Free Practice Questions for the ACFE Certified Fraud Examiner CFE-Fraud-Schemes-and-Financial-Crimes Exam (2026 Updated)

Detailed Explanation:

Rationale for Correct Answer: The balance sheet summarizes account balances from the ledger at a specific date, presenting assets, liabilities, and equity. It reflects the organization’s financial position and is derived from ledger balances.

Analysis of Incorrect Options:

B. Income statement – Summarizes revenues and expenses, not all ledger balances.

C. Financial statement – A general term, but the specific answer here is balance sheet.

D. General journal – Book of original entry, not a summary.

Key Concept: Balance sheet as a summary of ledger accounts.

Detailed Explanation:

Rationale for Correct Answer: Upcoding occurs when a provider bills for a higher level of service than what was actually provided. Billing a 15-minute visit as a 60-minute visit is a classic upcoding scheme.

Analysis of Incorrect Options:

A. Name brand prescription – Not upcoding; this is prescribing choice, not billing fraud.

B. Multiple codes instead of one – This is unbundling , not upcoding.

D. Changing service date – This is falsifying service dates , not upcoding.

Key Concept: Health care billing fraud — upcoding vs. unbundling.

Detailed Explanation:

Rationale for Correct Answer: Studies by the ACFE consistently show that inventory and equipment are the most commonly misappropriated noncash assets. They are highly liquid, valuable, and often difficult to monitor without strong controls.

Analysis of Incorrect Options:

A. Interest & Collusion – Not physical assets.

C. Inventory & Purchase – Purchase is a process, not a physical asset.

D. Sales & Equipment – Sales are transactions, not assets.

Key Concept: Noncash asset misappropriation — inventory and equipment are the primary targets.

The correct answer is A. A ghost employee scheme involves adding a fictitious or nonworking person to the payroll so the fraudster can collect wages or salary payments. Data analysis can help detect ghost employees by identifying duplicate, invalid, or suspicious employee information. Multiple employees using the same government or tax identification number is a strong red flag because legitimate employees should generally have unique identifying numbers. Payment tampering involves altering payments after they are initiated, while falsified hours and salary schemes usually involve overstated time worked or unauthorized pay-rate changes for real employees. Fraudulent commission schemes involve manipulating sales or commission records. The ACFE materials specifically identify duplicate government identification numbers as a test for ghost employee schemes.

================

Detailed Explanation:

Rationale for Correct Answer: Recognized schemes for stealing inventory include:

Larceny schemes (direct theft)

Asset requisition and transfer schemes (false requisitions to divert assets)

Purchasing and receiving schemes (over-ordering or falsifying deliveries).

“ Sales & Equipment handling ” is not a defined fraud scheme, making D correct.

Analysis of Incorrect Options:

A. Larceny schemes – Valid theft method.

B. Asset requisition and transfer – Document manipulation method.

C. Purchasing and receiving schemes – Valid misappropriation scheme.

Key Concept: Inventory theft schemes under the Fraud Tree.

The correct answer is C. Electronic payment tampering occurs when an employee improperly alters or creates electronic payments, such as ACH payments, wire transfers, or online banking payments. Reviewing non-payroll payments made to employees is highly effective because employees generally should not receive vendor-style electronic disbursements outside normal payroll or approved reimbursement channels. Such payments can indicate that an employee inserted their own bank account, created an unauthorized payee, or diverted electronic funds. Vendor duplicate confirmations are more relevant to duplicate-payment issues. Customer complaints about late account postings relate more to cash receipts or accounts receivable. Quarterly reconciliations are too infrequent for timely detection. The ACFE materials identify electronic payment tampering as a fraudulent disbursement risk requiring strong monitoring and bank controls.

================

The ACFE Fraud Examiners Manual (2020 International Edition) , under the section on Information Security in Electronic Commerce Systems , describes the three primary security goals that must be achieved to protect users and account holders:

Confidentiality

Integrity

Availability

These three goals form the cornerstone of information system protection and are often referred to as the CIA triad .

1. Confidentiality

Confidentiality ensures that sensitive information is accessible only to authorized individuals. The Manual highlights that e-commerce systems must protect customers’ personal and financial data from unauthorized access.

