, employee time, and disruption of operations. While necessary, investigations represent a significant resource commitment in terms of both time and financial cost.

Key Concept: Fraud Investigation Costs — deterrence vs. response strategies.

The correct answer is A, money laundering. The ACFE material defines money laundering as the process by which criminals disguise illicit assets as legitimate assets that they have a right to possess and spend. It involves concealing the existence, nature, source, control, beneficial ownership, location, or disposition of property derived from criminal activity. Cross-border financing may be a feature of laundering, but it is not the overall process described. Asset trafficking is not the best ACFE classification for disguising criminal proceeds. Concealment of assets may occur in fraud or bankruptcy matters, but it is broader and does not specifically capture the laundering of illegal proceeds into apparently legitimate funds.

================

Detailed Explanation:

Rationale for Correct Answer: Key GAAP principles include Conservatism , Historical Cost , and Full Disclosure . Quality control is not a GAAP principle; rather, it is a concept from auditing standards related to ensuring audit quality.

Analysis of Incorrect Options:

A. Conservatism – GAAP principle requiring cautious reporting of uncertain outcomes.

B. Cost – Historical cost principle is central to GAAP.

C. Full disclosure – Requires all relevant information to be presented.

D. Quality control – Belongs to auditing, not GAAP.

Key Concept: GAAP principles — distinguishing accounting standards from auditing practices.

Detailed Explanation:

Rationale for Correct Answer: According to the ACFE Fraud Tree , corruption is divided into four classifications: bribery, illegal gratuities, economic extortion, and conflicts of interest . These cover the major ways employees misuse influence for personal gain.

Analysis of Incorrect Options:

B. Corruption… – Redundant; corruption is the main category, not a sub-classification.

C. Overbilling and bid-rigging – These are disbursement schemes, not corruption categories.

D. Corruption repeated – Incorrect for the same reason as option B.

Key Concept: Corruption classifications under the Fraud Tree.

Detailed Explanation:

Rationale for Correct Answer: This is True . Fraudulent financial reporting often involves manipulating depreciation. By lowering or delaying depreciation expense, companies can inflate profits and overstate asset values. This is a common method of financial statement fraud related to earnings management.

Analysis of Incorrect Options:

B. False – Incorrect, as understatement of depreciation clearly inflates reported profits.

Key Concept: Depreciation Manipulation in Financial Statement Fraud .

Detailed Explanation:

Rationale for Correct Answer: An air loan is a mortgage fraud scheme where the borrower and sometimes insiders create completely fictitious properties or borrowers. Here, the nonexistent property and loan proceeds being pocketed fits this definition.

Analysis of Incorrect Options:

A. Property flopping – Involves short sales and undervaluing distressed property.

C. Phantom lien – False liens filed to collect fraudulent claims on real estate.

D. Daisy chain – Involves multiple property transactions between conspirators to inflate value.

Key Concept: Loan fraud schemes – fictitious property loans (air loans).

The correct answer is B. Cash register disbursement schemes commonly involve false voids, false refunds, or unauthorized register activity. Secure access codes help establish individual accountability and prevent one employee from processing fraudulent transactions under another employee’s credentials. Training employees not to share access codes strengthens this control. Option A is weak because announced cash counts reduce deterrence; surprise counts are more effective. Option C does not provide meaningful control because another non-supervising employee might not detect or challenge improper activity. Option D is inappropriate because employees should not independently reconcile their own register activity; independent review is necessary. The professional control principle is to restrict access, preserve accountability, and require supervisory or independent review of register disbursements.

================

Detailed Explanation:

Rationale for Correct Answer: When a single employee is responsible for opening the mail and recording payments, the risk of theft of incoming checks is greatest. This lack of segregation of duties allows one person both custody of funds and recordkeeping authority, a classic internal control weakness.

Analysis of Incorrect Options:

B & C – Involving two or more employees provides better segregation of duties, reducing the risk.

D. None of the above – Incorrect since option A directly matches.

Key Concept: Segregation of duties to prevent skimming/theft of incoming checks.

Detailed Explanation:

Rationale for Correct Answer: Fraudulent schemes involving returns and allowances can be detected by analyzing accounts for unusually high transactions in these categories. This is a common red flag for concealment of theft or manipulation of sales.

Analysis of Incorrect Options:

A. Allowances by vendors – Too narrow, not a standard analytic test.

B. Disposals of allowances than reorders – Not a recognized search method.

D. None of the above – Incorrect, since option C is valid.

Key Concept: Returns and allowances analysis for fraud detection.

Rationale for Correct Answer: Strong internal controls — particularly inventory controls — are essential not just to prevent theft, but also to detect errors, reduce waste, and ensure that inventory levels are appropriate. Controls such as physical counts, reconciliations, and segregation of duties protect against misappropriation and inefficiencies.

Key Concept: Internal Controls as a preventive and detective mechanism in asset safeguarding.

The correct answer is D. The FATF Recommendations establish international standards for combating money laundering, terrorist financing, and related threats. They recommend that countries criminalize money laundering, supervise financial institutions and high-risk professions, require suspicious transaction reporting, and maintain mechanisms for analyzing and disseminating financial intelligence. A financial intelligence unit receives and analyzes suspicious transaction reports and other AML-related information. Option A is incorrect because FATF does not require a universal three-year sentence for every conviction. Option B is too extreme and does not reflect the FATF framework. Option C is not a general FATF requirement; customer due diligence and monitoring focus on risk, transactions, and beneficial ownership, not mandatory review of public social media profiles.

================

Detailed Explanation:

Rationale for Correct Answer: Prepaid debit and gift cards are attractive because they allow fraudsters to convert stolen credit card funds into cash or easily launder illicit funds . They are widely available and accepted both in person and online, making option A correct.

Analysis of Incorrect Options:

B. Only from financial institutions – False; cards are sold at retail stores and online.

C. Not accepted online – False; they are accepted by most online retailers.

D. All of the above – Incorrect since B and C are false.

Key Concept: Prepaid card fraud as part of asset misappropriation and identity theft schemes.

The correct answer is A. Oona’s conduct is a multiple expense reimbursement scheme because she is attempting to obtain reimbursement for an expense that the company has already paid through the company credit card. In expense reimbursement fraud, multiple reimbursement schemes occur when an employee submits the same expense more than once, or submits an expense paid through one channel as though it was paid personally. This differs from a mischaracterized expense, where a personal cost is falsely described as business-related. It also differs from an overstated expense, where the amount is inflated, and from a fictitious expense, where no expense occurred. The key issue is duplicate recovery of the same lunch expense.

================

Detailed Explanation:

Rationale for Correct Answer: One of the most effective ways to protect proprietary information is educating employees about nondisclosure agreements (NDAs) at onboarding and again during exit. This ensures awareness of confidentiality obligations.

Analysis of Incorrect Options:

A. Changing locks/codes every 3–5 years – Reasonable security but insufficient for safeguarding proprietary information.

B. Classifying data by years of service – Not a sound security practice; access should be based on role and need-to-know.

D. Requiring notes/drafts – Increases risk of information leaks, not protection.

Key Concept: Proprietary information protection .

Detailed Explanation:

Rationale for Correct Answer: Conducting vendor background checks before adding them to the master file is a strong preventive control against shell companies, conflicts of interest, and vendor collusion. It helps ensure vendor legitimacy before business begins.

