CFE-Fraud-Schemes-and-Financial-Crimes Certified Fraud Examiner -Fraud Schemes and Financial Crimes Questions and Answers

Detailed Explanation:

Rationale for Correct Answer: The conservatism principle in accounting means that financial statements should not overstate assets or income and should anticipate possible losses. Thus, the amounts shown should be at least as much as reflected, if not more. This ensures users are not misled by overly optimistic figures.

Analysis of Incorrect Options:

A. Fraudulent statement – Involves intentional misrepresentation, not a principle of accounting.

B. Misappropriations – Theft of assets, unrelated to valuation principles.

D. Matching – Refers to aligning expenses with related revenues, not conservatism.

Key Concept: Conservatism principle — caution in financial reporting.

Detailed Explanation:

Rationale for Correct Answer: Biometric authentication (e.g., fingerprint, facial recognition) strengthens payment security by ensuring that only the authorized user can approve transactions, reducing the risk of unauthorized access even if credentials are stolen.

Analysis of Incorrect Options:

A – Using the same credentials increases exposure to credential-stuffing attacks.

C – Disabling biometrics weakens, not strengthens, security.

D – Incorrect since B is valid.

Key Concept: Cyberfraud prevention – authentication and mobile payment controls.

The correct answer is B. Horizontal analysis compares financial statement amounts across accounting periods and focuses on changes over time. Fraud examiners use it to identify unusual increases, decreases, or trends in individual line items, such as revenue, expenses, inventory, accounts receivable, or liabilities. Option C describes ratio analysis, which measures relationships between different financial statement amounts. Option D describes vertical analysis, which expresses financial statement items as percentages of a base amount, such as total assets or net sales. Option A is unrelated. In financial statement fraud detection, horizontal analysis helps reveal abnormal trends that might indicate improper revenue recognition, concealed liabilities, manipulated expenses, or other misstatements requiring further investigation.

================

Detailed Explanation:

Rationale for Correct Answer: Bid tailoring occurs when procurement officials structure contract requirements to unfairly favor a particular vendor. A hallmark red flag is unusually narrow specifications , which restrict competition.

Analysis of Incorrect Options:

A. Clear submission information – Standard and appropriate, not a red flag.

C. Rebid contracts – Could indicate limited interest, but not tailoring.

D. Numerous bidders – Indicates competition, opposite of bid tailoring.

Key Concept: Procurement fraud — bid tailoring .

Detailed Explanation:

Rationale for Correct Answer: Financial statement fraud typically involves overstating assets or revenues (e.g., inflating inventory, recognizing fictitious sales) and understating liabilities or expenses (e.g., hiding obligations, capitalizing expenses). This combination enhances profitability and net worth, misleading stakeholders.

Analysis of Incorrect Options:

A – Understating assets/revenue is rare since fraud usually aims to inflate results.

C – Overstating both assets and liabilities would not improve financial performance.

D – Understating both would reduce reported performance, contrary to typical fraud objectives.

Key Concept: Common patterns in financial statement fraud.

The correct answer is A. Fictitious revenue schemes involve recording sales that did not actually occur. Because no real customer owes money for the fake sale, the related accounts receivable often remain unpaid and become long overdue. A rising amount of old or uncollectible receivables can therefore be a red flag that revenue was fabricated to inflate income. Option B is less direct because companies might fail to write off bad receivables for several reasons, including improper allowance estimates. Option C is inconsistent with many fictitious revenue schemes because fake credit sales commonly increase receivables. Option D, receivables paid only a few days late, does not strongly indicate fictitious sales. The ACFE materials identify fictitious revenues and accounts receivable anomalies as common financial statement fraud indicators.

================

The correct answer is D. A logic bomb is malicious code hidden in a legitimate program that activates when specific conditions are met, such as a date, event, user action, or system change. Option A incorrectly describes a trapdoor; a trapdoor or backdoor is a hidden entry point that allows access while bypassing normal security controls. Option B describes a keylogger, not an infostealer. Option C describes a trapdoor or backdoor, not a botnet. A botnet is a network of compromised computers controlled by an attacker. The ACFE computer and internet fraud materials classify viruses, worms, Trojan horses, trapdoors, logic bombs, keyloggers, botnets, and other tools as important malware-related cyberfraud concepts.

================

Detailed Explanation:

Rationale for Correct Answer: Expenses appear on the income statement , not the balance sheet. The balance sheet includes assets, liabilities, and owners’ equity, representing the accounting equation.

Analysis of Incorrect Options:

A, B, D – All appear on the balance sheet.

Key Concept: Distinction between financial statements: balance sheet vs. income statement.

Rationale for Correct Answer: Fraud investigations can be highly costly to organizations. The process often involves external forensic examiners, legal proceedings, employee time, and disruption of operations. While necessary, investigations represent a significant resource commitment in terms of both time and financial cost.

Key Concept: Fraud Investigation Costs — deterrence vs. response strategies.

Detailed Explanation:

Rationale for Correct Answer: When a tangible asset is stolen (removed from the books), a debit entry would be missing its corresponding credit, leaving the books out-of-balance . Fraudsters often conceal this imbalance by falsifying entries (e.g., creating fictitious expenses or adjusting asset accounts).

Analysis of Incorrect Options:

A. Journal Entries – Too general; not the condition of the books.

C. False debits – A concealment method, but not the direct result.

D. None of all – Incorrect because “out-of-balance” is accurate.

Key Concept: Concealment of asset theft and impact on accounting records.

Detailed Explanation:

Rationale for Correct Answer: Bribes to purchasing employees often aim to:

Ensure late bids are accepted,

Extend deadlines unfairly,

Or falsify bid logs. Bid-splitting , however, is a scheme performed to avoid approval thresholds and does not require bribery of purchasing employees.

Analysis of Incorrect Options:

A. Receipt of late bid – Real reason to bribe.

B. Extend opening date – Real reason to bribe.

D. Falsify bid log – Real reason to bribe.

C. Ensure bid-splitting – Not a bribery motivation.

Key Concept: Bribery motivations in procurement fraud.

Henrietta is engaging in a need recognition scheme. Procurement begins when the organization identifies a need for goods or services. In a fraudulent need recognition scheme, an employee creates, exaggerates, or falsely justifies a need so the organization will purchase unnecessary goods or services from a favored vendor. Henrietta fabricates beetle sightings to convince management that specialized pest control services are required. Her receipt of money from the contractor shows corrupt motivation and vendor collusion. This is not bid tailoring because the facts do not involve drafting specifications to favor a bidder. It is not nonconforming services because the issue is the false need, not defective performance. It is not bid manipulation because the bidding process itself is not the main misconduct.

================

Detailed Explanation:

Rationale for Correct Answer: Expense reimbursement schemes are a common type of fraudulent disbursement. Requiring employees to submit receipts electronically improves controls by ensuring legibility, reducing the chance of altered or duplicate submissions, and creating a digital audit trail. This measure is recommended in the Fraud Examiners Manual as part of strengthening internal controls over reimbursement processes.

Analysis of Incorrect Option:

B. False – Incorrect because electronic receipt submission is indeed a recognized anti-fraud measure.

Key Concept: Fraudulent disbursements prevention through documentation controls.

Detailed Explanation:

Rationale for Correct Answer: Accruals represent expenses that have been incurred but not yet paid. Under the accrual basis of accounting, these must be recognized in the same period as the related revenues or obligations. Common examples include accrued wages and accrued interest.

Analysis of Incorrect Options:

B. Depreciations – Allocation of asset cost, not unpaid expenses.

C. Expenses – A broader term, but not specific to unpaid obligations.

D. Financial record – Too vague.

Key Concept: Accruals under the accrual basis of accounting.

Detailed Explanation:

Rationale for Correct Answer: According to the ACFE Fraud Tree , corruption is divided into four classifications: bribery, illegal gratuities, economic extortion, and conflicts of interest . These cover the major ways employees misuse influence for personal gain.