2. Integrity

Integrity requires that the information in the system is accurate and has not been improperly altered. This prevents fraudulent manipulation of records, transactions, and account balances.

3. Availability

Availability ensures that systems and data are accessible to authorized users when needed. This includes preventing disruptions caused by system failures, denial-of-service attacks, or internal sabotage.

These three goals are explicitly documented in the ACFE Manual as essential security requirements for safeguarding electronic financial systems.

Why Option C is the Correct Answer

“Penetrability of data” is NOT an information security goal.

In fact, it is the opposite of what an information security framework seeks to achieve. No section of the ACFE Manual identifies "penetrability" as a required or legitimate objective. Instead, systems should be resistant to penetration attempts.

Thus, Option C does not belong to the CIA model or any ACFE-described security framework.

ACFE Manual Reference

These concepts are covered in the Financial Transactions and Fraud Schemes section discussing information security objectives for e-commerce environments, which identifies confidentiality, integrity, and availability as the foundational goals of secure systems.

The correct answer is A. Financial statement disclosures are required when information is necessary for users to understand the entity’s financial position and risks. Potential losses from ongoing litigation generally must be disclosed when the likelihood of loss is reasonably possible, even if the amount is not yet certain. Option B is incorrect because significant subsequent events after the reporting period might require disclosure. Option C is incorrect because changes in accounting principles must generally be disclosed to preserve comparability and transparency. Option D is too narrow because related-party transactions require disclosure when material or relevant, not only when they financially harm stakeholders. The ACFE financial statement fraud materials identify improper disclosures, concealed liabilities, subsequent events, and related-party transactions as important fraud risk areas.

Detailed Explanation:

Rationale for Correct Answer: Expense reimbursement schemes are a common type of fraudulent disbursement. Requiring employees to submit receipts electronically improves controls by ensuring legibility, reducing the chance of altered or duplicate submissions, and creating a digital audit trail. This measure is recommended in the Fraud Examiners Manual as part of strengthening internal controls over reimbursement processes.

Analysis of Incorrect Option:

B. False – Incorrect because electronic receipt submission is indeed a recognized anti-fraud measure.

Key Concept: Fraudulent disbursements prevention through documentation controls.

The correct answer is D. The balance sheet is based on the fundamental accounting equation: Assets = Liabilities + Owners’ Equity. Assets represent resources owned or controlled by the entity. Liabilities represent obligations owed to creditors, while owners’ equity represents the owners’ residual interest after liabilities are deducted from assets. Because every accounting transaction affects at least two accounts, the equation must remain in balance. Revenues, expenses, cost of goods sold, and gross profit are primarily income statement elements, not the two main components that balance against assets on the statement of financial position. Understanding this equation is essential for fraud examiners because improper entries, concealed liabilities, overstated assets, and equity manipulation can distort financial statements.

================

Detailed Explanation:

Rationale for Correct Answer: One of the key red flags of fictitious revenues is sales to related parties, shell companies, or entities with unknown substance and ownership . Such transactions are often used to inflate revenue artificially.

Analysis of Incorrect Options:

A. Slow growth/unusual profitability – Incorrect, fictitious revenue often results in rapid or unrealistic growth.

B. Growth in days’ purchases in receivables – Misstated phrase; correct indicator would be growth in days’ sales in receivables .

D. Surge in purchases – Relates more to inventory fraud than fictitious revenues.

Key Concept: Red flags of fictitious revenue — questionable counterparties and unrealistic sales growth.

The correct answer is A. Creating answers to security questions using unique, nonpublic details helps prevent identity thieves from bypassing account protections. Many security-question answers, such as a mother’s maiden name, school name, pet name, or birthplace, can be discovered through social media, public records, or data breaches. Using answers that cannot be easily verified through public sources makes account recovery processes harder to exploit. Option B is weak because passwords and passphrases should not be reused across accounts at all. Option C is unsafe because email can be intercepted or misdirected, even when contacting reputable organizations. Option D is inadequate because moving files to the recycle bin does not securely erase data from a device before disposal.