Analysis of Incorrect Options:

B – Too broad; monitoring should focus on practical red flags, not “all schemes.”

C – Violates segregation of duties, increasing fraud risk.

D – Monitoring should be ongoing, not limited to once a year.

Key Concept: Procurement fraud prevention through vendor due diligence and segregation of duties.

Detailed Explanation:

Rationale for Correct Answer: Cressey’s research on fraud offenders found that most had non-sharable financial problems, which fell into categories such as: (1) violation of ascribed obligations, (2) business reversals, (3) physical isolation, (4) status gaining, and (5) employer-employee relations. “Larceny by fraud” is not a category of non-sharable problem but rather a type of theft scheme. Hence, D is correct.

Analysis of Incorrect Options:

A. Violation of ascribed obligations – Correctly one type of non-sharable problem.

B. Business reversals – Correctly one type of non-sharable problem.

C. Physical isolation – Correctly one type of non-sharable problem.

D. Larceny by fraud – Not a “problem” type; it is a fraud scheme.

Key Concept: Cressey’s non-sharable problems — psychological and situational pressures that contribute to occupational fraud.

Option A is the most accurate because government and public sector entities commonly face slower implementation of fraud prevention initiatives due to budget cycles, staffing rules, public accountability requirements, and formal approval structures. Public sector fraud prevention is often affected by legal mandates, appropriations, political priorities, and administrative constraints. Option B reverses the distinction; government entities are generally more directly constrained by legal and budgetary requirements. Option C is inaccurate because public sector organizations often have less flexibility over operations and objectives than private entities. Option D is also reversed because government and public sector fraud prevention is more likely to be influenced by public policy and prevailing government priorities. The ACFE material recognizes public-sector accountability and auditing standards as distinct from private sector governance.

================

Detailed Explanation:

Rationale for Correct Answer: One form of bid-rigging occurs when colluding vendors agree that one will submit a low bid and later withdraw it , allowing another conspirator to win the contract. This practice is sometimes referred to as “ complementary bidding ” or the withdrawal of low bids .

Analysis of Incorrect Options:

A. Bribery receipt – Refers to corrupt payments, not collusion.

B. Bid solicitation – The process of inviting bids, not collusion.

D. Contract acceptance – A legitimate procurement step, not fraud.

Key Concept: Bid-rigging through collusion — vendors withdrawing low bids to favor co-conspirators.

The correct answer is A. A tax haven is a jurisdiction with low or no tax rates that individuals or entities use to reduce tax obligations. Moving a company’s headquarters to another jurisdiction specifically to benefit from a lower tax rate fits the concept of using a tax haven. A secrecy jurisdiction emphasizes financial secrecy, bank secrecy, or laws that limit disclosure of ownership or account information; it might overlap with tax haven activity, but the question focuses on lower tax rates. A tax shelter is an investment or arrangement designed to create tax benefits, such as deductions or deferrals. A jurisdictional deduction is not the best ACFE concept here. The ACFE tax fraud materials discuss tax havens, secrecy jurisdictions, and tax shelters in international tax avoidance and evasion.

================

Detailed Explanation:

Rationale for Correct Answer: In the detection and analysis phase of cybersecurity incident response, the focus is on identifying the scope of the incident, including all breaches, compromised systems, and the method of attack. Containment, eradication, and recovery occur in later steps. Thus, identifying all breaches is the correct activity for this step.

Analysis of Incorrect Options:

A. Limiting damage – This occurs in the containment phase.

B. Creating an incident response plan – This is part of the preparation phase.

C. Restoring control of affected systems – This occurs during eradication and recovery .

Key Concept: Incident response methodology: preparation → detection/analysis → containment → eradication → recovery.

Detailed Explanation:

Rationale for Correct Answer: Human intelligence (HUMINT) involves gathering information directly from people, often through deception, elicitation, or impersonation. Georgina’s posing as a customer to obtain confidential details fits this method.

Analysis of Incorrect Options:

B. Baiting – A social engineering tactic using false promises (e.g., malware disguised as freebies).

C. Scavenging – Collecting discarded information (e.g., dumpster diving).

D. Open-source intelligence – Gathering data from public records, news, or websites, not through elicitation.

Key Concept: Methods of competitive intelligence and social engineering.

Detailed Explanation:

Rationale for Correct Answer: Employees authorized to grant discounts may exploit this by issuing false discounts . They pocket part of the customer’s payment while recording a reduced sale amount, making the books appear balanced.

Analysis of Incorrect Options:

B. Recording a discount on sale procedure – A legitimate process, not fraud.

C. Internal discount sales audits – A control, not a scheme.

D. None of the above – Incorrect since false discounts are a recognized method.

Key Concept: False discount schemes as a skimming method.

Shirley has most likely been victimized by a romance scheme. In romance, sweetheart, or friendship scams, the fraudster builds an emotional relationship with the victim, often through social networking or online communication, and then requests money under a sympathetic pretext. Simon befriends Shirley, creates expectations of a future meeting, claims financial hardship, receives $10,000, and then disappears. That pattern is typical of a romance scam. A grandparent scheme usually involves impersonating a grandchild or relative in distress. A bait-and-switch scheme involves advertising one product or service and substituting another. A vacation scheme would focus on fraudulent travel offers, not a fabricated romantic relationship used to obtain money. The ACFE material identifies romance and friendship sc hemes as consumer fraud schemes.

================

Submitting token bids is a common collusive procurement fraud method known as complementary bidding, also called protective, shadow, or cover bidding. In this scheme, competing contractors submit bids that are not serious attempts to win the contract. These bids might be intentionally too high, technically unacceptable, or structured with unfavorable terms so the preferred contractor wins while the process still appears competitive. This undermines the purpose of competitive bidding, which is to place bidders on equal terms and obtain the best price and conditions. Option B is inconsistent with market division, where conspirators divide markets rather than seek all areas. Option C refers more generally to shell or fictitious bidding, and option D is a billing fraud issue, not the common collusive bidding method described here.

================

Detailed Explanation:

Rationale for Correct Answer: Bid pooling occurs when vendors collude to divide contracts among themselves. They agree in advance who will submit the lowest bid for certain contracts, ensuring each participant gets a share of the business.

Analysis of Incorrect Options:

A. Bid opening – The formal process of opening bids, not fraud.

B. Fictitious bidding – Not a standard fraud term.

D. Bid log – A record of submitted bids, not a scheme.

Key Concept: Bid pooling — collusion among vendors in bid-rigging schemes.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters conceal inventory shrinkage through multiple methods, including unrecorded sales, false write-offs, or manipulating perpetual records. The ACFE manual notes that concealment is a common theme in inventory fraud. Hence, all of the above are valid.

Analysis of Incorrect Options:

A, B, C – Each is correct individually, but the most comprehensive answer is D.

Key Concept: Concealment methods for inventory theft.

The correct answer is A. David is committing a lapping scheme. Lapping occurs when an employee steals one customer’s payment and conceals the theft by applying a later payment from another customer to the first customer’s account. The employee must then continue shifting later payments to earlier accounts to keep the shortage hidden. This creates a rolling concealment pattern that can continue until discovered through customer complaints, account confirmations, delayed postings, or independent reconciliation. Padding, substitution, and duplication are not the standard ACFE classifications for this receivables concealment method. Because David is using later customer payments to cover earlier stolen receipts, his conduct fits the classic definition of lapping under cash receipts fraud schemes.