Analysis of Incorrect Options:

B. Corruption… – Redundant; corruption is the main category, not a sub-classification.

C. Overbilling and bid-rigging – These are disbursement schemes, not corruption categories.

D. Corruption repeated – Incorrect for the same reason as option B.

Key Concept: Corruption classifications under the Fraud Tree.

Detailed Explanation:

Rationale for Correct Answer: Conflict of interest schemes occur when an employee, manager, or agent has an undisclosed personal interest in a transaction that is adverse to their employer. The Fraud Examiners Manual (2020) notes that one of the most common forms is when an employee has a hidden ownership or financial interest in a vendor that does business with the company. This compromises objectivity and creates self-dealing risks.

Analysis of Incorrect Options:

B. Salesman interest – Too narrow and not representative of the standard conflict scheme definition.

C. Purchaser interest – Purchasers are often involved, but the broader definition encompasses all employees.

D. Dealer interest – “Dealership interest” is not a recognized ACFE fraud scheme classification.

Key Concept: Conflict of Interest scheme under Corruption .

Detailed Explanation:

Rationale for Correct Answer: Bribery prevention policies often include:

Reporting gifts (disclosure of items received from vendors),

Discounts (rules about vendor concessions),

Business meetings (clear rules on vendor-sponsored events). Resource diversions is not a standard bribery prevention policy but a form of fraud.

Analysis of Incorrect Options:

A, B, C – Legitimate examples of prevention policies.

D. Resource diversions – Not a preventive measure.

Key Concept: Anti-bribery policies — clear rules on gifts, discounts, and vendor relationships.

The correct answer is C. Government and public sector organizations might need to conduct and respond to fraud risk assessments more frequently because their risks can change with political priorities, public programs, emergency funding, legislative mandates, and changing public expectations. Public entities are accountable to citizens, regulators, oversight bodies, and funding authorities. Option A is incorrect because the absence of shareholders does not permit higher fraud tolerance; public stewardship often requires strong accountability. Option B is inaccurate because public sector priorities can shift quickly based on laws, budgets, and government initiatives. Option D is also incorrect because public organizations usually have less autonomy than private entities due to statutory requirements, public scrutiny, procurement rules, and oversight obligations. Fraud risk assessment should therefore be dynamic and responsive.

================

Detailed Explanation:

Rationale for Correct Answer: This statement is False . Research in occupational fraud consistently shows that when employees believe there is a strong likelihood of being caught, they are less likely to engage in theft or deviant behavior. Deterrence theory emphasizes that perceived certainty of detection is one of the most effective controls against occupational fraud.

Key Concept: Deterrence through perceived detection .

The correct answer is C. Collectibles fraud often involves misrepresenting authenticity, rarity, condition, provenance, or value of items such as rare books, art, coins, stamps, or memorabilia. A professional appraisal before purchase is the strongest option because it provides independent evaluation of authenticity and value. A dealer’s social media presence does not prove legitimacy. A list of prior sales might be fabricated or unverifiable. A dealer’s description of condition is useful but still comes from the seller and might be biased or false. The ACFE consumer fraud materials identify art and rare-item schemes as consumer fraud risks, and independent verification is an important safeguard before paying for expensive collectibles.

================

The correct answer is C. A Trojan horse is malware that appears to be legitimate, useful, or harmless software but contains hidden malicious code. Once installed or executed, it can damage systems, steal information, create unauthorized access, or perform other harmful actions. Option A describes ransomware, not a worm; ransomware restricts access to systems or files and demands payment. A worm is self-replicating malware that spreads across networks. Option B describes adware more closely than spyware. Spyware secretly monitors and reports user activity or information. Option D also describes spyware rather than ransomware. Professionally, the key distinction is the malware’s function: concealment and deception for Trojan horses, self-replication for worms, surveillance for spyware, and restriction or encryption for ransomware.

================

The correct answer is D. Carl committed electronic payment tampering because he used stolen online banking credentials to create an unauthorized recurring electronic payment. Electronic payment tampering involves manipulating electronic disbursement systems, online banking portals, ACH transactions, wire transfers, or related payment credentials to divert funds. Although Carl uses a disguised bank account, the central misconduct is the unauthorized creation of an electronic payment, not a traditional billing scheme. A diverted revenue scheme concerns incoming receipts rather than outgoing payments. A ghost payee scheme can involve fictitious recipients, but here the best classification is electronic payment tampering because the fraud is executed through the company’s online banking system. The ACFE materials classify electronic payment tampering under fraudulent disbursement schemes.

================

Jay committed a purchasing and receiving scheme because the theft occurred during the receiving process and was concealed by falsifying receiving documentation. In this type of inventory misappropriation, an employee involved in receiving goods can steal part of an incoming shipment and manipulate records so the shortage is not detected. The ACFE material identifies purchasing and receiving schemes, falsifying incoming shipments, and altered inventory records as inventory theft methods. This is not a false sale because no fictitious customer sale is created. It is not a register disbursement scheme because no refund, void, or cash register transaction is involved. It is also not skimming because no unrecorded cash receipt is stolen.

================

The ACFE Fraud Examiners Manual classifies this type of conduct under Insurance Fraud → Vehicle Insurance Schemes , and it specifically lists Past Posting as a recognized vehicle insurance fraud scheme.

In this question, Ron’s vehicle was damaged before he obtained the additional coverage, but he later submitted the claim as though the damage happened after the new coverage became effective. That is the essence of past posting : attempting to obtain insurance benefits for a loss that occurred before coverage applied , while misrepresenting the time of the loss. This matches the scenario exactly.

Why the other options are incorrect

A. Ditching

The Manual lists Ditching as a separate vehicle insurance scheme. It does not describe the act of misrepresenting the timing of a preexisting loss after increasing coverage.

B. Bait and wait

This is not the insurance-fraud classification that fits the facts given. The fraud here depends on claiming an earlier loss as a later covered loss , which is the Manual’s past posting category.

D. Double dipping

Double dipping generally refers to obtaining duplicate recovery for the same loss from multiple sources, which is not what Ron is doing here. The issue is the false date of loss , not duplicate reimbursement.

References

ACFE Fraud Examiners Manual, 2020 International Edition

Insurance Fraud — Vehicle Insurance Schemes — Past Posting

The correct answer is D. Bid tailoring occurs when procurement specifications are drafted to favor a particular contractor or to allow an otherwise unsuitable contractor to qualify. The ACFE material identifies overly broad specifications as one form of bid tailoring because they can be designed to include a favored vendor even though the vendor does not meet the organization’s actual operational needs. Bid splitting involves dividing purchases to avoid competitive thresholds. Bid suppression involves preventing or discouraging competitors from submitting bids. Bid manipulation is broader, but the facts specifically focus on drafting specifications in a way that favors the winning contractor. Therefore, bid tailoring is the most precise classification for Hondo’s finding.

================

Detailed Explanation:

Rationale for Correct Answer: Ponzi schemes differ from pyramid schemes. In Ponzi schemes, investors are paid returns from funds contributed by later investors, not based on recruiting new investors. Recruiting-based payouts are a characteristic of pyramid schemes , not Ponzi schemes.

Analysis of Incorrect Options:

A. Legitimate investment belief – True; victims believe the investment is genuine.

B. High returns promised – Classic Ponzi hallmark.

D. Minimal valid commerce – Ponzi promoters often fake or exaggerate legitimate investments.

Key Concept: Difference between Ponzi schemes and pyramid schemes .

The correct answer is A. Oona’s conduct is a multiple expense reimbursement scheme because she is attempting to obtain reimbursement for an expense that the company has already paid through the company credit card. In expense reimbursement fraud, multiple reimbursement schemes occur when an employee submits the same expense more than once, or submits an expense paid through one channel as though it was paid personally. This differs from a mischaracterized expense, where a personal cost is falsely described as business-related. It also differs from an overstated expense, where the amount is inflated, and from a fictitious expense, where no expense occurred. The key issue is duplicate recovery of the same lunch expense.

