CFE-Financial-Transactions-and-Fraud-Schemes Certified Fraud Examiner - Financial Transactions and Fraud Schemes Exam Questions and Answers

Detailed Explanation:

Rationale for Correct Answer:Short-term skimming schemes include tactics like unrecorded sales, understated sales, and theft of incoming checks. These involve diverting funds before recording and typically last for a shorter duration because of higher detection risk.

Analysis of Incorrect Options:

B. Dual endorsements – Relates more to check fraud, not skimming.

C. False company accounts – Typically used in long-term fraud concealment.

D. Check-for-currency substitutions – More relevant to larceny and kiting schemes.

Key Concept:Short-term skimming schemes involve quick thefts before recording transactions.

Detailed Explanation:

Rationale for Correct Answer:ACFE’s occupational fraud surveys consistently show that males are more often the primary perpetrators than females, accounting for approximately 62% of cases compared to 37% for females. This is attributed to higher representation of males in positions of authority and access. Therefore, C. 62 versus 37 is correct.

Key Concept:Demographics of Fraud Perpetrators — gender-based survey findings.

Detailed Explanation:

Rationale for Correct Answer: Misuse of noncash assets occurs when employees use company assets for personal purposes without authorization. Even though the vehicle was returned undamaged, unauthorized use and concealment by false statements makes it a fraud scheme under asset misappropriation.

Analysis of Incorrect Options:

A – Incorrect; unauthorized use with deception constitutes fraud.

B – Expense reimbursement involves falsified claims for travel/expenses, not vehicle misuse.

D – Financial statement fraud involves misstating accounting entries, unrelated here.

Key Concept: Misuse of company assets (noncash) as part of asset misappropriation.

Detailed Explanation:

Rationale for Correct Answer: The accounting framework a company must follow depends on the jurisdiction in which it is publicly traded. For example, U.S.-listed companies must follow GAAP, while companies in the EU must use IFRS. Some countries allow or require IFRS, others mandate local GAAP.

Analysis of Incorrect Options:

B – Incorrect; some jurisdictions have their own national GAAP not tied to U.S. GAAP or IFRS.

C – Incorrect; international operations do not mandate IFRS—jurisdictional rules apply.

D – Incorrect; U.S. GAAP is rules-based, IFRS is principles-based (the reverse of what’s stated).

Key Concept: Financial reporting standards are jurisdiction-driven.

Detailed Explanation:

Rationale for Correct Answer: A major red flag of a Ponzi scheme is when the promoter has custody and control over investor funds with little to no independent oversight. This centralization allows them to use new investor money to pay old investors while concealing losses.

Analysis of Incorrect Options:

A – Ponzi operators usually pressure investors to reinvest, not take payouts, to keep funds circulating.

C – Schemes often involve overly complex or secretive strategies, not simple ones.

D – Realistic fluctuations based on markets suggest legitimate investing, not a Ponzi scheme (which typically reports steady, unrealistic returns).

Key Concept: Ponzi schemes rely on lack of oversight, unrealistic returns, and control of funds by promoters.

Detailed Explanation:

Rationale for Correct Answer:Technical security controls include software- and hardware-based measures such as application security, firewalls, and encryption. Application security protects against vulnerabilities in the programs employees use.

Analysis of Incorrect Options:

B. Human audits – Administrative control, not technical.

C. Penetration testing – A detective measure/test, not a control itself.

D. Data security – A broad goal, not a specific technical control.

Key Concept: Technical security controls for preventing cyberfraud.

Detailed Explanation:

Rationale for Correct Answer:Ransomware is malware that encrypts or locks an operating system and prevents access to data until a ransom is paid. This definition is correct.

Analysis of Incorrect Options:

A. Spyware – Monitors user activity, keystrokes, or data, not a startup instruction program.

B. Trojan horse – Appears legitimate but contains malicious code; adware is different.

C. Worm – Self-replicating program spreading across networks; not a keystroke logger.

Key Concept: Cyber fraud and malware types.

Detailed Explanation:

Rationale for Correct Answer:In fictitious revenue schemes, sales are recorded that never occurred. Because no actual customers exist, there will be no late or overdue accounts receivable. The Fraud Examiners Manual (2020) notes that unusually clean receivables aging reports—i.e., no overdue balances—can be a red flag of revenue manipulation.

Analysis of Incorrect Option:

B. False – Incorrect; the absence of overdue receivables is indeed suspicious and aligns with fictitious revenue fraud.

Key Concept: Financial statement fraud red flags — fictitious revenues.

Detailed Explanation:

Rationale for Correct Answer:This statement is False. Shrinkage is a general term for unaccounted-for inventory losses, and it can indeed result from theft, errors, damage, or waste. To say shrinkage does not result from theft is misleading because theft is one of its primary causes.

Analysis of Incorrect Options:

A. True – Incorrect, as theft is often a major contributor to shrinkage.

B. False – Correct, since shrinkage can include theft.

Key Concept:Shrinkage includes theft as a cause of unexplained inventory loss.