================

The correct answer is C. A code of business ethics and conduct is most effective when it clearly communicates the organization’s values, expected behavior, and major compliance risks, including bribery, conflicts of interest, gifts, hospitality, facilitation payments, and dealings with third parties. Its purpose is not merely to impose management’s expectations, but to guide ethical decision-making across the organization. Option A is too one-sided and does not reflect tone at the top or mutual accountability. Option B is too narrow because anti-corruption obligations extend beyond shareholders to regulators, customers, employees, business partners, and the public. Option D is unrealistic because no code can address every possible ethical situation; it should provide principles, reporting channels, and escalation guidance.

================

The correct answer is A. Electronic funds transfer fraud involves the misuse of electronic payment systems to move money improperly. A vendor submitting an electronic bill through a client’s online payment system for services not provided is a fraudulent use of electronic bill presentment or payment processes. Option B is payroll fraud, specifically falsified hours or salary. Option C involves theft and misuse of prepaid cards, not EFT manipulation by the payee. Option D describes payment card skimming, where card information is captured for later unauthorized use. The ACFE materials discuss electronic funds transfers, wire transfer fraud, electronic bill presentment and payment, and detection of EFT fraud as part of payment fraud risk.

================

The correct answer is C. Competitive intelligence is the lawful and ethical gathering and analysis of information about competitors, markets, products, customers, and industry conditions. It can support research and development, pricing decisions, strategic planning, and forecasting of competitors’ costs or business moves. Option A is incorrect because illegal or covert acquisition of commercial information describes corporate espionage, not legitimate competitive intelligence. Option B describes government intelligence activity, not business competitive intelligence. Option D is incorrect because competitive intelligence should not use the same unlawful or deceptive methods associated with espionage. The ACFE material distinguishes lawful competitive intelligence from theft of data, trade secrets, and intellectual property.

================

Tammy is most likely committing a structuring scheme. Structuring occurs when a person deliberately breaks transactions into smaller amounts to avoid mandatory reporting thresholds. Here, Tammy repeatedly deposits cash in amounts between $9,000 and $9,900, just below the $10,000 reporting requirement. That pattern strongly indicates an attempt to avoid currency transaction reporting. A reverse deposit scheme and remote deposit capture scheme do not describe the deliberate splitting of cash deposits to evade reporting. Integration is a later stage of money laundering in which illicit funds are reintroduced into the economy as apparently legitimate funds, but Tammy’s activity is focused on avoiding detection during placement. The ACFE material identifies repeated deposits just under the reporting threshold as a classic red flag of smurfing or structuring.

================

The correct answer is B. Misrepresentation in health care or insurance fraud occurs when an applicant or insured person provides false information to obtain coverage, reduce premiums, or receive benefits that would not otherwise be available. Marco falsely states that he is a nonsmoker to obtain full insurance coverage, making the application materially misleading. Option A is a fictitious claim because the procedure was canceled. Option C involves improper use of another person’s policy or coverage. Option D is closer to multiple-claim or duplicate reimbursement fraud. The ACFE health care fraud materials specifically identify misrepresentation on applications as an insured or beneficiary fraud scheme, making Marco’s false smoking status the best example.

================

Detailed Explanation:

Rationale for Correct Answer: Net realizable value (NRV) is the estimated selling price of an asset in the ordinary course of business, minus any costs of completion, disposal, or transportation. This is often applied in valuing accounts receivable and inventory.

Analysis of Incorrect Options:

B. Going concern – Assumption of business continuity, not asset valuation.

C. Cost – Historical cost, not future realizable value.

D. Fair value – Current market-based measure, not net proceeds after costs.

Key Concept: Net realizable value — valuation method for receivables and inventory.

Detailed Explanation:

Rationale for Correct Answer: Fictitious or fabricated revenues are one of the most common forms of financial statement fraud. They involve recording revenues for transactions that never occurred, thereby inflating income and misleading stakeholders.

Analysis of Incorrect Options:

B. Financial revenues – Not a fraud scheme.

C. Red flag revenues – “Red flags” are indicators of fraud, not a type of revenue.

D. Concealed revenues – Refers to hiding income, not creating fictitious sales.

Key Concept: Fictitious revenues as a core financial statement fraud scheme.

Rationale for Correct Answer: Traditional bribery laws historically applied only to government officials . When bribery occurs in the private sector (commercial setting), it is known as commercial bribery . Modern laws and internal company codes address this as well.

Key Concept: Commercial bribery vs. government bribery.

Detailed Explanation:

Rationale for Correct Answer: The described scheme is lapping , a classic accounts receivable fraud. It involves covering up stolen payments by applying subsequent receipts from other customers to hide the shortage.

Analysis of Incorrect Options:

A. Padding – Usually refers to overstating expense reimbursements, not AR fraud.

C. Substitution – Refers to replacing missing assets with others, not AR manipulation.

D. Daisy chain – Not a recognized fraud concealment method in this context.

Key Concept: Skimming concealment techniques – lapping of receivables.

The ACFE Fraud Examiners Manual includes Kickback Schemes in the corruption section and specifically identifies Diverting Business to Vendors as a type of kickback scheme.

This question states that Bob, a purchasing agent , directed business to Oak Company, and in return Oak’s sales manager agreed to pay Bob a percentage of the extra profits . That is a classic kickback arrangement : the employee steers company business to a favored vendor in exchange for a personal financial benefit. The Manual’s examples of corruption also discuss a vendor bribing or paying a purchasing agent to receive more business.

Why the other options are incorrect

A. Economic extortion scheme

The Manual defines economic extortion as obtaining money, property, or services through coercion or threatened adverse action. That is not what happened here; Bob was paid for steering business, not coercing payment through threats.

C. Illegal gratuity scheme

The Manual explains that illegal gratuities are items of value given to reward a decision, often after the recipient has already made the decision, and this concept is primarily discussed in the public-sector context. Here, the payment is part of an agreement to direct business and share in profits, which is more accurately a kickback .

D. Diversion scheme

The relevant Manual terminology is Diverting Business to Vendors , but that appears as a subtype under Kickback Schemes . Therefore, the best answer among the options is the broader and correct classification: kickback scheme .

References

ACFE Fraud Examiners Manual, 2020 International Edition

Corruption — Kickback Schemes

Corruption — Diverting Business to Vendors

Example involving a purchasing agent receiving improper payments to steer business to a vendor

Economic Extortion definition

Illegal Gratuities definition

Detailed Explanation:

Rationale for Correct Answer: Otto’s act combines misappropriation of customer funds with concealment via false accounting entries . Per the Fraud Examiners Manual , concealment through altering records is a hallmark of accounting fraud schemes tied to asset misappropriation.

Analysis of Incorrect Options:

A – Unauthorized disbursement typically refers to fraudulent payments like check tampering, not customer withdrawals.

B – Dormant account fraud targets unused/inactive accounts; the victim here is an active but inattentive customer.

D – Unauthorized withdrawal is part of the theft, but the defining element is the falsified ledger concealment, making C more precise.

Key Concept: Asset misappropriation with concealment through false accounting.

The correct answer is B. Register disbursement schemes usually involve false refunds or false voids that cause cash to be removed from the register while the records appear to justify the disbursement. An unusually high number of refunds on the register log is a red flag because it might indicate that employees are creating fictitious refund transactions to conceal cash theft. Option A is not suspicious by itself because no gaps in transaction numbers suggests record continuity. Option C is less suspicious because supervisory approval exists, although approvals should still be reviewed. Option D is generally a positive control because supporting documents should exist for voided transactions. The ACFE materials identify refund and void activity as key areas for detecting register disbursement schemes.