================

Why the correct answer is Human Intelligence

The ACFE Fraud Examiners Manual , in the section on fraud examination tools and intelligence gathering , discusses methods of obtaining information from individuals. One of the recognized methods is Human Intelligence (HUMINT) .

The Manual explains that human intelligence gathering involves:

Collecting information directly from people—often through conversation, elicitation, or interviews—sometimes while using a pretext to encourage the target to disclose information.

In this scenario:

Georgina poses as a customer (a pretext),

Contacts an employee of ERO Corp., and

Elicits sensitive information directly from that individual.

This aligns perfectly with the definition of human intelligence gathering —information obtained directly from human sources , often under false pretenses.

Why the other options are incorrect

B. Scavenging – Incorrect

The Manual describes scavenging as:

Obtaining information by searching for discarded documents or materials, such as in trash or recycling bins.

Georgina is not going through discarded materials; she is speaking directly with an employee.

C. Baiting – Incorrect

Baiting typically refers to:

Enticing someone with something of value to trick them into taking an action, often involving malware-infected media or fraudulent offers.

Georgina is not offering anything or luring the employee with incentives.

D. Open-source intelligence – Incorrect

Open-source intelligence (OSINT) refers to gathering information from:

Publicly available sources such as websites, publications, databases, or social media.

Georgina is not using public sources; she is actively eliciting confidential information from a person under false pretenses.

ACFE Manual References

The concepts used in this answer derive from the Fraud Examiners Manual (2020 International Edition), including:

Human intelligence and data collection techniques

Scavenging as an investigative method

Baiting schemes

Open-source intelligence descriptions

Detailed Explanation:

Rationale for Correct Answer: Employees authorized to grant discounts may exploit this by issuing false discounts . They pocket part of the customer’s payment while recording a reduced sale amount, making the books appear balanced.

Analysis of Incorrect Options:

B. Recording a discount on sale procedure – A legitimate process, not fraud.

C. Internal discount sales audits – A control, not a scheme.

D. None of the above – Incorrect since false discounts are a recognized method.

Key Concept: False discount schemes as a skimming method.

Detailed Explanation:

Rationale for Correct Answer: Per generally accepted accounting principles, changes in accounting principles must be disclosed in the financial statements to ensure comparability and transparency. The ACFE notes that disclosures are critical to prevent misleading users of financial statements.

Analysis of Incorrect Options:

A. Subsequent events – Material subsequent events must be disclosed; this statement is false.

B. Contingent losses – Only probable and reasonably estimable losses must be disclosed. If unlikely, no disclosure is required.

C. All information – Only material information requires disclosure.

Key Concept: Disclosure requirements in financial reporting .

Detailed Explanation:

Rationale for Correct Answer: Insurer health care fraud occurs when the insurance company itself engages in deception for financial gain. Submitting inflated cost data to regulators in order to justify rate increases is a direct example of insurer fraud.

Analysis of Incorrect Options:

A. Intermediary verifying claims – Proper procedure, not fraud.

C. Passing on negotiated rates – Legitimate practice.

D. Denying incomplete claims – May be harsh, but not fraudulent.

Key Concept: Insurer fraud vs. provider or claimant fraud .

The correct answer is B. A Ponzi scheme is a fraudulent investment arrangement in which funds from new investors are used to make payments to earlier investors. The payments create an appearance that the investment is legitimate and profitable, even though little or no genuine business activity or investment return exists. This artificial success helps the promoter attract more investors and delay detection. Option A describes a characteristic more closely associated with pyramid schemes, where compensation depends heavily on recruiting participants. Option C is incomplete because Ponzi schemes usually promise high returns with low or no stated risk, not openly high-risk investments. Option D also reflects pyramid-style recruitment structures rather than the defining feature of a Ponzi scheme.

================

Detailed Explanation:

Rationale for Correct Answer: Liabilities are defined as obligations to transfer assets or provide services to other entities in the future as a result of past transactions. They represent what the organization owes, distinguishing them from assets.

Analysis of Incorrect Options:

A. Supplies – Assets consumed within a year, not obligations.

B. Expenses – Costs incurred, but not necessarily amounts owed.

C. Assets – Resources owned, not obligations.

Key Concept: Definition of Liabilities in accounting.

Detailed Explanation:

Rationale for Correct Answer: The described scheme is lapping , a classic accounts receivable fraud. It involves covering up stolen payments by applying subsequent receipts from other customers to hide the shortage.

Analysis of Incorrect Options:

A. Padding – Usually refers to overstating expense reimbursements, not AR fraud.

C. Substitution – Refers to replacing missing assets with others, not AR manipulation.

D. Daisy chain – Not a recognized fraud concealment method in this context.

Key Concept: Skimming concealment techniques – lapping of receivables.

Detailed Explanation:

Rationale for Correct Answer: Common skimming schemes include unrecorded sales , theft of incoming checks , and understating sales/receivables . “Fraud & Cost” is not a recognized skimming scheme and appears to be a distractor.

Analysis of Incorrect Options:

A. Unrecorded sales – A classic skimming method.

C. Theft of checks through the mail – Another recognized skimming approach (incoming receivables).

D. Understated sales and receivables – A concealment method within skimming schemes.

B. Fraud & Cost – Not a scheme classification.

Key Concept: Skimming schemes vs. unrelated distractors.

The red flag is that Fran has made multiple insurance claims in the past. Prior claims history can indicate a pattern of suspicious or repeated losses, especially when a new claim involves valuable property. Receipts and photographs generally support a claim rather than create suspicion by themselves, although they should still be verified for authenticity. Including bulky items in a fire loss claim is not automatically suspicious because fires can destroy many types of property, including large household goods. The ACFE insurance fraud materials identify red flags as indicators requiring further review, not proof of fraud. Fran’s repeated claim history would justify closer examination of the claim details, supporting documentation, timing, policy coverage, and any prior loss patterns.

================

Detailed Explanation:

Rationale for Correct Answer: This is personal purchases with company funds , where an employee uses company resources to acquire goods or services for personal benefit. Baker used ABC’s funds to buy supplies for home improvements.

Analysis of Incorrect Options:

A. Pay and return scheme – Involves overpaying a vendor and pocketing the refund.

C. Pass-through scheme – Involves using a controlled company to bill the employer at inflated prices.

D. Theft of inventory – Involves stealing company stock, not purchasing items for personal use.

Key Concept: Fraudulent disbursement – billing fraud through unauthorized personal purchases.

Timothy is a victim of a pig butchering scheme. This scam combines long-term relationship manipulation with fraudulent investment activity, commonly involving cryptocurrency. The fraudster builds trust over weeks or months, moves the victim to a private messaging channel, and encourages investments through a fake platform. The victim often sees apparent gains, but the trading platform is controlled by the fraudster or does not exist. Once the victim attempts to withdraw funds, the fraudster disappears or demands more money. This is not a Ponzi scheme because the facts do not involve paying old investors with new investor funds. It is not a pump-and-dump because no market manipulation of a traded security is described. It is broader than a simple advance-fee scheme.

================

Detailed Explanation:

Rationale for Correct Answer: Fraudsters typically change the contact information (e.g., phone number, email) to prevent the true account holder from receiving alerts about suspicious activity. Leaving the contact information unchanged would risk detection. Thus, option B is NOT a common fraudster tactic.

Analysis of Incorrect Options:

A – True; fraudsters steal funds or make purchases.

C – True; known as “credential stuffing” or account chaining.

D – True; phishing is a primary way to obtain credentials.

Key Concept: Cyber-enabled fraud – account takeover schemes.