================

Maria is engaging in leaking bid data because she provides confidential or pre-bid information to a favored bidder before the solicitation is publicly available. The ACFE material explains that leaking bid data occurs when procurement employees disclose pre-bid information or confidential information to a favored vendor, giving that vendor an unfair advantage. This differs from bid tailoring, where specifications are drafted to favor a contractor. It also differs from suppressing bids, which involves preventing competitors from submitting bids, and bid splitting, which involves breaking a larger purchase into smaller amounts to avoid competitive bidding thresholds. Maria’s conduct gives the bidder advance notice and extra preparation time, making option B the correct answer.

================

Rationale for Correct Answer: Rationalization is the cognitive process by which fraud perpetrators justify their unethical conduct so they can commit fraud without feeling like criminals. A common way is to “invent a good reason” for their actions (e.g., “I deserve it,” “I’ll pay it back,” “Everyone else is doing it”). Thus, the correct completion is “one’s actions” or more precisely, Rationalization .

Analysis of Incorrect Options: Since this is a fill-in-the-blank, the distractors are implied. The only correct concept here is rationalization of one’s actions .

Key Concept: Rationalization — one leg of the fraud triangle.

Detailed Explanation:

Rationale for Correct Answer: Deliberate writing of vague specifications is a type of corruption scheme where an employee intentionally drafts unclear requirements. This forces later amendments, which can be manipulated to favor a particular vendor.

Analysis of Incorrect Options:

B. Need recognition – Involves unnecessary purchases, not vague specifications.

C. False specification – General but not precise; “vague specifications” is the correct technical term.

D. Bid-splitting – Breaking contracts into smaller amounts to avoid approval controls, not related to vague specs.

Key Concept: Specification schemes in procurement corruption.

Detailed Explanation:

Rationale for Correct Answer: This is True . When an employee has significant authority or discretion in the procurement process (e.g., drafting specifications, approving vendors, or evaluating bids), they are more capable of steering contracts toward favored suppliers. This increases the risk of corruption schemes like kickbacks or bid-rigging .

Analysis of Incorrect Options:

B. False – Incorrect; influence grows with authority over procurement.

Key Concept: Procurement authority is a key risk factor for corruption.

Detailed Explanation:

Rationale for Correct Answer: The accounting framework a company must follow depends on the jurisdiction in which it is publicly traded . For example, U.S.-listed companies must follow GAAP, while companies in the EU must use IFRS. Some countries allow or require IFRS, others mandate local GAAP.

Analysis of Incorrect Options:

B – Incorrect; some jurisdictions have their own national GAAP not tied to U.S. GAAP or IFRS.

C – Incorrect; international operations do not mandate IFRS—jurisdictional rules apply.

D – Incorrect; U.S. GAAP is rules-based, IFRS is principles-based (the reverse of what’s stated).

Key Concept: Financial reporting standards are jurisdiction-driven.

Detailed Explanation:

Rationale for Correct Answer: A kickback scheme occurs when vendors make payments to employees of a purchasing organization in exchange for steering business their way. Here, Bob steered contracts to Oak Company and received a percentage of profits, a textbook kickback arrangement.

Analysis of Incorrect Options:

B. Illegal gratuity scheme – Involves rewards after a decision, without a prior agreement. Here, the agreement was prearranged.

C. Diversion scheme – Refers to diversion of assets, not procurement favoritism.

D. Economic extortion scheme – Involves coercion of the vendor; this was voluntary bribery.

Key Concept: Bribery and kickbacks as forms of corruption.

Detailed Explanation:

Rationale for Correct Answer: An air loan is a mortgage fraud scheme where the borrower and sometimes insiders create completely fictitious properties or borrowers. Here, the nonexistent property and loan proceeds being pocketed fits this definition.

Analysis of Incorrect Options:

A. Property flopping – Involves short sales and undervaluing distressed property.

C. Phantom lien – False liens filed to collect fraudulent claims on real estate.

D. Daisy chain – Involves multiple property transactions between conspirators to inflate value.

Key Concept: Loan fraud schemes – fictitious property loans (air loans).