================

Detailed Explanation:

Rationale for Correct Answer: A high percentage of coding outliers (e.g., using higher-paying diagnosis or procedure codes more often than peers) is a red flag of upcoding or fraudulent billing. This signals possible abuse of reimbursement systems.

Analysis of Incorrect Options:

A – Fewer claims would not suggest fraud.

C – Matching documentation is expected, not suspicious.

D – Low profits may indicate inefficiency, not fraud.

Key Concept: Health care fraud detection through data analytics and coding anomalies.

Detailed Explanation:

Rationale for Correct Answer: Corporate spies do use social engineering, but their primary methods include surveillance, infiltration (e.g., posing as employees), and technical monitoring. The statement in option C is false because searching desks/workstations is a tactic, but it is not the primary method.

Analysis of Incorrect Options:

A – True; fake badges are a common infiltration tactic.

B – True; low-level jobs provide physical access.

D – True; technical surveillance is a recognized method.

Key Concept: Methods of corporate espionage.

Detailed Explanation:

Rationale for Correct Answer: Supplies are recorded as expenses because they are expected to be consumed within one year. Unlike long-lived assets, supplies do not provide benefits beyond the short term and therefore are expensed rather than capitalized.

Analysis of Incorrect Options:

B. Expenses – The accounting treatment, not the category of item.

C. Assets – Supplies are assets when purchased, but they become expenses upon consumption.

D. Equity – Represents ownership interest, unrelated here.

Key Concept: Short-term asset consumption and expense recognition.

Detailed Explanation:

Rationale for Correct Answer: W. Steve Albrecht’s Fraud Scale introduced the relationship between pressure, opportunity, and integrity. He and his colleagues identified 81 red flags or behavioral indicators of occupational fraud and abuse based on these three dimensions. Therefore, the correct answer is A. 81 .

Analysis of Incorrect Options:

B. 82 / C. 83 / D. 84 – Distractors; none match the number identified in the fraud scale research.

Key Concept: Fraud Scale — Red Flags of occupational fraud.

Detailed Explanation:

Rationale for Correct Answer: Corrupt payments are not always made directly in cash. According to the Fraud Examiners Manual (2020) , one common method is disguising them as loans on favorable terms , which provide value to the recipient while appearing legitimate. This is recognized as a form of bribery or illegal gratuity.

Analysis of Incorrect Options:

B. Credit cards – Corrupt payments can be made via many channels, including credit, so this is incorrect.

C. Selling property above market value – Payments are typically disguised by undervaluing sales to recipients, not overvaluing.

D. Promises of favorable treatment – Promises alone can constitute bribery; this statement is false.

Key Concept: Methods of making corrupt payments .

Detailed Explanation:

Rationale for Correct Answer: When a tangible asset is stolen (removed from the books), a debit entry would be missing its corresponding credit, leaving the books out-of-balance . Fraudsters often conceal this imbalance by falsifying entries (e.g., creating fictitious expenses or adjusting asset accounts).

Analysis of Incorrect Options:

A. Journal Entries – Too general; not the condition of the books.

C. False debits – A concealment method, but not the direct result.

D. None of all – Incorrect because “out-of-balance” is accurate.

Key Concept: Concealment of asset theft and impact on accounting records.

Detailed Explanation:

Rationale for Correct Answer: In fictitious revenue schemes , sales are recorded that never occurred. Because no actual customers exist, there will be no late or overdue accounts receivable. The Fraud Examiners Manual (2020) notes that unusually clean receivables aging reports—i.e., no overdue balances—can be a red flag of revenue manipulation.

Analysis of Incorrect Option:

B. False – Incorrect; the absence of overdue receivables is indeed suspicious and aligns with fictitious revenue fraud.

Key Concept: Financial statement fraud red flags — fictitious revenues.

Detailed Explanation:

Rationale for Correct Answer: Ponzi schemes differ from pyramid schemes. In Ponzi schemes, investors are paid returns from funds contributed by later investors, not based on recruiting new investors. Recruiting-based payouts are a characteristic of pyramid schemes , not Ponzi schemes.

Analysis of Incorrect Options:

A. Legitimate investment belief – True; victims believe the investment is genuine.

B. High returns promised – Classic Ponzi hallmark.

D. Minimal valid commerce – Ponzi promoters often fake or exaggerate legitimate investments.

Key Concept: Difference between Ponzi schemes and pyramid schemes .

Detailed Explanation:

Rationale for Correct Answer: Check fraud is prevalent partly because the equipment needed (scanners, printers, software) is relatively inexpensive and widely available , lowering the barrier to entry.

Analysis of Incorrect Options:

A – False; many check fraud perpetrators are never caught.

C – False; penalties are often not severe, and enforcement may be inconsistent.

D – Incorrect, since B is a true statement.

Key Concept: Nature and accessibility of check fraud schemes.

Detailed Explanation:

Rationale for Correct Answer: Biometric authentication (e.g., fingerprint, facial recognition) strengthens payment security by ensuring that only the authorized user can approve transactions, reducing the risk of unauthorized access even if credentials are stolen.

Analysis of Incorrect Options:

A – Using the same credentials increases exposure to credential-stuffing attacks.

C – Disabling biometrics weakens, not strengthens, security.

D – Incorrect since B is valid.

Key Concept: Cyberfraud prevention – authentication and mobile payment controls.

Detailed Explanation:

Rationale for Correct Answer: A kickback scheme occurs when vendors make payments to employees of a purchasing organization in exchange for steering business their way. Here, Bob steered contracts to Oak Company and received a percentage of profits, a textbook kickback arrangement.

Analysis of Incorrect Options:

B. Illegal gratuity scheme – Involves rewards after a decision, without a prior agreement. Here, the agreement was prearranged.

C. Diversion scheme – Refers to diversion of assets, not procurement favoritism.

D. Economic extortion scheme – Involves coercion of the vendor; this was voluntary bribery.

Key Concept: Bribery and kickbacks as forms of corruption.

The red flag is that Fran has made multiple insurance claims in the past. Prior claims history can indicate a pattern of suspicious or repeated losses, especially when a new claim involves valuable property. Receipts and photographs generally support a claim rather than create suspicion by themselves, although they should still be verified for authenticity. Including bulky items in a fire loss claim is not automatically suspicious because fires can destroy many types of property, including large household goods. The ACFE insurance fraud materials identify red flags as indicators requiring further review, not proof of fraud. Fran’s repeated claim history would justify closer examination of the claim details, supporting documentation, timing, policy coverage, and any prior loss patterns.

================

The correct answer is D. Users being denied access to files they normally use is a significant indicator of possible network intrusion. Such denial might result from unauthorized permission changes, malware, ransomware encryption, account compromise, or malicious alteration of access controls. In a professional fraud examination context, this condition should trigger immediate incident-response procedures, including review of system logs, firewall records, router logs, and affected files. Options A and C describe routine security and system maintenance activities. Option B is not inherently suspicious because the country has a legitimate client connection. The ACFE computer and internet fraud materials emphasize that compromised systems should be treated as suspect and reviewed for irregularities and abnormal activity.