The correct answer is A, money laundering. The ACFE material defines money laundering as the process by which criminals disguise illicit assets as legitimate assets that they have a right to possess and spend. It involves concealing the existence, nature, source, control, beneficial ownership, location, or disposition of property derived from criminal activity. Cross-border financing may be a feature of laundering, but it is not the overall process described. Asset trafficking is not the best ACFE classification for disguising criminal proceeds. Concealment of assets may occur in fraud or bankruptcy matters, but it is broader and does not specifically capture the laundering of illegal proceeds into apparently legitimate funds.

================

Detailed Explanation:

Rationale for Correct Answer: Horizontal analysis evaluates financial statement items over multiple periods, highlighting percentage changes from one period to another . This helps detect unusual trends or anomalies.

Analysis of Incorrect Options:

A – Describes vertical analysis (common-size statements).

B – Describes ratio analysis .

D – Describes benchmarking/comparative analysis across companies.

Key Concept: Analytical procedures – horizontal vs. vertical and ratio analysis.

Detailed Explanation:

Rationale for Correct Answer: Baiting is a social engineering tactic where fraudsters leave infected flash drives or storage media in public areas, hoping victims will plug them in, unknowingly installing malware. This is an accurate description.

Analysis of Incorrect Options:

A. Pharming – Involves redirecting users from legitimate websites to fraudulent ones, not mail redirection.

B. Dumpster diving – Searching physical trash for sensitive information, not computers from resellers.

C. Shoulder surfing – Observing someone’s screen or keystrokes, not access exploitation.

Key Concept: Identity theft techniques .

The correct answer is B. ACH blocks are a preventive bank control that allows an account holder to instruct the bank not to permit ACH debits from designated accounts. This reduces the risk of unauthorized electronic withdrawals. Option A is incorrect because positive pay for ACH should not be declined; it can help verify ACH transactions before they clear. Option C violates segregation of duties because the person initiating electronic payments should not also control ACH filters or payment security settings. Option D is also weak because using separate accounts for paper checks and electronic transactions can improve monitoring and limit exposure. The ACFE materials identify ACH blocks, ACH filters, positive pay, segregation of duties, and bank security services as important controls against electronic payment tampering.

================

Rationale for Correct Answer: The price-level adjusted historical cost method adjusts the original purchase price of an asset for inflation, providing a more current value while still tied to historical cost principles. It addresses one of the limitations of strict historical cost accounting.

Key Concept: Inflation adjustments in asset valuation.

The correct answer is B. Separating the purchasing and payment functions is a core preventive control against billing schemes. Billing fraud often occurs when an employee can initiate purchases, approve vendors, authorize invoices, and process payments without independent review. By segregating these duties, the organization reduces the opportunity for fictitious vendors, shell company invoices, inflated invoices, and personal purchases with company funds. Option A might assist procurement negotiations, but it does not directly address internal authorization and payment control. Option C would weaken procurement controls because competitive bidding helps prevent favoritism and inflated pricing. Option D is also improper because employees should have independent reporting channels, such as hotlines, not only direct supervisors. The ACFE materials emphasize separation of duties, approvals, documentation, and competitive bidding as billing-fraud controls.

================

Detailed Explanation:

Rationale for Correct Answer: According to SAB 104 , revenue recognition requires persuasive evidence of an arrangement. This does not exist if there is no written contract, purchase order, or verbal agreement supporting the transaction.

Analysis of Incorrect Options:

A. Revenue and expenses don’t match – Violates matching principle, not persuasive evidence.

C. Timings not meet properly – Refers to delivery/performance, not evidence of arrangement.

D. Capitalized expenses and liabilities – Irrelevant to revenue recognition.

Key Concept: Revenue recognition requirement: Persuasive evidence of an arrangement.

Detailed Explanation:

Rationale for Correct Answer: Cash larceny involves stealing cash after it has been recorded. Reconciling register totals against actual drawer cash can reveal shortages, making option C the best detection method.

Analysis of Incorrect Options:

A – Weakens segregation of duties and increases fraud risk.

B – Impractical; cross-training is often necessary.

D – Cashiers counting their own registers weakens independent verification and may conceal theft.

Key Concept: Detecting cash larceny through reconciliation controls.

Detailed Explanation:

Rationale for Correct Answer: Cressey’s research on fraud offenders found that most had non-sharable financial problems, which fell into categories such as: (1) violation of ascribed obligations, (2) business reversals, (3) physical isolation, (4) status gaining, and (5) employer-employee relations. “Larceny by fraud” is not a category of non-sharable problem but rather a type of theft scheme. Hence, D is correct.

Analysis of Incorrect Options:

A. Violation of ascribed obligations – Correctly one type of non-sharable problem.

B. Business reversals – Correctly one type of non-sharable problem.

C. Physical isolation – Correctly one type of non-sharable problem.

D. Larceny by fraud – Not a “problem” type; it is a fraud scheme.

Key Concept: Cressey’s non-sharable problems — psychological and situational pressures that contribute to occupational fraud.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters may solicit bids from fictitious suppliers (phony vendors) to create the illusion of competition. This ensures that the favored vendor wins while maintaining the appearance of a legitimate competitive bidding process.

Analysis of Incorrect Options:

B. Solicit transactions from fictitious vendors – Incorrect phrasing; bids, not transactions, are solicited.

C. Solicit bid-splitting… – Bid-splitting is a different fraud scheme, not part of solicitation.

D. None of the above – Incorrect, since A is accurate.

Key Concept: Phony bid solicitation as a corruption tactic in procurement.

The ACFE Fraud Examiners Manual (2020 International Edition) , under the section on Information Security in Electronic Commerce Systems , describes the three primary security goals that must be achieved to protect users and account holders:

Confidentiality

Integrity

Availability

These three goals form the cornerstone of information system protection and are often referred to as the CIA triad .

1. Confidentiality

Confidentiality ensures that sensitive information is accessible only to authorized individuals. The Manual highlights that e-commerce systems must protect customers’ personal and financial data from unauthorized access.

2. Integrity

Integrity requires that the information in the system is accurate and has not been improperly altered. This prevents fraudulent manipulation of records, transactions, and account balances.

3. Availability

Availability ensures that systems and data are accessible to authorized users when needed. This includes preventing disruptions caused by system failures, denial-of-service attacks, or internal sabotage.

These three goals are explicitly documented in the ACFE Manual as essential security requirements for safeguarding electronic financial systems.

Why Option C is the Correct Answer

“Penetrability of data” is NOT an information security goal.

In fact, it is the opposite of what an information security framework seeks to achieve. No section of the ACFE Manual identifies "penetrability" as a required or legitimate objective. Instead, systems should be resistant to penetration attempts.

Thus, Option C does not belong to the CIA model or any ACFE-described security framework.

ACFE Manual Reference

These concepts are covered in the Financial Transactions and Fraud Schemes section discussing information security objectives for e-commerce environments, which identifies confidentiality, integrity, and availability as the foundational goals of secure systems.

Detailed Explanation:

Rationale for Correct Answer: Blank plastic cards are a common basis for counterfeit card production. Fraudsters encode stolen magnetic stripe or chip data onto blank cards.

Analysis of Incorrect Options:

A – False; holograms are designed to be difficult to reproduce.

B – False; high-speed printers and embossers make counterfeiting easier, not harder.

D – Incorrect, since A and B are false.

Key Concept: Counterfeit card fraud methods.

The ACFE Fraud Examiners Manual includes Kickback Schemes in the corruption section and specifically identifies Diverting Business to Vendors as a type of kickback scheme.

This question states that Bob, a purchasing agent , directed business to Oak Company, and in return Oak’s sales manager agreed to pay Bob a percentage of the extra profits . That is a classic kickback arrangement : the employee steers company business to a favored vendor in exchange for a personal financial benefit. The Manual’s examples of corruption also discuss a vendor bribing or paying a purchasing agent to receive more business.

Why the other options are incorrect

A. Economic extortion scheme

The Manual defines economic extortion as obtaining money, property, or services through coercion or threatened adverse action. That is not what happened here; Bob was paid for steering business, not coercing payment through threats.