Detailed Explanation:

Rationale for Correct Answer:The accounting definition of assets, as cited by Marshall and in GAAP frameworks, is “probable future economic benefits obtained or controlled by a particular entity as a result of past transactions or events.” This definition underlies balance sheet recognition of assets.

Analysis of Incorrect Options:

B. Liabilities – Represent probable future sacrifices, not benefits.

C. Credentials – Irrelevant to financial reporting.

D. None of the above – Incorrect since “assets” directly matches.

Key Concept:Definition of Assets under financial accounting frameworks.

Detailed Explanation:

Rationale for Correct Answer: Financial statement fraud typically involves overstating assets or revenues (e.g., inflating inventory, recognizing fictitious sales) and understating liabilities or expenses (e.g., hiding obligations, capitalizing expenses). This combination enhances profitability and net worth, misleading stakeholders.

Analysis of Incorrect Options:

A – Understating assets/revenue is rare since fraud usually aims to inflate results.

C – Overstating both assets and liabilities would not improve financial performance.

D – Understating both would reduce reported performance, contrary to typical fraud objectives.

Key Concept: Common patterns in financial statement fraud.

Detailed Explanation:

Rationale for Correct Answer: A disproportionate increase in COGS without a corresponding increase in sales is a red flag for inventory theft or misappropriation. Theft reduces ending inventory, which artificially inflates COGS, while sales remain unchanged or grow modestly.

Analysis of Incorrect Options:

A – Warranty liabilities affect expenses, not COGS.

B – Fewer sales would reduce both revenue and COGS proportionally, not cause a large disparity.

C – Sales returns reduce revenue, not inflate COGS.

Key Concept: Using analytical review to detect inventory theft via COGS anomalies.

Detailed Explanation:

Rationale for Correct Answer:Hollinger and Clark’s research emphasized that management policy should focus on: (1) developing a clear understanding of theft behavior and its causes, and (2) enforcing sanctions consistently. Both are necessary to reduce employee deviance and occupational fraud. Thus, C. Both A & B is correct.

Key Concept:Hollinger-Clark Study — policy implications for managing employee theft.

Detailed Explanation:

Rationale for Correct Answer:Prenumbering and controlling shipping documents is a strong preventive measure against inventory theft because it ensures all inventory leaving the warehouse is properly authorized and tracked.

Analysis of Incorrect Options:

A. Same person for requisition and receiving – Violates segregation of duties.

B. Purchasing supervisor counting inventory – Creates conflict; inventory should be counted by independent staff.

D. Same person for shipping and scrap – Increases fraud risk.

Key Concept: Inventory theft prevention — control over documentation.

Comprehensive and Detailed Explanation

Definition of Upcoding (ACFE Manual Reference)

The ACFE Manual identifies upcoding as a type of health care billing fraud in which the provider submits a claim for a more expensive or more complex service than what was actually provided.

Although the exact term “upcoding” appears within the health care fraud discussions, the broader category is part of Financial Transactions and Fraud Schemes concerning fraudulent billing practices. The manual describes fraud schemes in which the perpetrator:

Bills for services not provided,

Bills for more expensive services than were actually delivered, or

Uses codes that misrepresent the level or nature of medical procedures.

Upcoding specifically involves:

Billing for a higher-cost procedure than what was actually performed, by using a code representing a more expensive service.

Why Option D Is Correct

Dr. Raul advised a patient with a small fracture to use crutches, but he submitted a claim using a code indicating that he placed a cast on the patient.

Actual service: Advice and crutches

Billed service: Application of a cast (more expensive procedure)

This is a textbook example of upcoding, as the provider is using a higher-cost CPT code to obtain greater reimbursement than the service warrants.

Why the Other Options Are Incorrect

Option A – Not Upcoding

Cindy receives a payment to undergo an unnecessary procedure, which is then billed fraudulently.

This is medically unnecessary services fraud, not upcoding.

Option B – Not Upcoding

Dr. Loomis uses three procedure codes instead of one.

This is an example of unbundling, which involves billing separate codes for procedures that should be billed as a single package.

Option C – Not Upcoding

Landon inflates the amount of a medical bill he wants reimbursed.

This is billing inflation or overstatement, but not misrepresentation via coding.

ACFE Manual Supporting Reference

The Manual’s section on fraudulent billing schemes discusses cases where perpetrators misrepresent medical procedures, including using false or inflated codes to obtain higher reimbursements.

Rationale for Correct Answer:Sampling is a fraud examination technique that enables investigators to review a subset of documents rather than all records. Properly designed sampling provides reasonable assurance and allows focus on anomalies or red flags.

Key Concept:Sampling in fraud examination and audit testing.

Detailed Explanation:

Rationale for Correct Answer:Skimming is difficult to detect because the stolen cash is never recorded (“off-book”). Therefore, it is often discovered by accident — such as customer complaints, discovery of missing deposits, or unexpected reconciliations — rather than through audits or routine controls.