================

The correct answer is A because the accounting equation is Assets = Liabilities + Owners’ Equity. If a fraudster removes a liability from the books, total liabilities decrease. To keep the equation balanced without drawing attention to the improper removal, the fraudster could increase another liability account. This offsets the decrease and keeps total liabilities from appearing reduced. Decreasing owners’ equity or creating a fictitious expense would further reduce the right side of the equation and would not conceal the removal in the same way. Increasing an asset would increase the left side, worsening the imbalance unless another entry were also made. The ACFE accounting concepts materials explain that understanding debit-credit relationships and the accounting equation is essential in detecting concealment entries.

Detailed Explanation:

Rationale for Correct Answer: The accounting definition of assets , as cited by Marshall and in GAAP frameworks, is “probable future economic benefits obtained or controlled by a particular entity as a result of past transactions or events.” This definition underlies balance sheet recognition of assets.

Analysis of Incorrect Options:

B. Liabilities – Represent probable future sacrifices, not benefits.

C. Credentials – Irrelevant to financial reporting.

D. None of the above – Incorrect since “assets” directly matches.

Key Concept: Definition of Assets under financial accounting frameworks.

The correct answer is A. Baker used the company’s purchasing function to acquire goods for his personal benefit, making the scheme a personal purchase with company funds. This type of billing scheme occurs when an employee causes the organization to pay for goods or services that are not for legitimate business use. The fact that Baker ordered unnecessary supplies and used them to improve his house shows a personal benefit disguised as a business purchase. A pass-through scheme involves an intermediary company used to resell goods or services at inflated prices. A pay-and-return scheme involves overpaying a vendor and diverting the refund. Theft of inventory is less precise because Baker fraudulently caused the company to purchase the items.

================

The correct answer is A. The income statement reports revenues and expenses for a period, and most companies present net sales or net service revenues as the first line item. Net sales means gross sales reduced by sales returns, allowances, refunds, or discounts. Option B is incorrect because gross profit is generally net sales minus cost of goods sold, not revenues minus operating expenses. Operating expenses are deducted after gross profit to help determine operating income. Option C incorrectly defines net profit; net profit reflects revenues minus all relevant expenses, not merely sales minus cost of goods sold. Option D is also incorrect because gross revenue is before deductions, while net sales are after deductions. The ACFE accounting materials explain these income statement relationships.

================

Detailed Explanation:

Rationale for Correct Answer: Tangible assets are those that can be physically perceived (touched, seen, etc.) and appraised (assigned a measurable value). Examples include buildings, land, equipment, and inventory. Both characteristics are correct, making C the best choice.

Analysis of Incorrect Options:

A. Capable of being perceived – True, but incomplete.

B. Capable of being appraised – True, but incomplete.

D. Neither A nor B – Incorrect since both statements are accurate.

Key Concept: Tangible Assets — physical and measurable property owned by a business.

Detailed Explanation:

Rationale for Correct Answer: Financial statement fraud typically involves overstating assets or revenues (e.g., inflating inventory, recognizing fictitious sales) and understating liabilities or expenses (e.g., hiding obligations, capitalizing expenses). This combination enhances profitability and net worth, misleading stakeholders.

Analysis of Incorrect Options:

A – Understating assets/revenue is rare since fraud usually aims to inflate results.

C – Overstating both assets and liabilities would not improve financial performance.

D – Understating both would reduce reported performance, contrary to typical fraud objectives.

Key Concept: Common patterns in financial statement fraud.

The correct answer is D. Smishing is phishing conducted through SMS or text messages. Margarette sends a fraudulent text that appears to come from Arlo’s doctor’s office and includes a payment link to a fake portal she controls. The purpose is to trick Arlo into entering payment card information, which she then steals. Quishing uses QR codes to direct victims to fraudulent sites. Pharming redirects users from legitimate websites to fraudulent ones, often through technical manipulation of domain name resolution or device settings. Vishing uses voice calls or voicemail to obtain sensitive information. Because the fraudulent communication is a text message and the goal is to steal payment information, the scheme is smishing.

Detailed Explanation:

Rationale for Correct Answer: Larceny by fraud (often termed “theft by deception”) occurs when someone unlawfully obtains another’s property by deception rather than by direct taking. As defined in fraud examination principles, deception can involve: (1) creating or reinforcing a false impression, (2) failing to correct a false impression, or (3) failing to disclose material facts such as liens or adverse claims. Because all three scenarios represent deceptive means to unlawfully take property, the correct answer is D. All of the above .

Analysis of Incorrect Options:

A, B, C each describe valid examples of fraud by deception but individually do not fully capture the concept.

D encompasses the totality of recognized deceptive practices under larceny by fraud.

Key Concept: Fraud by deception as an element of theft and misappropriation.

Detailed Explanation:

Rationale for Correct Answer: Comparing register tape totals to the actual cash on hand is a classic reconciliation test used to detect employee theft . Discrepancies suggest cash has been skimmed or stolen after recording.

Analysis of Incorrect Options:

B. Recorded sales – Register tapes already show recorded sales; comparison is for theft detection.

C. Internal audits – A process, not the purpose of the comparison.

D. Occupational frauds – Too broad a term.

Key Concept: Cash Reconciliation as a control to detect employee theft.

Detailed Explanation:

Rationale for Correct Answer: Conflict of interest cases are difficult to detect because the transactions often appear legitimate on their face. However, they can be prevented more effectively through proactive controls such as disclosure requirements, vendor vetting, and employee training. The Fraud Examiners Manual (2020) emphasizes that prevention mechanisms are more effective than detection when it comes to conflicts of interest.

Analysis of Incorrect Options:

B. False – Incorrect because detection is challenging; prevention is comparatively easier.

Key Concept: Prevention vs. detection in Conflict of Interest schemes .

Detailed Explanation:

Rationale for Correct Answer: Under anti-bribery laws and fraud examination principles, the offer of a payment itself may constitute a bribe, regardless of whether money changes hands. Intent to improperly influence is enough to establish bribery.

Analysis of Incorrect Options:

B. Corruption in payment – Too vague, not a legal element.

C. Kickback payment – Requires an actual payment; not just an offer.

D. Overbilling in payment – A disbursement scheme, not a bribe.

Key Concept: Bribery offense can occur upon the offer alone.

Detailed Explanation:

Rationale for Correct Answer: Smishing (SMS phishing) uses fraudulent text messages to trick victims into clicking malicious links or revealing credentials. This matches Cynthia’s scenario.

Analysis of Incorrect Options:

A. Vishing – Voice phishing by phone call, not text message.

C. Catfishing – Fake online persona in social contexts, not financial fraud via text.

D. Pharming – Redirecting users to fake websites via DNS manipulation, not text messages.

Key Concept: Social engineering methods—email (phishing), phone (vishing), text (smishing).

The correct answer is D. Carl committed electronic payment tampering because he used stolen online banking credentials to create an unauthorized recurring electronic payment. Electronic payment tampering involves manipulating electronic disbursement systems, online banking portals, ACH transactions, wire transfers, or related payment credentials to divert funds. Although Carl uses a disguised bank account, the central misconduct is the unauthorized creation of an electronic payment, not a traditional billing scheme. A diverted revenue scheme concerns incoming receipts rather than outgoing payments. A ghost payee scheme can involve fictitious recipients, but here the best classification is electronic payment tampering because the fraud is executed through the company’s online banking system. The ACFE materials classify electronic payment tampering under fraudulent disbursement schemes.