C. Illegal gratuity scheme

The Manual explains that illegal gratuities are items of value given to reward a decision, often after the recipient has already made the decision, and this concept is primarily discussed in the public-sector context. Here, the payment is part of an agreement to direct business and share in profits, which is more accurately a kickback .

D. Diversion scheme

The relevant Manual terminology is Diverting Business to Vendors , but that appears as a subtype under Kickback Schemes . Therefore, the best answer among the options is the broader and correct classification: kickback scheme .

References

ACFE Fraud Examiners Manual, 2020 International Edition

Corruption — Kickback Schemes

Corruption — Diverting Business to Vendors

Example involving a purchasing agent receiving improper payments to steer business to a vendor

Economic Extortion definition

Illegal Gratuities definition

The correct answer is B. When a debtor organization intends to continue as a going concern, effective insolvency practice may permit existing management to remain involved, subject to oversight by an independent insolvency representative. This approach balances operational continuity with creditor protection, transparency, and accountability. Exclusive control by secured creditors is inappropriate because insolvency proceedings must consider the legal framework and the rights of all affected parties. Creditors may have participation rights, but they do not automatically manage the organization. Mandatory shared governance between management and creditors is also not the best statement of the World Bank Principles. Professionally, the independent representative’s role is to supervise, preserve value, investigate improper transactions, and protect the integrity of the process.

================

The correct answer is A. Electronic funds transfer fraud involves the misuse of electronic payment systems to move money improperly. A vendor submitting an electronic bill through a client’s online payment system for services not provided is a fraudulent use of electronic bill presentment or payment processes. Option B is payroll fraud, specifically falsified hours or salary. Option C involves theft and misuse of prepaid cards, not EFT manipulation by the payee. Option D describes payment card skimming, where card information is captured for later unauthorized use. The ACFE materials discuss electronic funds transfers, wire transfer fraud, electronic bill presentment and payment, and detection of EFT fraud as part of payment fraud risk.

================

Detailed Explanation:

Rationale for Correct Answer: A ghost employee scheme occurs when fictitious or former employees remain on payroll. Detecting duplicate addresses, Social Security/Government ID numbers, or other anomalies between HR and payroll records is a classic detection method for ghost employees.

Analysis of Incorrect Options:

A. Fraudulent commissions scheme – Relates to sales manipulation, not duplicate personnel records.

B. Falsified hours and salary scheme – Involves timekeeping, not fictitious employees.

C. Expense reimbursement scheme – Concerns fraudulent expense claims, unrelated to payroll records.

Key Concept: Payroll fraud — Ghost Employee scheme .

Detailed Explanation:

Rationale for Correct Answer: This is True . When an employee has significant authority or discretion in the procurement process (e.g., drafting specifications, approving vendors, or evaluating bids), they are more capable of steering contracts toward favored suppliers. This increases the risk of corruption schemes like kickbacks or bid-rigging .

Analysis of Incorrect Options:

B. False – Incorrect; influence grows with authority over procurement.

Key Concept: Procurement authority is a key risk factor for corruption.

Detailed Explanation:

Rationale for Correct Answer: Shrinkage refers to discrepancies between physical inventory counts and perpetual inventory records. Causes include theft, errors, waste, or fraud. It is one of the most common indicators of asset misappropriation.

Analysis of Incorrect Options:

A. Altered inventory – Not a recognized accounting term.

B. Account receivable – Unrelated to inventory.

D. Write-offs – A corrective accounting entry, not the variance itself.

Key Concept: Inventory shrinkage as a red flag for fraud.

The correct answer is C. A code of business ethics and conduct is most effective when it clearly communicates the organization’s values, expected behavior, and major compliance risks, including bribery, conflicts of interest, gifts, hospitality, facilitation payments, and dealings with third parties. Its purpose is not merely to impose management’s expectations, but to guide ethical decision-making across the organization. Option A is too one-sided and does not reflect tone at the top or mutual accountability. Option B is too narrow because anti-corruption obligations extend beyond shareholders to regulators, customers, employees, business partners, and the public. Option D is unrealistic because no code can address every possible ethical situation; it should provide principles, reporting channels, and escalation guidance.

================

Detailed Explanation:

Rationale for Correct Answer: A false balance occurs when incorrect totals are intentionally carried forward from the journal to the ledger or from the ledger to the financial statements. This is often used as a concealment technique in fraud to make the books appear balanced while hiding irregularities.

Analysis of Incorrect Options:

A. Forced Balance – Involves adding fictitious entries to force accounts into balance.

B. Out-of-balance – Results when entries don’t match, but not specifically from carried totals.

D. None of all – Incorrect since “false balance” is the precise term.

Key Concept: False balance entries as concealment techniques in fraudulent bookkeeping.

Detailed Explanation:

Rationale for Correct Answer: The balance sheet summarizes account balances from the ledger at a specific date, presenting assets, liabilities, and equity. It reflects the organization’s financial position and is derived from ledger balances.

Analysis of Incorrect Options:

B. Income statement – Summarizes revenues and expenses, not all ledger balances.

C. Financial statement – A general term, but the specific answer here is balance sheet.

D. General journal – Book of original entry, not a summary.

Key Concept: Balance sheet as a summary of ledger accounts.

Detailed Explanation:

Rationale for Correct Answer: Biometric authentication (fingerprints, facial recognition) is one of the strongest defenses against identity theft. It prevents unauthorized logins even if passwords are compromised.

Analysis of Incorrect Options:

A – Password reuse should be avoided altogether, not just limited.

B – Updates should be installed promptly, not annually.

C – Personal information should rarely, if ever, be transmitted via email, even with reputable companies.

Key Concept: Identity theft prevention through strong authentication.

Detailed Explanation:

Rationale for Correct Answer: Larceny by fraud (often termed “theft by deception”) occurs when someone unlawfully obtains another’s property by deception rather than by direct taking. As defined in fraud examination principles, deception can involve: (1) creating or reinforcing a false impression, (2) failing to correct a false impression, or (3) failing to disclose material facts such as liens or adverse claims. Because all three scenarios represent deceptive means to unlawfully take property, the correct answer is D. All of the above .

Analysis of Incorrect Options:

A, B, C each describe valid examples of fraud by deception but individually do not fully capture the concept.

D encompasses the totality of recognized deceptive practices under larceny by fraud.

Key Concept: Fraud by deception as an element of theft and misappropriation.

Detailed Explanation:

Rationale for Correct Answer: The SEC’s Staff Accounting Bulletin (SAB) 104 outlines four criteria for revenue recognition:

Persuasive evidence of an arrangement exists.

Delivery has occurred or services have been rendered.

The seller’s price is fixed or determinable.

Collectability is reasonably assured.

“ Timings have been met ” is not one of the recognized criteria, making C the correct answer.

Analysis of Incorrect Options:

A, B, D – All are required conditions.

C – Not part of SAB 104.

Key Concept: Revenue recognition criteria under SAB 104.

Detailed Explanation:

Rationale for Correct Answer: Kickbacks are undisclosed payments made by vendors to employees of purchasing companies to secure favorable treatment. They are a classic form of bribery under the corruption classification of the Fraud Tree.

Analysis of Incorrect Options:

A. Bid-rigging – Involves collusion among bidders, not secret payments.

C. Presolicitation – A phase in procurement fraud, not the scheme itself.

D. None of the above – Incorrect, as kickbacks are the precise answer.

Key Concept: Kickbacks — secret vendor payments for favorable purchasing treatment.

The correct answer is A. Creating answers to security questions using unique, nonpublic details helps prevent identity thieves from bypassing account protections. Many security-question answers, such as a mother’s maiden name, school name, pet name, or birthplace, can be discovered through social media, public records, or data breaches. Using answers that cannot be easily verified through public sources makes account recovery processes harder to exploit. Option B is weak because passwords and passphrases should not be reused across accounts at all. Option C is unsafe because email can be intercepted or misdirected, even when contacting reputable organizations. Option D is inadequate because moving files to the recycle bin does not securely erase data from a device before disposal.