Analysis of Incorrect Options:

A. Internal audits – Effective for many frauds but weak at uncovering skimming because records appear normal.

C. Internal controls – Preventive controls may deter but cannot detect unrecorded theft.

D. Occupational frauds – Too broad and not a detection method.

Key Concept:Detection of Skimming — most often accidental.

Detailed Explanation:

Rationale for Correct Answer: Blank plastic cards are a common basis for counterfeit card production. Fraudsters encode stolen magnetic stripe or chip data onto blank cards.

Analysis of Incorrect Options:

A – False; holograms are designed to be difficult to reproduce.

B – False; high-speed printers and embossers make counterfeiting easier, not harder.

D – Incorrect, since A and B are false.

Key Concept: Counterfeit card fraud methods.

Detailed Explanation:

Rationale for Correct Answer:Simply holding two jobs without disclosure is not inherently a conflict of interest unless the roles compete, overlap, or present divided loyalties. The other options all describe undisclosed financial or relational interests that conflict with the employer’s best interest.

Analysis of Incorrect Options:

A. Harriet’s stock ownership – Direct financial conflict.

C. Jennifer’s board positions – Competing loyalties between competitors.

D. Ernest hiring his brother – Nepotism without disclosure is a conflict.

Key Concept: Conflict of interest schemes in corruption.

Detailed Explanation:

Rationale for Correct Answer:Intangible assets are long-lived assets that lack physical substance and differ from property, plant, and equipment. Examples include goodwill, patents, trademarks, and copyrights. They provide long-term benefits but cannot be physically touched.

Analysis of Incorrect Options:

A. Tangible Assets – These have physical form (e.g., equipment, land).

C. Forced Assets – Not an accounting category.

D. None of the above – Incorrect since intangible assets match the definition.

Key Concept:Classification of Assets — tangible vs. intangible.

Detailed Explanation:

Rationale for Correct Answer:Perpetual inventory systems maintain a continuous, running balance of inventory on hand. They are updated with each purchase and sale, providing a theoretical count at all times. Discrepancies between perpetual and physical counts may indicate theft, errors, or fraud.

Analysis of Incorrect Options:

A. Altered inventory – Fraudulent manipulation, not a system.

C. Shrinking inventory – Refers to shrinkage, not the system.

D. Fictitious inventory – Fraudulent reporting, not a legitimate system.

Key Concept:Perpetual inventory systems as internal controls.

Detailed Explanation:

Rationale for Correct Answer:This is True. Fraudulent financial reporting often involves manipulating depreciation. By lowering or delaying depreciation expense, companies can inflate profits and overstate asset values. This is a common method of financial statement fraud related to earnings management.

Analysis of Incorrect Options:

B. False – Incorrect, as understatement of depreciation clearly inflates reported profits.

Key Concept:Depreciation Manipulation in Financial Statement Fraud.

Detailed Explanation:

Rationale for Correct Answer:Bid-rigging occurs when an employee or official manipulates the competitive bidding process to ensure a specific vendor wins the contract. This may involve sharing confidential information, suppressing competition, or tailoring bid specifications.

Analysis of Incorrect Options:

B. Does not assist – Opposite of fraud; no scheme.

C/D. Once assists… – Bid-rigging is systemic, not limited to one occurrence.

Key Concept:Bid-rigging schemes — corruption in procurement processes.

Detailed Explanation:

Rationale for Correct Answer:According to the Fraud Examiners Manual (2020 International Edition), offenders can be categorized into types. Absconders are individuals who commit fraud and immediately flee with the proceeds (“take the money and run”). They differ from long-term violators who maintain their frauds for extended periods while concealing them. Thus, the correct answer is A. Absconders.

Analysis of Incorrect Options:

B. Long-term violators – These offenders commit frauds over a long period and often maintain their positions of trust while continuing the scheme.

C. Offender types – Too vague; not a specific classification.

D. None of the above – Incorrect, since “Absconders” directly matches.

Key Concept:Offender Typologies — distinguishing between absconders and long-term violators in occupational fraud.

Detailed Explanation:

Rationale for Correct Answer: Human intelligence (HUMINT) involves gathering information directly from people, often through deception, elicitation, or impersonation. Georgina’s posing as a customer to obtain confidential details fits this method.

Analysis of Incorrect Options:

B. Baiting – A social engineering tactic using false promises (e.g., malware disguised as freebies).

C. Scavenging – Collecting discarded information (e.g., dumpster diving).

D. Open-source intelligence – Gathering data from public records, news, or websites, not through elicitation.

Key Concept: Methods of competitive intelligence and social engineering.

Detailed Explanation:

Rationale for Correct Answer: Properly shredded documents using a cross-cut shredder are very difficult to reconstruct, making them not a common medium for information leaks. By contrast, shareholder reports, executive speeches, and workstation displays often contain sensitive data that can be exploited by competitors or fraudsters.