================

Detailed Explanation:

Rationale for Correct Answer: Skimming is defined as the theft of cash before it is recorded in the books . Because the stolen funds are never entered into the accounting system, this is often referred to as an “off-book” fraud. It is distinct from cash larceny , which occurs after cash has been recorded.

Analysis of Incorrect Options:

B. The addition of cash – Incorrect; skimming involves removal, not addition.

C. Removal after entry – This describes cash larceny, not skimming.

D. None of above – Incorrect since option A is correct.

Key Concept: Skimming schemes — off-book cash theft.

Comprehensive and Detailed Explanation (Based on the ACFE Fraud Examiners Manual – Financial Transactions and Fraud Schemes)

In the Identity Theft chapter of the Financial Transactions and Fraud Schemes section, the ACFE Manual explains that there are two primary methods of committing identity theft :

Traditional identity theft

Synthetic identity theft

These are listed under “Methods of Committing Identity Theft” (1.803) , immediately followed by “Types of Identity Theft Schemes” (1.804) such as financial identity theft and criminal identity theft.

1. Why the correct answer is Traditional identity theft (Option B)

In traditional identity theft , the perpetrator uses the real, complete identity of another person—such as their name, government identification number, and birthdate —to impersonate that person for fraudulent purposes. This is exactly what is happening in the question:

The fraudster uses a real victim’s name, government identification number, and birthdate to open a credit card account in the victim’s name.

This matches the Manual’s categorization where traditional identity theft involves misuse of actual personal identifying information (PII) belonging to a real individual, rather than fabricating an identity. The Manual then explains that this stolen identity is often used in financial schemes , such as obtaining credit cards, loans, or other financial benefits, which falls under financial identity theft as a type of identity theft scheme.

So, in ACFE terms, the method is traditional identity theft , and the scheme type is financial identity theft (using another person’s identity to obtain credit or other financial benefits).

2. Why the other options are incorrect

Option A – New account identity theft

“New account identity theft” is a descriptive phrase sometimes used in practice to describe opening new credit accounts in another person’s name, but the ACFE Manual’s formal categorization focuses on:

Methods of committing identity theft:

Traditional identity theft

Synthetic identity theft

Types of identity theft schemes:

Financial identity theft

Criminal identity theft

Medical identity theft

Insurance identity theft

Tax identity theft

Employment identity theft

Business identity theft

“New account identity theft” is not one of the defined method categories in the Manual; the described conduct is captured under traditional identity theft (method) and financial identity theft (scheme type). Therefore, this option does not align with the ACFE’s terminology tested on the CFE exam.

Option C – Synthetic identity theft

The Manual distinguishes synthetic identity theft as a different method. Under “Methods of Committing Identity Theft” (1.803) , it explains that synthetic identity theft involves combining real elements of identity (for example, a genuine government identification number) with fabricated or unrelated information (such as a made-up name, date of birth, or address) to create a partly fictitious identity .

In the question, the fraudster is not creating a hybrid or composite identity. They are using all of the real victim’s identifying information (name, government ID number, birthdate) and posing directly as that person. That is traditional , not synthetic.

Option D – Criminal identity theft

Under “Types of Identity Theft Schemes” (1.804–1.805) , the Manual describes criminal identity theft as a scheme where a fraudster gives someone else’s identifying information to law enforcement or in criminal justice contexts , so that the victim’s identity is attached to the criminal record or charges .

Typical examples include:

Giving another person’s name and identification details when stopped or arrested

Causing warrants or criminal records to be issued in the victim’s name

In the question scenario, the fraudster is not interacting with law enforcement or shifting criminal records to the victim. Instead, they are opening a credit card account , which is a financial use of the stolen identity. Therefore, it fits financial identity theft as a scheme type, but traditional identity theft as the method.

Detailed Explanation:

Rationale for Correct Answer: Properly shredded documents using a cross-cut shredder are very difficult to reconstruct, making them not a common medium for information leaks. By contrast, shareholder reports, executive speeches, and workstation displays often contain sensitive data that can be exploited by competitors or fraudsters.

Analysis of Incorrect Options:

A – Shareholder reports can reveal strategy and financial vulnerabilities.

C – Executive speeches sometimes unintentionally disclose sensitive plans.

D – Information left visible at workstations is a known security risk.

Key Concept: Protection of proprietary information against espionage and fraud.

The correct answer is D. The balance sheet is based on the fundamental accounting equation: Assets = Liabilities + Owners’ Equity. Assets represent resources owned or controlled by the entity. Liabilities represent obligations owed to creditors, while owners’ equity represents the owners’ residual interest after liabilities are deducted from assets. Because every accounting transaction affects at least two accounts, the equation must remain in balance. Revenues, expenses, cost of goods sold, and gross profit are primarily income statement elements, not the two main components that balance against assets on the statement of financial position. Understanding this equation is essential for fraud examiners because improper entries, concealed liabilities, overstated assets, and equity manipulation can distort financial statements.

================

Detailed Explanation:

Rationale for Correct Answer: Illegal pyramid schemes rely on continual recruitment of new members. Early participants are paid from the investments of later recruits, meaning later participants almost always lose money. This matches option B.

Analysis of Incorrect Options:

A – Not true; pyramid-shaped hierarchies exist in legitimate organizations.

C – The goal isn’t product sales but rather recruitment; products, if present, are often incidental.

D – Incorrect because B is true.

Key Concept: Ponzi and pyramid schemes – payment to early investors with later investors’ funds.

The correct answer is A. The facts indicate a possible nonconforming goods scheme, in which a vendor provides goods that fail to meet contract specifications while charging as though compliant goods were supplied. The most effective detection measure before customer complaints would have been an inspection of the glass upon receipt, including its packaging, appearance, description, and conformity with the contract. This control helps identify substitutions, inferior materials, counterfeit goods, or products of lower quality than promised. Option B is indirect and less reliable than inspecting the goods. Option C relates to change order abuse rather than quality substitution. Option D focuses on the vendor’s internal cost data and would not directly confirm whether the delivered glass met CTR’s contract specifications.

Detailed Explanation:

Rationale for Correct Answer: One of the strongest internal controls against fraudulent billing schemes (such as shell companies, inflated invoices, and kickbacks) is to require competitive bidding . This ensures transparency, reduces favoritism, and makes it harder for employees and vendors to collude.

Analysis of Incorrect Options:

A – Fraud tips are valuable, but routing them only through supervisors may suppress reporting; hotlines are more effective.

B – Combining purchasing and payment increases fraud risk by reducing segregation of duties.

D – Outsourcing negotiations does not directly prevent billing fraud.

Key Concept: Internal controls and segregation of duties in preventing billing schemes.

Detailed Explanation:

Rationale for Correct Answer: The journal is the core of the bookkeeping system because it provides a chronological record of all business transactions. Each transaction is recorded as a journal entry before posting to the ledger.

Analysis of Incorrect Options:

A. Asset – A resource, not a recording system.

B. Liability – An obligation, not the recording medium.

C. Checkbook – Tracks cash disbursements, but not all transactions.

Key Concept: Journal as the primary book of original entry.

Detailed Explanation:

Rationale for Correct Answer: While asset misappropriation schemes are usually committed by lower-level employees, financial statement fraud is most often committed by senior management . This is because executives have the authority to override controls, direct accounting policies, and influence financial reporting for personal gain (bonuses, stock prices, or to conceal poor performance).