================

Detailed Explanation:

Rationale for Correct Answer: Fraudulent schemes involving returns and allowances can be detected by analyzing accounts for unusually high transactions in these categories. This is a common red flag for concealment of theft or manipulation of sales.

Analysis of Incorrect Options:

A. Allowances by vendors – Too narrow, not a standard analytic test.

B. Disposals of allowances than reorders – Not a recognized search method.

D. None of the above – Incorrect, since option C is valid.

Key Concept: Returns and allowances analysis for fraud detection.

Option A describes a card skimming or shimming scheme. Skimming involves using a hidden device to capture payment card information, often from a magnetic stripe, while shimming commonly involves a device inserted into a card reader to capture chip-card data. A small camera can also be used to record PIN entry. Automated teller machines and point-of-sale terminals are common targets because customers insert or swipe cards and enter authentication data. Option B involves theft or sale of card information but not skimming or shimming through a reader. Option C describes physical card theft or retention. Option D does not clearly show capture of card credentials. The ACFE material discusses ATM fraud, including skimming and shimming, as financial institution fraud risks.

================

Detailed Explanation:

Rationale for Correct Answer: In a need recognition scheme , an employee creates or exaggerates a need for goods or services to benefit a favored supplier. One red flag is that materials are ordered prematurely or not at the optimal reorder point , suggesting that purchases are being manipulated to benefit a corrupt vendor rather than based on actual business needs.

Analysis of Incorrect Options:

A – A large list of suppliers suggests competition, not fraud.

C – A need met by various suppliers does not indicate fraud.

D – Low requirements for stock may reflect lean inventory management, not fraud.

Key Concept: Corruption – need recognition schemes and red flags.

Detailed Explanation:

Rationale for Correct Answer: In the “playing the accounting system” approach, fraudsters manipulate legitimate accounting rules and entries to distort reported results. Examples include manipulating estimates, changing depreciation methods, or shifting expenses. They exploit the flexibility of GAAP to present misleading results while still appearing compliant.

Analysis of Incorrect Options:

A. Organized accounting – Not a recognized fraud approach.

C. Beating accounting – Refers to bypassing the system entirely, not using it as a tool.

D. All of the above – Incorrect because only option B is valid.

Key Concept: Playing the accounting system as a method of financial statement fraud.

Detailed Explanation:

Rationale for Correct Answer: The accounts receivable journal (also called the sales journal) records all sales transactions, whether on credit or cash. It provides a detailed subsidiary record of customer accounts and sales activity.

Analysis of Incorrect Options:

A. Disbursement journal – Records cash outflows, not sales.

C. Accounts payable journal – Records amounts owed to vendors, not sales.

D. General journal – Records miscellaneous entries not suited to specialized journals.

Key Concept: Special journals — sales activity recorded in the accounts receivable journal.

The correct answer is B. A request to send payment to a country different from where the third party conducts business is a significant red flag in corruption and bribery schemes. Such payment instructions can indicate attempts to conceal beneficial ownership, route funds through offshore accounts, disguise improper commissions, or make corrupt payments difficult to trace. Option A is not necessarily suspicious because many legitimate vendors use one business address and phone number. Option C can reflect legitimate competitive strength if the vendor truly provides superior services. Option D is also not inherently suspicious because lower prices may result from efficiency or market strategy. Fraud examiners should treat unusual third-party payment destinations as high-risk indicators requiring enhanced due diligence and documentation review.

================

Detailed Explanation:

Rationale for Correct Answer: Best practices in preventing EFT fraud require mailing PINs and account information separately , never together. Sending them together creates a serious security risk if intercepted.

Analysis of Incorrect Options:

A – Correct preventive measure: immediately cancel and reissue stolen access devices.

B – Correct preventive measure: validating addresses helps detect fraudulent applications.

C – Correct preventive measure: segregation of duties reduces insider fraud risks.

Key Concept: EFT fraud prevention through layered security and separation of duties.

Detailed Explanation:

Rationale for Correct Answer: Tangible assets are those that can be physically perceived (touched, seen, etc.) and appraised (assigned a measurable value). Examples include buildings, land, equipment, and inventory. Both characteristics are correct, making C the best choice.

Analysis of Incorrect Options:

A. Capable of being perceived – True, but incomplete.

B. Capable of being appraised – True, but incomplete.

D. Neither A nor B – Incorrect since both statements are accurate.

Key Concept: Tangible Assets — physical and measurable property owned by a business.

Detailed Explanation:

Rationale for Correct Answer: Administrative security controls involve policies, procedures, and practices designed to manage the overall security environment—such as awareness training, audits, data classification, and enforcement of policies. These controls focus on governance rather than direct system configuration.

Analysis of Incorrect Options:

A. Technical security controls – These are automated safeguards (e.g., firewalls, encryption).

B. Logical access controls – Restrict access to systems through passwords, tokens, or biometrics.

D. Physical access controls – Restrict physical access (e.g., locks, guards, CCTV).

Key Concept: Layers of security controls (administrative, technical, physical).

The correct answer is C. Electronic payment tampering occurs when an employee improperly alters or creates electronic payments, such as ACH payments, wire transfers, or online banking payments. Reviewing non-payroll payments made to employees is highly effective because employees generally should not receive vendor-style electronic disbursements outside normal payroll or approved reimbursement channels. Such payments can indicate that an employee inserted their own bank account, created an unauthorized payee, or diverted electronic funds. Vendor duplicate confirmations are more relevant to duplicate-payment issues. Customer complaints about late account postings relate more to cash receipts or accounts receivable. Quarterly reconciliations are too infrequent for timely detection. The ACFE materials identify electronic payment tampering as a fraudulent disbursement risk requiring strong monitoring and bank controls.

================

Detailed Explanation:

Rationale for Correct Answer: Misuse of noncash assets occurs when employees use company assets for personal purposes without authorization. Even though the vehicle was returned undamaged, unauthorized use and concealment by false statements makes it a fraud scheme under asset misappropriation.

Analysis of Incorrect Options:

A – Incorrect; unauthorized use with deception constitutes fraud.

B – Expense reimbursement involves falsified claims for travel/expenses, not vehicle misuse.

D – Financial statement fraud involves misstating accounting entries, unrelated here.

Key Concept: Misuse of company assets (noncash) as part of asset misappropriation.

Comprehensive and Detailed Explanation (Based on the ACFE Fraud Examiners Manual – Financial Transactions and Fraud Schemes)

In the Identity Theft chapter of the Financial Transactions and Fraud Schemes section, the ACFE Manual explains that there are two primary methods of committing identity theft :

Traditional identity theft

Synthetic identity theft

These are listed under “Methods of Committing Identity Theft” (1.803) , immediately followed by “Types of Identity Theft Schemes” (1.804) such as financial identity theft and criminal identity theft.

1. Why the correct answer is Traditional identity theft (Option B)

In traditional identity theft , the perpetrator uses the real, complete identity of another person—such as their name, government identification number, and birthdate —to impersonate that person for fraudulent purposes. This is exactly what is happening in the question:

The fraudster uses a real victim’s name, government identification number, and birthdate to open a credit card account in the victim’s name.

This matches the Manual’s categorization where traditional identity theft involves misuse of actual personal identifying information (PII) belonging to a real individual, rather than fabricating an identity. The Manual then explains that this stolen identity is often used in financial schemes , such as obtaining credit cards, loans, or other financial benefits, which falls under financial identity theft as a type of identity theft scheme.

So, in ACFE terms, the method is traditional identity theft , and the scheme type is financial identity theft (using another person’s identity to obtain credit or other financial benefits).