Analysis of Incorrect Options:

A – Shareholder reports can reveal strategy and financial vulnerabilities.

C – Executive speeches sometimes unintentionally disclose sensitive plans.

D – Information left visible at workstations is a known security risk.

Key Concept: Protection of proprietary information against espionage and fraud.

Detailed Explanation:

Rationale for Correct Answer:For fraud to exist, several legal elements must be established. These include: (1) a material false statement made by the perpetrator, (2) knowledge of the falsity of that statement (scienter or intent to deceive), and (3) reliance on the false statement by the victim, resulting in harm or damages. The Fraud Examiners Manual (2020 International Edition) explains that all elements must be present for a fraud case to be sustained. Thus, the correct answer is D. All of the above.

Analysis of Incorrect Options (Distractors):

A. A material false statement – A false statement alone is insufficient unless there is intent to deceive and victim reliance.

B. Knowledge that the statement was false when it was uttered – Intent is critical, but without the victim’s reliance and damages, fraud is incomplete.

C. Reliance on the false statement by the victim – Victim reliance is necessary, but without a knowingly false statement and intent, fraud cannot be proven.

Key Concept:The essential legal elements of fraud.

Detailed Explanation:

Rationale for Correct Answer:Upcoding occurs when a provider bills for a higher level of service than what was actually provided. Billing a 15-minute visit as a 60-minute visit is a classic upcoding scheme.

Analysis of Incorrect Options:

A. Name brand prescription – Not upcoding; this is prescribing choice, not billing fraud.

B. Multiple codes instead of one – This is unbundling, not upcoding.

D. Changing service date – This is falsifying service dates, not upcoding.

Key Concept: Health care billing fraud — upcoding vs. unbundling.

Detailed Explanation:

Rationale for Correct Answer:In a legitimate competitive bidding process, all bidders must be treated equally, with the same access to information, terms, and conditions. This ensures fairness and prevents procurement fraud.

Analysis of Incorrect Options:

A. Bid-rigging – The manipulation of competitive bidding, not the fair process.

B. Kickbacks – Involve secret payments, not equal bidding.

D. Bid solicitation – The stage of inviting bids, not the equal treatment requirement.

Key Concept:Competitive bidding — foundation of fairness in procurement.

Detailed Explanation:

Rationale for Correct Answer:Ponzi schemes differ from pyramid schemes. In Ponzi schemes, investors are paid returns from funds contributed by later investors, not based on recruiting new investors. Recruiting-based payouts are a characteristic of pyramid schemes, not Ponzi schemes.

Analysis of Incorrect Options:

A. Legitimate investment belief – True; victims believe the investment is genuine.

B. High returns promised – Classic Ponzi hallmark.

D. Minimal valid commerce – Ponzi promoters often fake or exaggerate legitimate investments.

Key Concept: Difference between Ponzi schemes and pyramid schemes.

Detailed Explanation:

Rationale for Correct Answer:In sound internal controls, the person initiating electronic payments should not also be responsible for setting filters or approving transactions. This creates a segregation of duties violation. Therefore, statement D is false.

Analysis of Incorrect Options:

A. Positive pay for ACH – True; it helps verify transactions.

B. ACH blocks – Correct; a control against unauthorized debits.

C. Lack of physical evidence – True; electronic fraud lacks paper trails, making detection harder.

Key Concept: Electronic payment tampering controls.

Detailed Explanation:

Rationale for Correct Answer: Affinity fraud occurs when fraudsters exploit trust within identifiable groups—such as religious, ethnic, or professional communities—making members more susceptible to deception.

Analysis of Incorrect Options:

B – Social control fraud relates to control fraud by institutions, not religious targeting.

C – Bait and switch is a deceptive sales tactic, not specific to religious groups.

D – Advance-fee scams may target anyone, not specifically religious communities.

Key Concept: Affinity fraud as a corruption/exploitation scheme.

Detailed Explanation:

Rationale for Correct Answer:Bid tailoring occurs when procurement officials structure contract requirements to unfairly favor a particular vendor. A hallmark red flag is unusually narrow specifications, which restrict competition.

Analysis of Incorrect Options:

A. Clear submission information – Standard and appropriate, not a red flag.

C. Rebid contracts – Could indicate limited interest, but not tailoring.

D. Numerous bidders – Indicates competition, opposite of bid tailoring.

Key Concept: Procurement fraud — bid tailoring.

Detailed Explanation:

Rationale for Correct Answer:The Asset Turnover Ratio measures how efficiently a company uses its assets to generate revenue. It is calculated as Net Sales ÷ Average Total Assets. Higher ratios indicate better efficiency.

Analysis of Incorrect Options:

A. Quick ratio – Liquidity ratio, not asset efficiency.

B. Receivable turnover ratio – Measures efficiency in collecting receivables, not overall asset use.

C. Debt-to-equity ratio – Capital structure metric, not efficiency.

Key Concept: Financial ratio analysis — asset utilization efficiency.