Analysis of Incorrect Options:

A. Organized criminals – May commit fraud, but financial statement fraud specifically requires authority over reporting.

B. Mid and lower-level employees – Lack sufficient authority to materially alter financial statements.

D. All of the above – Incorrect, as financial statement fraud is overwhelmingly associated with senior management.

Key Concept: Management override — financial statement fraud perpetrated by those with the authority to manipulate reports.

Detailed Explanation:

Rationale for Correct Answer: Accrual basis accounting requires revenues and related expenses to be recorded in the same accounting period. This is known as the matching principle , ensuring accurate measurement of income.

Analysis of Incorrect Options:

A. Equity – Not relevant to matching expenses.

C. Expense – A category of cost, not a principle.

D. Financial record – Too general.

Key Concept: Accrual Accounting & Matching Principle .

The correct answer is B. A request to send payment to a country different from where the third party conducts business is a significant red flag in corruption and bribery schemes. Such payment instructions can indicate attempts to conceal beneficial ownership, route funds through offshore accounts, disguise improper commissions, or make corrupt payments difficult to trace. Option A is not necessarily suspicious because many legitimate vendors use one business address and phone number. Option C can reflect legitimate competitive strength if the vendor truly provides superior services. Option D is also not inherently suspicious because lower prices may result from efficiency or market strategy. Fraud examiners should treat unusual third-party payment destinations as high-risk indicators requiring enhanced due diligence and documentation review.

================

Detailed Explanation:

Rationale for Correct Answer: Economic extortion occurs when someone demands payment or benefit under threat of harm (explicit or implicit). A government official demanding money in exchange for awarding a contract is classic extortion.

Analysis of Incorrect Options:

A – This is a billing scheme (fraudulent disbursement), not extortion.

C – This is a kickback scheme (corruption).

D – This is an illegal gratuity scheme (reward after action).

Key Concept: Types of corruption—extortion vs. bribery vs. gratuities.

The correct answer is C. The business owner is committing a falsified tax deduction scheme by fraudulently inflating production costs to reduce taxable income. Deductions are legitimate only when they accurately reflect allowable expenses. Here, the owner paid the supplier to alter the receipt so that the company appears to have incurred a higher deductible cost than it actually did. This false documentation reduces reported taxable income and therefore lowers the tax liability improperly. Option A is incorrect because the facts do not involve excise taxes on a specific class of goods. Option B is incorrect because the owner is not omitting income; they are overstating expenses. Option D is not applicable because the scheme involves deductions, not tax credits.

================

Option A describes a card skimming or shimming scheme. Skimming involves using a hidden device to capture payment card information, often from a magnetic stripe, while shimming commonly involves a device inserted into a card reader to capture chip-card data. A small camera can also be used to record PIN entry. Automated teller machines and point-of-sale terminals are common targets because customers insert or swipe cards and enter authentication data. Option B involves theft or sale of card information but not skimming or shimming through a reader. Option C describes physical card theft or retention. Option D does not clearly show capture of card credentials. The ACFE material discusses ATM fraud, including skimming and shimming, as financial institution fraud risks.

================

Detailed Explanation:

Rationale for Correct Answer: Insurer health care fraud occurs when the insurance company itself engages in deception for financial gain. Submitting inflated cost data to regulators in order to justify rate increases is a direct example of insurer fraud.

Analysis of Incorrect Options:

A. Intermediary verifying claims – Proper procedure, not fraud.

C. Passing on negotiated rates – Legitimate practice.

D. Denying incomplete claims – May be harsh, but not fraudulent.

Key Concept: Insurer fraud vs. provider or claimant fraud .

Detailed Explanation:

Rationale for Correct Answer: The correct answer is A. Fiduciary Capacity . According to the Fraud Examiners Manual (2020 International Edition) , a fiduciary relationship exists when a person is entrusted with the property or affairs of another and is obligated to act in the best interest of that person, rather than for their own benefit. Fiduciary capacity is a key legal concept in fraud examinations, particularly in cases involving breaches of trust, embezzlement, or misappropriation.

Analysis of Incorrect Options (Distractors):

B. Embezzlement – Embezzlement is the wrongful appropriation of assets by a person entrusted with them. While it often arises from a fiduciary relationship, it describes the act of theft , not the capacity in which the person acts.

C. Conversion – Conversion refers to the unauthorized use or control over another’s property, a civil wrong, but it does not describe the relationship of acting on another’s behalf.

D. None of the above – Incorrect, since “fiduciary capacity” directly fits the definition in the question.

Key Concept: Understanding fiduciary duty and fiduciary capacity , which form the legal foundation for identifying when a person has a duty to act on behalf of another, often forming the basis for fraud-related legal claims.

Detailed Explanation:

Rationale for Correct Answer: The phases of the bidding process include:

Presolicitation (need recognition/specification stage),

Solicitation (inviting bids),

Submission (vendors submit bids). There is no standard phase called Postsolicitation .

Analysis of Incorrect Options:

A. Presolicitation – Valid phase.

C. Solicitation – Valid phase.

D. Submission – Valid phase.

B. Postsolicitation – Not recognized as a formal bidding stage.

Key Concept: Bidding process phases — presolicitation, solicitation, submission.

Detailed Explanation:

Rationale for Correct Answer: Weak or poor collection and recording procedures create opportunities for employees to skim. Without strong controls over cash receipts and documentation, employees can divert funds without detection.

Analysis of Incorrect Options:

A. Revenue sources and recording procedures – Too general; it is weak procedures that matter.

C. Internal audits and recording procedures – Audits help detect fraud, not enable it.

D. Register manipulations and recording procedures – Describes concealment, not the root cause.

Key Concept: Control weaknesses enable skimming.

Detailed Explanation:

Rationale for Correct Answer: The Asset Turnover Ratio measures how efficiently a company uses its assets to generate revenue. It is calculated as Net Sales ÷ Average Total Assets . Higher ratios indicate better efficiency.

Analysis of Incorrect Options:

A. Quick ratio – Liquidity ratio, not asset efficiency.

B. Receivable turnover ratio – Measures efficiency in collecting receivables, not overall asset use.

C. Debt-to-equity ratio – Capital structure metric, not efficiency.

Key Concept: Financial ratio analysis — asset utilization efficiency .

The correct answer is D. Technical surveillance involves using electronic or technical means to collect information that is not available through open sources, including nondocumentary information such as conversations, signals, or communications. This is a recognized method of corporate espionage when used to obtain proprietary or confidential business information. Option A is too narrow and inaccurate because social engineering manipulates people into revealing information or providing access, not primarily desk-file searches. Option B misstates physical infiltration; physical entry can give access to premises, documents, or devices, but exploiting firewalls is a technical attack. Option C incorrectly defines pretexting; pretexting involves using a false identity or fabricated reason to obtain information. Corporate espionage must be distinguished from lawful competitive intelligence.

================

The correct answer is B. Skimming involves stealing cash before it is recorded in the organization’s accounting system. Separating the duties of collecting cash and accessing or posting to the accounts receivable journal is an effective preventive control because it prevents one employee from both taking funds and manipulating records to conceal the theft. Job rotation can help, but it is less direct. Comparing sales records to cash received and reviewing deposit timing are more detective than preventive in nature. The strongest control is segregation of duties between custody of cash and recordkeeping authority. The ACFE cash receipts materials emphasize receipt-level controls, general controls, and separation of duties as primary measures for preventing skimming schemes.