2. Why the other options are incorrect

Option A – New account identity theft

“New account identity theft” is a descriptive phrase sometimes used in practice to describe opening new credit accounts in another person’s name, but the ACFE Manual’s formal categorization focuses on:

Methods of committing identity theft:

Traditional identity theft

Synthetic identity theft

Types of identity theft schemes:

Financial identity theft

Criminal identity theft

Medical identity theft

Insurance identity theft

Tax identity theft

Employment identity theft

Business identity theft

“New account identity theft” is not one of the defined method categories in the Manual; the described conduct is captured under traditional identity theft (method) and financial identity theft (scheme type). Therefore, this option does not align with the ACFE’s terminology tested on the CFE exam.

Option C – Synthetic identity theft

The Manual distinguishes synthetic identity theft as a different method. Under “Methods of Committing Identity Theft” (1.803) , it explains that synthetic identity theft involves combining real elements of identity (for example, a genuine government identification number) with fabricated or unrelated information (such as a made-up name, date of birth, or address) to create a partly fictitious identity .

In the question, the fraudster is not creating a hybrid or composite identity. They are using all of the real victim’s identifying information (name, government ID number, birthdate) and posing directly as that person. That is traditional , not synthetic.

Option D – Criminal identity theft

Under “Types of Identity Theft Schemes” (1.804–1.805) , the Manual describes criminal identity theft as a scheme where a fraudster gives someone else’s identifying information to law enforcement or in criminal justice contexts , so that the victim’s identity is attached to the criminal record or charges .

Typical examples include:

Giving another person’s name and identification details when stopped or arrested

Causing warrants or criminal records to be issued in the victim’s name

In the question scenario, the fraudster is not interacting with law enforcement or shifting criminal records to the victim. Instead, they are opening a credit card account , which is a financial use of the stolen identity. Therefore, it fits financial identity theft as a scheme type, but traditional identity theft as the method.

Detailed Explanation:

Rationale for Correct Answer: Irregular, low-value, or unpredictable revenue sources such as parking fees, late charges, or vending machine sales are prime skimming targets. Because they are difficult to estimate or reconcile precisely, theft of these funds is less likely to be detected quickly.

Analysis of Incorrect Options:

B. Recorded sales – These are already in the books and easier to reconcile.

C. Internal audits – A control mechanism, not a target.

D. Register manipulations – A method, not the revenue source itself.

Key Concept: Vulnerable revenue streams as skimming targets.

Detailed Explanation:

Rationale for Correct Answer: The full disclosure principle requires that all material facts and deviations from GAAP be disclosed to readers of financial statements so that they are not misled. Transparency is essential for informed decision-making by investors, creditors, and regulators.

Analysis of Incorrect Options:

B. SAS – Refers to auditing standards, not accounting standards.

C. Writer – Incorrect; disclosures are intended for readers/users.

D. None of above – Incorrect since option A is correct.

Key Concept: Full disclosure principle — providing users with all material information.

The correct answer is D. Supervisor authorization of overtime and verification of hours worked are strong preventive controls against payroll fraud, especially falsified hours and salary schemes. Payroll fraud frequently occurs when employees overstate hours, submit unauthorized overtime, manipulate time records, or receive pay for time not worked. Supervisory review creates accountability and provides an independent check before payroll is processed. Option A is improper because payroll preparation and bank reconciliation should be segregated. Option B is not recommended because direct deposit can reduce paycheck theft and distribution risks. Option C is weak because allowing coworkers to collect paychecks can create opportunities for misappropriation. The ACFE materials identify overtime authorization and payroll review as important payroll fraud controls.

================

Detailed Explanation:

Rationale for Correct Answer: Under accrual-basis accounting , revenues are generally recognized when earned (often upon delivery of goods or services), not necessarily when cash is received. Similarly, expenses are recorded when incurred, not when paid. This provides a more accurate picture of performance and financial position.

Analysis of Incorrect Options:

A – This describes cash-basis accounting , not accrual-basis.

B – Accrual accounting is more complex, not simpler.

C – Focuses on earned revenues and incurred expenses, not immediate cash flow.

Key Concept: Accrual accounting matches revenues with expenses in the period they occur.

The correct answer is D. The FATF Recommendations establish international standards for combating money laundering, terrorist financing, and related threats. They recommend that countries criminalize money laundering, supervise financial institutions and high-risk professions, require suspicious transaction reporting, and maintain mechanisms for analyzing and disseminating financial intelligence. A financial intelligence unit receives and analyzes suspicious transaction reports and other AML-related information. Option A is incorrect because FATF does not require a universal three-year sentence for every conviction. Option B is too extreme and does not reflect the FATF framework. Option C is not a general FATF requirement; customer due diligence and monitoring focus on risk, transactions, and beneficial ownership, not mandatory review of public social media profiles.

================

Detailed Explanation:

Rationale for Correct Answer: Cost mischarging occurs when costs are charged to improper accounts or contracts. The best way to detect it is through analytical review —comparing direct vs. indirect labor account totals across periods to identify unusual shifts or spikes.

Analysis of Incorrect Options:

A. Reviewing inspection/testing reports – Effective for detecting defective/substituted goods, not mischarging.

C. Inspecting packaging – Identifies product substitution, not accounting mischarges.

D. Examining change orders – Useful for contract fraud, but not direct mischarging.

Key Concept: Cost mischarging detection through analytical procedures .

The correct answer is A. Billing schemes often exploit weak segregation of duties in purchasing, receiving, and payment functions. If one person or department can request goods, approve receipt, authorize payment, and process invoices without independent verification, fictitious invoices, pass-through schemes, personal purchases, or inflated vendor billings are easier to conceal. Karen should therefore determine whether these functions operate independently. Option B is not the strongest choice as written because identifying employees with the same phone number does not directly test vendor billing fraud. Customer complaints about sales policies relate to revenue or consumer issues, not purchasing fraud. Accounts receivable and credit sales analysis is more relevant to revenue fraud. The ACFE materials classify billing schemes under fraudulent disbursements and emphasize purchasing, receiving, and invoice controls.

================

Valentin’s scheme is best described as property flipping. Property flipping becomes fraudulent when real estate is quickly resold at an artificially inflated price supported by false or misleading appraisals, sham transactions, or misrepresentations. The key facts are the quick resale and inflated value created through a fraudulent appraisal. A daisy chain generally involves a sequence of related transactions or parties used to inflate value or conceal the nature of the transaction, but the question asks for the best description of the basic scheme. A fraudulent sale is too general, and an air loan involves a fictitious borrower, fictitious property, or nonexistent transaction. The ACFE material discusses fraudulent appraisals, real estate fraud, and property flipping as financial institution fraud risks.

================

The correct answer is D because unexplained gaps in a promoter’s work history are specifically identified as a red flag that an entity might be operating a securities business without proper licensing or registration. The ACFE material explains that legitimate brokerage firms and broker-dealers must register with the appropriate regulatory authority, meet required standards, and ensure that relevant personnel are properly registered or licensed. Red flags include agents with criminal records, unexplained employment gaps, prior customer complaints, regulatory problems, and questionable credentials. Options A and B are not red flags by themselves because prospectuses and regulatory filings may be associated with legitimate securities activity. Option C is the opposite of a warning sign; customer complaints would be more concerning than a lack of complaints.

================

Detailed Explanation:

Rationale for Correct Answer: Recognized schemes for stealing inventory include:

Larceny schemes (direct theft)

Asset requisition and transfer schemes (false requisitions to divert assets)

Purchasing and receiving schemes (over-ordering or falsifying deliveries).

“ Sales & Equipment handling ” is not a defined fraud scheme, making D correct.

Analysis of Incorrect Options:

A. Larceny schemes – Valid theft method.

B. Asset requisition and transfer – Document manipulation method.

C. Purchasing and receiving schemes – Valid misappropriation scheme.

Key Concept: Inventory theft schemes under the Fraud Tree.