Detailed Explanation:

Rationale for Correct Answer:

Detailed Explanation:

Rationale for Correct Answer:Under GAAP, revenue is recognized when it is realized or realizable and earned. This requires that the earnings process be substantially complete, and payment be reasonably assured.

Analysis of Incorrect Options:

B. Fictitious and Earned – Fictitious revenues are fraud, not recognized revenue.

C. Realized and Evidenced – Evidence supports recognition, but “earned” is the proper standard.

D. All of the above – Incorrect, since only option A is correct.

Key Concept:Revenue recognition principle — realized/realizable and earned.

Detailed Explanation:

Rationale for Correct Answer:Common skimming schemes include unrecorded sales, theft of incoming checks, and understating sales/receivables. “Fraud & Cost” is not a recognized skimming scheme and appears to be a distractor.

Analysis of Incorrect Options:

A. Unrecorded sales – A classic skimming method.

C. Theft of checks through the mail – Another recognized skimming approach (incoming receivables).

D. Understated sales and receivables – A concealment method within skimming schemes.

B. Fraud & Cost – Not a scheme classification.

Key Concept:Skimming schemes vs. unrelated distractors.

Comprehensive and Detailed Explanation From the ACFE Fraud Examiners Manual

Why the correct answer is Human Intelligence

The ACFE Fraud Examiners Manual, in the section on fraud examination tools and intelligence gathering, discusses methods of obtaining information from individuals. One of the recognized methods is Human Intelligence (HUMINT).

The Manual explains that human intelligence gathering involves:

Collecting information directly from people—often through conversation, elicitation, or interviews—sometimes while using a pretext to encourage the target to disclose information.

In this scenario:

Georgina poses as a customer (a pretext),

Contacts an employee of ERO Corp., and

Elicits sensitive information directly from that individual.

This aligns perfectly with the definition of human intelligence gathering—information obtained directly from human sources, often under false pretenses.

Why the other options are incorrect

B. Scavenging – Incorrect

The Manual describes scavenging as:

Obtaining information by searching for discarded documents or materials, such as in trash or recycling bins.

Georgina is not going through discarded materials; she is speaking directly with an employee.

C. Baiting – Incorrect

Baiting typically refers to:

Enticing someone with something of value to trick them into taking an action, often involving malware-infected media or fraudulent offers.

Georgina is not offering anything or luring the employee with incentives.

D. Open-source intelligence – Incorrect

Open-source intelligence (OSINT) refers to gathering information from:

Publicly available sources such as websites, publications, databases, or social media.

Georgina is not using public sources; she is actively eliciting confidential information from a person under false pretenses.

ACFE Manual References

The concepts used in this answer derive from the Fraud Examiners Manual (2020 International Edition), including:

Human intelligence and data collection techniques

Scavenging as an investigative method

Baiting schemes

Open-source intelligence descriptions

Detailed Explanation:

Rationale for Correct Answer:An underring occurs when an employee intentionally enters a lower sales amount into the register than what was collected from the customer. The difference is pocketed by the employee. This is a common register manipulation skimming scheme.

Analysis of Incorrect Options:

B. Recording a sale procedure – General process, not fraud.

C. Internal sales audits – Control activity, not the fraud scheme.

D. All of the above – Incorrect, since only “underring” is accurate.

Key Concept:Underring schemes in cash register fraud.

Detailed Explanation:

Rationale for Correct Answer:Net realizable value (NRV) is the estimated selling price of an asset in the ordinary course of business, minus any costs of completion, disposal, or transportation. This is often applied in valuing accounts receivable and inventory.

Analysis of Incorrect Options:

B. Going concern – Assumption of business continuity, not asset valuation.

C. Cost – Historical cost, not future realizable value.

D. Fair value – Current market-based measure, not net proceeds after costs.

Key Concept:Net realizable value — valuation method for receivables and inventory.

Detailed Explanation:

Rationale for Correct Answer: One of the strongest internal controls against fraudulent billing schemes (such as shell companies, inflated invoices, and kickbacks) is to require competitive bidding. This ensures transparency, reduces favoritism, and makes it harder for employees and vendors to collude.

Analysis of Incorrect Options:

A – Fraud tips are valuable, but routing them only through supervisors may suppress reporting; hotlines are more effective.

B – Combining purchasing and payment increases fraud risk by reducing segregation of duties.

D – Outsourcing negotiations does not directly prevent billing fraud.

Key Concept: Internal controls and segregation of duties in preventing billing schemes.

Detailed Explanation:

Rationale for Correct Answer:This scheme is known as a Turnaround Sale or Flip. The employee secretly purchases an asset their employer needs and then resells it to the employer at a markup, thereby profiting at the employer’s expense.

Analysis of Incorrect Options:

A. Conflict of interest in sale – Too general; does not describe the flipping mechanism.

C. Unauthorized sale – Not an ACFE fraud category in this context.

D. Written sale of unique assets – Not a recognized scheme.

Key Concept: Conflict of Interest scheme — Turnaround Sales/Flips.