================

Detailed Explanation:

Rationale for Correct Answer: Expense reimbursement schemes are a common type of fraudulent disbursement. Requiring employees to submit receipts electronically improves controls by ensuring legibility, reducing the chance of altered or duplicate submissions, and creating a digital audit trail. This measure is recommended in the Fraud Examiners Manual as part of strengthening internal controls over reimbursement processes.

Analysis of Incorrect Option:

B. False – Incorrect because electronic receipt submission is indeed a recognized anti-fraud measure.

Key Concept: Fraudulent disbursements prevention through documentation controls.

Detailed Explanation:

Rationale for Correct Answer: Synthetic identity theft occurs when fraudsters combine real identifiers (e.g., SSN, tax ID) with fictitious details to create a “new” identity. This differs from traditional identity theft, where a real person’s identity is used in full.

Analysis of Incorrect Options:

B. Simulated identity theft – Not a standard fraud classification.

C. Traditional identity theft – Uses a complete stolen identity, not a hybrid.

D. Criminal identity theft – Involves using someone else’s identity when charged with a crime.

Key Concept: Synthetic identity theft as an evolving form of fraud.

The correct answer is D. A fraudulent conveyance occurs when a debtor transfers property to another party, often an insider or related party, for little or no consideration before or during insolvency to place assets beyond the reach of creditors. Brad’s transfer of valuable marble slabs to his son’s construction business at no charge shortly before bankruptcy is a strong indicator of such a scheme. Option A, concealed transfer, is less precise because the key issue is not merely hiding a transfer but transferring assets for inadequate value to impair creditors. Option B is overly broad and does not identify the scheme type. Option C, planned bustout, usually involves obtaining goods or credit with the intent to dispose of assets and then file bankruptcy.

================

The correct answer is B. ACH blocks are a preventive bank control that allows an account holder to instruct the bank not to permit ACH debits from designated accounts. This reduces the risk of unauthorized electronic withdrawals. Option A is incorrect because positive pay for ACH should not be declined; it can help verify ACH transactions before they clear. Option C violates segregation of duties because the person initiating electronic payments should not also control ACH filters or payment security settings. Option D is also weak because using separate accounts for paper checks and electronic transactions can improve monitoring and limit exposure. The ACFE materials identify ACH blocks, ACH filters, positive pay, segregation of duties, and bank security services as important controls against electronic payment tampering.

================

The correct answer is C. Change order abuse occurs after a contract has been awarded, when a contractor improperly increases the price, expands the work, or modifies contract terms through change orders. A corrupt contractor might submit a low bid to win the award and later recover profits through unnecessary or inflated change orders. This defeats the benefit of competitive bidding because the procuring entity no longer receives the price or terms that justified the original award. Option A is incorrect because the scheme usually increases, not decreases, the amount paid. Option B is too narrow because change order abuse can occur in competitive contracts. Option D is incorrect because the scheme often involves collusion between contractor and procurement personnel, not necessarily several contractors.

================

Detailed Explanation:

Rationale for Correct Answer: In the procurement cycle, the post-award and administration phase involves the actual performance of contractual duties by the awarded contractor(s) and monitoring by the procuring entity. This is consistent with procurement process descriptions in the Fraud Examiners Manual (2020) .

Analysis of Incorrect Options:

B – Needs identification occurs in the presolicitation phase , not solicitation.

C – In presolicitation, the entity defines needs; contractors submit bids during the solicitation phase.

D – The solicitation document is issued during the solicitation phase , not evaluation.

Key Concept: Understanding procurement phases to detect fraud opportunities (e.g., bid rigging, kickbacks).

The correct answer is B. A Ponzi scheme is a fraudulent investment arrangement in which funds from new investors are used to make payments to earlier investors. The payments create an appearance that the investment is legitimate and profitable, even though little or no genuine business activity or investment return exists. This artificial success helps the promoter attract more investors and delay detection. Option A describes a characteristic more closely associated with pyramid schemes, where compensation depends heavily on recruiting participants. Option C is incomplete because Ponzi schemes usually promise high returns with low or no stated risk, not openly high-risk investments. Option D also reflects pyramid-style recruitment structures rather than the defining feature of a Ponzi scheme.

================

Detailed Explanation:

Rationale for Correct Answer: The statement is false . Cressey’s fraud triangle and Albrecht’s fraud scale both emphasize that fraud is more likely when pressures are high, opportunities are present, and integrity is low . Conversely, when pressure and opportunity are low and integrity is high, the likelihood of fraud is greatly reduced.

Analysis of Incorrect Options:

A. True – Incorrect, it directly contradicts the fraud triangle and fraud scale models.

B. False – Correct, because under the conditions stated, fraud occurrence is less likely.

Key Concept: Fraud Scale Variables — Pressure, Opportunity, Integrity.

Detailed Explanation:

Rationale for Correct Answer: Card skimming/shimming occurs when a fraudster captures payment card data with a hidden device. In this case, the employee secretly scans the customer’s card with a small device — a textbook example of skimming.

Analysis of Incorrect Options:

A. Server keeps the card – This is theft of the card, not skimming.

B. Imitation website – This is phishing , not skimming.

D. None of the above – Incorrect since option C is correct.

Key Concept: Payment card fraud — skimming/shimming devices.

The correct answer is C. Management can make profits appear stronger by concealing liabilities and expenses, including warranty costs. Warranty obligations arise when a company is likely to incur future costs related to products already sold. If management fails to record or disclose those expected costs, expenses and liabilities are understated, while net income and financial position appear better than reality. Overstating expenses and understating revenue would reduce, not strengthen, reported profits. Fabricating product-return liabilities would also reduce income because it creates an additional liability or expense. The ACFE financial statement fraud materials identify concealed liabilities and expenses, including unrecorded or undisclosed warranty costs and product-return liabilities, as schemes used to overstate financial performance.

================

Detailed Explanation:

Rationale for Correct Answer: Employees involved in bribery or corruption schemes often exhibit lifestyle red flags such as gambling habits, drug/alcohol addiction, or extravagant spending . These behaviors create financial pressures that may motivate or result from corrupt activity.

Analysis of Incorrect Options:

A, B, C individually – Each is a red flag, but the most accurate answer is all of the above .

Key Concept: Behavioral red flags in corruption cases.

The correct answer is B. A conflict of interest occurs when an employee has an undisclosed personal, financial, or family interest that could influence decisions made on behalf of the employer. Cindy purchases supplies from a company owned by her aunt and does not disclose the relationship. This creates at least a potential conflict because Cindy’s family connection could cause her to favor the vendor over her employer’s best interests. Options A and D involve relationships or financial interests, but they have been disclosed to the employer, allowing the organization to evaluate and approve or manage the conflict. Option C might create employment or scheduling concerns, but it does not establish a conflict in a purchasing or transactional decision. Disclosure is central to proper conflict management.

================

Detailed Explanation:

Rationale for Correct Answer: Deliberate writing of vague specifications is a type of corruption scheme where an employee intentionally drafts unclear requirements. This forces later amendments, which can be manipulated to favor a particular vendor.

Analysis of Incorrect Options:

B. Need recognition – Involves unnecessary purchases, not vague specifications.

C. False specification – General but not precise; “vague specifications” is the correct technical term.

D. Bid-splitting – Breaking contracts into smaller amounts to avoid approval controls, not related to vague specs.

Key Concept: Specification schemes in procurement corruption.