Submitting token bids is a common collusive procurement fraud method known as complementary bidding, also called protective, shadow, or cover bidding. In this scheme, competing contractors submit bids that are not serious attempts to win the contract. These bids might be intentionally too high, technically unacceptable, or structured with unfavorable terms so the preferred contractor wins while the process still appears competitive. This undermines the purpose of competitive bidding, which is to place bidders on equal terms and obtain the best price and conditions. Option B is inconsistent with market division, where conspirators divide markets rather than seek all areas. Option C refers more generally to shell or fictitious bidding, and option D is a billing fraud issue, not the common collusive bidding method described here.

================

Detailed Explanation:

Rationale for Correct Answer: Perpetual inventory systems maintain a continuous, running balance of inventory on hand. They are updated with each purchase and sale, providing a theoretical count at all times. Discrepancies between perpetual and physical counts may indicate theft, errors, or fraud.

Analysis of Incorrect Options:

A. Altered inventory – Fraudulent manipulation, not a system.

C. Shrinking inventory – Refers to shrinkage, not the system.

D. Fictitious inventory – Fraudulent reporting, not a legitimate system.

Key Concept: Perpetual inventory systems as internal controls.

The correct answer is C because comparing claimed travel expenses with known business-trip dates is a targeted way to detect fictitious, overstated, or personal expenses submitted for reimbursement. Expense reimbursement fraud often involves employees claiming expenses that were not actually incurred for business purposes, altering receipts, requesting multiple reimbursements, or mischaracterizing personal costs as business costs. Travel expenses outside approved trip dates are suspicious because they might represent personal travel or fabricated claims. Option A is weak because balances matching historical amounts are not inherently suspicious. Option B is inefficient and HR might not have the necessary transactional evidence. Option D is not a strong fraud indicator because lower expenses are generally less suspicious than excessive or unsupported expenses. The ACFE material emphasizes detailed review and analysis of expense reports.

================

The correct answer is C. Management can make profits appear stronger by concealing liabilities and expenses, including warranty costs. Warranty obligations arise when a company is likely to incur future costs related to products already sold. If management fails to record or disclose those expected costs, expenses and liabilities are understated, while net income and financial position appear better than reality. Overstating expenses and understating revenue would reduce, not strengthen, reported profits. Fabricating product-return liabilities would also reduce income because it creates an additional liability or expense. The ACFE financial statement fraud materials identify concealed liabilities and expenses, including unrecorded or undisclosed warranty costs and product-return liabilities, as schemes used to overstate financial performance.

================

Detailed Explanation:

Rationale for Correct Answer: By definition, conflict of interest fraud arises when an employee has a hidden financial or ownership interest in another entity with which the employer does business. The fraudster’s loyalty is divided because their interest lies outside of their primary employer.

Analysis of Incorrect Options:

B. False – Incorrect because the essence of conflict of interest is precisely that the fraudster’s interest lies outside their company.

Key Concept: Conflict of Interest (divided loyalty).

Shirley has most likely been victimized by a romance scheme. In romance, sweetheart, or friendship scams, the fraudster builds an emotional relationship with the victim, often through social networking or online communication, and then requests money under a sympathetic pretext. Simon befriends Shirley, creates expectations of a future meeting, claims financial hardship, receives $10,000, and then disappears. That pattern is typical of a romance scam. A grandparent scheme usually involves impersonating a grandchild or relative in distress. A bait-and-switch scheme involves advertising one product or service and substituting another. A vacation scheme would focus on fraudulent travel offers, not a fabricated romantic relationship used to obtain money. The ACFE material identifies romance and friendship sc hemes as consumer fraud schemes.

================

The correct answer is D. Technical surveillance involves using electronic or technical means to collect information that is not available through open sources, including nondocumentary information such as conversations, signals, or communications. This is a recognized method of corporate espionage when used to obtain proprietary or confidential business information. Option A is too narrow and inaccurate because social engineering manipulates people into revealing information or providing access, not primarily desk-file searches. Option B misstates physical infiltration; physical entry can give access to premises, documents, or devices, but exploiting firewalls is a technical attack. Option C incorrectly defines pretexting; pretexting involves using a false identity or fabricated reason to obtain information. Corporate espionage must be distinguished from lawful competitive intelligence.

================

Detailed Explanation:

Rationale for Correct Answer: In fictitious revenue schemes , sales are recorded that never occurred. Because no actual customers exist, there will be no late or overdue accounts receivable. The Fraud Examiners Manual (2020) notes that unusually clean receivables aging reports—i.e., no overdue balances—can be a red flag of revenue manipulation.

Analysis of Incorrect Option:

B. False – Incorrect; the absence of overdue receivables is indeed suspicious and aligns with fictitious revenue fraud.

Key Concept: Financial statement fraud red flags — fictitious revenues.

Rationale for Correct Answer: Strong internal controls — particularly inventory controls — are essential not just to prevent theft, but also to detect errors, reduce waste, and ensure that inventory levels are appropriate. Controls such as physical counts, reconciliations, and segregation of duties protect against misappropriation and inefficiencies.

Key Concept: Internal Controls as a preventive and detective mechanism in asset safeguarding.

The correct answer is A. A tax haven is a jurisdiction with low or no tax rates that individuals or entities use to reduce tax obligations. Moving a company’s headquarters to another jurisdiction specifically to benefit from a lower tax rate fits the concept of using a tax haven. A secrecy jurisdiction emphasizes financial secrecy, bank secrecy, or laws that limit disclosure of ownership or account information; it might overlap with tax haven activity, but the question focuses on lower tax rates. A tax shelter is an investment or arrangement designed to create tax benefits, such as deductions or deferrals. A jurisdictional deduction is not the best ACFE concept here. The ACFE tax fraud materials discuss tax havens, secrecy jurisdictions, and tax shelters in international tax avoidance and evasion.

================

The correct answer is A. David is committing a lapping scheme. Lapping occurs when an employee steals one customer’s payment and conceals the theft by applying a later payment from another customer to the first customer’s account. The employee must then continue shifting later payments to earlier accounts to keep the shortage hidden. This creates a rolling concealment pattern that can continue until discovered through customer complaints, account confirmations, delayed postings, or independent reconciliation. Padding, substitution, and duplication are not the standard ACFE classifications for this receivables concealment method. Because David is using later customer payments to cover earlier stolen receipts, his conduct fits the classic definition of lapping under cash receipts fraud schemes.

================

The correct answer is D. A fraudulent conveyance occurs when a debtor transfers property to another party, often an insider or related party, for little or no consideration before or during insolvency to place assets beyond the reach of creditors. Brad’s transfer of valuable marble slabs to his son’s construction business at no charge shortly before bankruptcy is a strong indicator of such a scheme. Option A, concealed transfer, is less precise because the key issue is not merely hiding a transfer but transferring assets for inadequate value to impair creditors. Option B is overly broad and does not identify the scheme type. Option C, planned bustout, usually involves obtaining goods or credit with the intent to dispose of assets and then file bankruptcy.

================

Detailed Explanation:

Rationale for Correct Answer: Short-term skimming schemes include tactics like unrecorded sales , understated sales , and theft of incoming checks . These involve diverting funds before recording and typically last for a shorter duration because of higher detection risk.

Analysis of Incorrect Options:

B. Dual endorsements – Relates more to check fraud, not skimming.

C. False company accounts – Typically used in long-term fraud concealment.

D. Check-for-currency substitutions – More relevant to larceny and kiting schemes.

Key Concept: Short-term skimming schemes involve quick thefts before recording transactions.

Detailed Explanation:

Rationale for Correct Answer: One of the most effective ways to protect proprietary information is educating employees about nondisclosure agreements (NDAs) at onboarding and again during exit. This ensures awareness of confidentiality obligations.

Analysis of Incorrect Options:

A. Changing locks/codes every 3–5 years – Reasonable security but insufficient for safeguarding proprietary information.

B. Classifying data by years of service – Not a sound security practice; access should be based on role and need-to-know.

D. Requiring notes/drafts – Increases risk of information leaks, not protection.

Key Concept: Proprietary information protection .