Detailed Explanation:

Rationale for Correct Answer: This is third-party fraud, where someone uses another person’s identity (often a relative or acquaintance) to obtain services or benefits they are not entitled to, such as medical treatment under another’s insurance.

Analysis of Incorrect Options:

A. Misrepresentations fraud – Usually involves false information by a legitimate patient or provider.

B. Fictitious claims fraud – Involves billing for services that never occurred.

D. Multiple claims fraud – Involves submitting duplicate claims for the same service.

Key Concept: Health care fraud typologies – patient third-party impersonation.

Detailed Explanation:

Rationale for Correct Answer:This is a Pass-through scheme, a type of Conflict of Interest under the corruption category. In this scheme, the employee sets up a shell company to act as a vendor. The shell purchases goods from legitimate suppliers and resells them to the employer at inflated prices. Pilar’s actions align perfectly with this definition.

Analysis of Incorrect Options:

A. Need recognition scheme – Involves manipulating an employer’s need to justify a purchase, not reselling via a shell.

B. Pay and return scheme – A fraudulent disbursement scheme where overpayments are made and refunds diverted. Not applicable here.

D. Cash larceny scheme – Involves theft of incoming cash, unrelated to vendor fraud.

Key Concept: Pass-through scheme (Conflict of Interest within Corruption).

Detailed Explanation:

Rationale for Correct Answer: Social engineering involves manipulating or deceiving people into revealing confidential information or taking actions that aid the attacker (e.g., clicking malicious links, sharing credentials). It targets human weaknesses rather than technical vulnerabilities.

Analysis of Incorrect Options:

A. IP spoofing – Forging an IP address to disguise origin.

B. Electronic piggybacking – Unauthorized use of someone else’s access connection.

C. Packet sniffing – Monitoring data traffic across a network.

Key Concept: Cyberfraud techniques – social engineering.

Comprehensive and Detailed Explanation

Why the correct answer is: False accounting entry

According to the ACFE Fraud Examiners Manual – Financial Transactions and Fraud Schemes, under Financial Institution Fraud → Types of Embezzlement Schemes, the Manual provides explicit descriptions of relevant banking fraud schemes, including false accounting entries.

The Manual lists False Accounting Entries as a form of embezzlement in which an employee manipulates general ledger accounts or other accounting records to conceal a theft or unauthorized activity:

“False Accounting Entries” are specifically categorized as a type of embezzlement scheme used by dishonest bank employees to hide misappropriated funds.

In this question, the accountant:

Adjusted the bank’s general ledger

With the intent to conceal the theft of customer funds

This aligns exactly with the ACFE definition of false accounting entries, which involve altering legitimate financial records to hide fraudulent actions.

Therefore, the best ACFE-defined description of the scheme is:

→ False accounting entry (Option B)

Why the other options are incorrect

A. Unauthorized withdrawal

The Manual separately defines Unauthorized Withdrawals as a type of embezzlement in which a bank employee directly removes funds from accounts without permission:

“Unauthorized Withdrawals” are listed as a distinct embezzlement scheme involving unapproved removal of customer funds.

However, in this scenario, the defining act is manipulating ledger records, not simply withdrawing funds. The nature of the concealment technique makes false accounting entry the correct classification.

C. Moving money from inactive accounts

The Manual defines:

“Moving Money from Customers’ Dormant or Inactive Accounts” as a scheme in which employees transfer funds from inactive accounts to themselves.

In this question, the stolen funds come from an active customer account, so this option does not apply.

D. Unauthorized disbursement of funds

The Manual includes:

“Unauthorized Disbursement of Funds to Outsiders” as another type of financial institution fraud.

This refers to payments made to external parties without authorization—not to ledger manipulation to hide theft.

Again, the defining characteristic in the scenario is the use of false ledger entries, which makes Option B the most accurate according to ACFE terminology.

Detailed Explanation:

Rationale for Correct Answer: An air loan is a mortgage fraud scheme where the borrower and sometimes insiders create completely fictitious properties or borrowers. Here, the nonexistent property and loan proceeds being pocketed fits this definition.

Analysis of Incorrect Options:

A. Property flopping – Involves short sales and undervaluing distressed property.

C. Phantom lien – False liens filed to collect fraudulent claims on real estate.

D. Daisy chain – Involves multiple property transactions between conspirators to inflate value.

Key Concept: Loan fraud schemes – fictitious property loans (air loans).

Detailed Explanation:

Rationale for Correct Answer:Skimming is defined as the theft of cash before it is recorded in the books. Because the stolen funds are never entered into the accounting system, this is often referred to as an “off-book” fraud. It is distinct from cash larceny, which occurs after cash has been recorded.

Analysis of Incorrect Options:

B. The addition of cash – Incorrect; skimming involves removal, not addition.

C. Removal after entry – This describes cash larceny, not skimming.

D. None of above – Incorrect since option A is correct.

Key Concept:Skimming schemes — off-book cash theft.

Detailed Explanation:

Rationale for Correct Answer:Filing a claim shortly after a policy begins is a classic red flag of potential insurance fraud, as it may indicate the loss occurred before coverage or is fabricated.

Analysis of Incorrect Options:

B. One prior claim in five years – Not unusual by itself.

C. Small electronics/jewelry – Common theft items, not automatically suspicious.

D. Recently purchased items with receipts – Strong documentation actually supports legitimacy.

Key Concept: Insurance fraud red flags.

Detailed Explanation:

Rationale for Correct Answer:Revenue recognition requires that delivery has occurred or services have been rendered. If installation, testing, and customer acceptance have not occurred (A), or if a written order exists but with a right of return (B), delivery is not considered complete. Both scenarios prevent proper revenue recognition. Hence, the correct answer is C. Both A & B.

Analysis of Incorrect Options:

A – Correct condition, but incomplete.

B – Correct condition, but incomplete.

D. Neither A nor B – Incorrect, as both conditions do prevent recognition.

Key Concept:Revenue recognition fraud risks — recognizing revenue prematurely.

Detailed Explanation:

Rationale for Correct Answer:Fraudulent schemes involving returns and allowances can be detected by analyzing accounts for unusually high transactions in these categories. This is a common red flag for concealment of theft or manipulation of sales.

Analysis of Incorrect Options:

A. Allowances by vendors – Too narrow, not a standard analytic test.

B. Disposals of allowances than reorders – Not a recognized search method.

D. None of the above – Incorrect, since option C is valid.

Key Concept:Returns and allowances analysis for fraud detection.

Detailed Explanation:

Rationale for Correct Answer:The matching principle under GAAP requires that revenues and the corresponding expenses incurred to generate those revenues be recorded in the same period. Failing to do so misstates income and violates accrual accounting.

Analysis of Incorrect Options:

B. Revenue and Income statement – The income statement is a report, not an item to be matched.

C. Income statement and Long-term contracts – Long-term contracts follow special rules (percentage of completion, completed contract), not the general matching principle.

D. Capitalized expenses and Liabilities – Not part of the matching principle.

Key Concept:Matching Principle — recording related revenues and expenses in the same period.

Detailed Explanation:

Rationale for Correct Answer:This statement is True. ACFE research shows that external audits, while valuable, are generally not effective at detecting fraud quickly. Organizations with only external audits often experience higher median losses and longer-lasting schemes compared to those with stronger internal controls and fraud-specific detection mechanisms. External audits are not designed to catch fraud; their focus is on financial statement accuracy.

Key Concept:Effectiveness of External Audits in fraud detection versus prevention and internal controls.

Detailed Explanation:

Rationale for Correct Answer:Shrinkage refers to discrepancies between physical inventory counts and perpetual inventory records. Causes include theft, errors, waste, or fraud. It is one of the most common indicators of asset misappropriation.

Analysis of Incorrect Options:

A. Altered inventory – Not a recognized accounting term.

B. Account receivable – Unrelated to inventory.

D. Write-offs – A corrective accounting entry, not the variance itself.

Key Concept:Inventory shrinkage as a red flag for fraud.

Rationale for Correct Answer:The price-level adjusted historical cost method adjusts the original purchase price of an asset for inflation, providing a more current value while still tied to historical cost principles. It addresses one of the limitations of strict historical cost accounting.

Key Concept:Inflation adjustments in asset valuation.

Detailed Explanation:

Rationale for Correct Answer:The most basic skimming scheme is when an employee completes a legitimate sale, collects payment, but never records the transaction. The stolen cash is never entered in the books, making it an “off-book” fraud.

Analysis of Incorrect Options:

B & D – Describe purchasing scenarios, irrelevant to skimming.

C – Records the sale, meaning the transaction enters the books (not skimming).

Key Concept:Unrecorded Sales as the simplest form of skimming.

Detailed Explanation:

Rationale for Correct Answer:The balance sheet provides a snapshot of a company’s financial position at a specific date. It shows assets, liabilities, and equity, allowing stakeholders to assess book value and solvency.

Analysis of Incorrect Options:

A. Equity – A component of the balance sheet, not the full report.

C. Income statement – Shows performance over a period, not book worth at a date.

D. Financial record – Too general.

Key Concept:Balance Sheet as a tool for determining book worth at a point in time.

Detailed Explanation:

Rationale for Correct Answer:Baiting is a social engineering tactic where fraudsters leave infected flash drives or storage media in public areas, hoping victims will plug them in, unknowingly installing malware. This is an accurate description.

Analysis of Incorrect Options:

A. Pharming – Involves redirecting users from legitimate websites to fraudulent ones, not mail redirection.

B. Dumpster diving – Searching physical trash for sensitive information, not computers from resellers.

C. Shoulder surfing – Observing someone’s screen or keystrokes, not access exploitation.

Key Concept: Identity theft techniques.

Detailed Explanation:

Rationale for Correct Answer:Insurer health care fraud occurs when the insurance company itself engages in deception for financial gain. Submitting inflated cost data to regulators in order to justify rate increases is a direct example of insurer fraud.

Analysis of Incorrect Options:

A. Intermediary verifying claims – Proper procedure, not fraud.

C. Passing on negotiated rates – Legitimate practice.

D. Denying incomplete claims – May be harsh, but not fraudulent.

Key Concept: Insurer fraud vs. provider or claimant fraud.

Detailed Explanation:

Rationale for Correct Answer:When a single employee is responsible for opening the mail and recording payments, the risk of theft of incoming checks is greatest. This lack of segregation of duties allows one person both custody of funds and recordkeeping authority, a classic internal control weakness.

Analysis of Incorrect Options:

B & C – Involving two or more employees provides better segregation of duties, reducing the risk.

D. None of the above – Incorrect since option A directly matches.

Key Concept:Segregation of duties to prevent skimming/theft of incoming checks.

Detailed Explanation:

Rationale for Correct Answer:Larceny by fraud (often termed “theft by deception”) occurs when someone unlawfully obtains another’s property by deception rather than by direct taking. As defined in fraud examination principles, deception can involve: (1) creating or reinforcing a false impression, (2) failing to correct a false impression, or (3) failing to disclose material facts such as liens or adverse claims. Because all three scenarios represent deceptive means to unlawfully take property, the correct answer is D. All of the above.

Analysis of Incorrect Options:

A, B, C each describe valid examples of fraud by deception but individually do not fully capture the concept.

D encompasses the totality of recognized deceptive practices under larceny by fraud.

Key Concept:Fraud by deception as an element of theft and misappropriation.

Detailed Explanation:

Rationale for Correct Answer: Finding personal checks in the cash register is unusual, but it does not specifically indicate a register disbursement scheme (such as false refunds or voids). The other options are classic red flags for such schemes.

Analysis of Incorrect Options:

A – Missing transaction numbers suggest manipulation.

C – Excessive voids near approval limits indicate fraud concealment.

D – Allowing cashiers to void their own sales creates opportunity for abuse.

Key Concept: Register disbursement schemes and their red flags.

Detailed Explanation:

Rationale for Correct Answer:In a fraudulent purchase scheme, the company legitimately purchases assets, but the fraudster diverts or misappropriates them after acquisition. The purchase itself is real, but the use of the assets is fraudulent.

Analysis of Incorrect Options:

A. Inventory larceny scheme – Direct theft without purchase.

B. Asset receiving scheme – Not a recognized fraud scheme.

D. Falsify shipping – Involves falsifying shipment records, not post-purchase misappropriation.

Key Concept:Fraudulent purchases — assets are bought legitimately but stolen afterward.

Detailed Explanation:

Rationale for Correct Answer:Disclosure is required whenever individuals in positions of trust are indicted or otherwise compromised. Transparency ensures stakeholders are aware of potential conflicts or risks.

Analysis of Incorrect Options:

A. Conflict of interest – A scheme, not the corrective measure.

B. Turnaround sale or flip – Specific scheme, irrelevant here.

D. Resource diversion – A fraud method, not a governance requirement.

Key Concept: Importance of Disclosure in preventing or responding to conflicts of interest.

Detailed Explanation:

Rationale for Correct Answer: This is personal purchases with company funds, where an employee uses company resources to acquire goods or services for personal benefit. Baker used ABC’s funds to buy supplies for home improvements.

Analysis of Incorrect Options:

A. Pay and return scheme – Involves overpaying a vendor and pocketing the refund.

C. Pass-through scheme – Involves using a controlled company to bill the employer at inflated prices.

D. Theft of inventory – Involves stealing company stock, not purchasing items for personal use.

Key Concept: Fraudulent disbursement – billing fraud through unauthorized personal purchases.

Detailed Explanation:

Rationale for Correct Answer:Option B is NOT a typical fraud-related aspect of inventory purchases. An increase in year 2 inventory being greater than year 1 is not, by itself, an indicator of fraud — it could reflect growth. However:

A describes “inventory build-up and liquidation” schemes,

C highlights mismatches between sales and purchases,

D acknowledges possible fraud schemes.

Analysis of Incorrect Options:

A – Recognized fraud indicator.

C – Suggests fictitious sales or revenue manipulation.

D – Correctly signals potential fraud.

Key Concept:Red flags in inventory purchases and mismatched patterns.

Detailed Explanation:

Rationale for Correct Answer:One of the most effective ways to protect proprietary information is educating employees about nondisclosure agreements (NDAs) at onboarding and again during exit. This ensures awareness of confidentiality obligations.

Analysis of Incorrect Options:

A. Changing locks/codes every 3–5 years – Reasonable security but insufficient for safeguarding proprietary information.

B. Classifying data by years of service – Not a sound security practice; access should be based on role and need-to-know.

D. Requiring notes/drafts – Increases risk of information leaks, not protection.

Key Concept: Proprietary information protection.