The correct answer is C. Regularly requesting and reviewing credit reports is one of the most effective ways for individuals to detect identity theft because unauthorized loans, credit cards, inquiries, addresses, or accounts may appear on the report. A credit report provides structured information from credit reporting agencies and is more reliable than general internet searches. Option A is impractical and incomplete because an individual cannot reasonably contact every international bank. Option B is incorrect because identity theft often causes negative credit activity, not necessarily a large improvement. Option D might reveal exposed information but is not a strong method for detecting fraudulent accounts. The ACFE materials discuss identity theft prevention and response, including monitoring financial and credit information for suspicious activity.

================

The correct answer is C. New account fraud often involves opening accounts with false, stolen, or synthetic identities. The most effective preventive measure listed is to verify the customer’s identity through reliable third-party credit reporting agencies and customer identification services. These sources can help confirm identity details, detect inconsistencies, identify suspicious histories, and reduce reliance on documents that might be forged. Employer recommendation letters are not standard or reliable identity controls. Small cash deposits are not automatically suspicious and might be normal for many customers. Sending communications to all previous residences is inefficient and unlikely to be the strongest verification method. The ACFE financial institution fraud materials identify new account fraud schemes and emphasize customer identification controls as a prevention method.

================

Detailed Explanation:

Rationale for Correct Answer: Expenses appear on the income statement , not the balance sheet. The balance sheet includes assets, liabilities, and owners’ equity, representing the accounting equation.

Analysis of Incorrect Options:

A, B, D – All appear on the balance sheet.

Key Concept: Distinction between financial statements: balance sheet vs. income statement.

The correct answer is B. A request to send payment to a country different from where the third party conducts business is a significant red flag in corruption and bribery schemes. Such payment instructions can indicate attempts to conceal beneficial ownership, route funds through offshore accounts, disguise improper commissions, or make corrupt payments difficult to trace. Option A is not necessarily suspicious because many legitimate vendors use one business address and phone number. Option C can reflect legitimate competitive strength if the vendor truly provides superior services. Option D is also not inherently suspicious because lower prices may result from efficiency or market strategy. Fraud examiners should treat unusual third-party payment destinations as high-risk indicators requiring enhanced due diligence and documentation review.

================

Detailed Explanation:

Rationale for Correct Answer: By definition, Equity (or net assets) represents the residual interest in the assets of an entity after deducting liabilities. This aligns with the basic accounting equation: Assets = Liabilities + Equity . Thus, the difference between assets and liabilities is Equity .

Analysis of Incorrect Options:

B. Expense – A cost incurred in earning revenue, not residual interest.

C. Revenue – Inflows from operations, not assets minus liabilities.

D. Income statement – A financial report, not a balance sheet component.

Key Concept: Equity as residual interest in the accounting equation.

Detailed Explanation:

Rationale for Correct Answer: Under GAAP, revenue is recognized when it is realized or realizable and earned . This requires that the earnings process be substantially complete, and payment be reasonably assured.

Analysis of Incorrect Options:

B. Fictitious and Earned – Fictitious revenues are fraud, not recognized revenue.

C. Realized and Evidenced – Evidence supports recognition, but “earned” is the proper standard.

D. All of the above – Incorrect, since only option A is correct.

Key Concept: Revenue recognition principle — realized/realizable and earned.

Detailed Explanation:

Rationale for Correct Answer: Under accrual-basis accounting , revenues are generally recognized when earned (often upon delivery of goods or services), not necessarily when cash is received. Similarly, expenses are recorded when incurred, not when paid. This provides a more accurate picture of performance and financial position.

Analysis of Incorrect Options:

A – This describes cash-basis accounting , not accrual-basis.

B – Accrual accounting is more complex, not simpler.

C – Focuses on earned revenues and incurred expenses, not immediate cash flow.

Key Concept: Accrual accounting matches revenues with expenses in the period they occur.

Detailed Explanation:

Rationale for Correct Answer: Horizontal analysis evaluates financial statement items over multiple periods, highlighting percentage changes from one period to another . This helps detect unusual trends or anomalies.

Analysis of Incorrect Options:

A – Describes vertical analysis (common-size statements).

B – Describes ratio analysis .

D – Describes benchmarking/comparative analysis across companies.

Key Concept: Analytical procedures – horizontal vs. vertical and ratio analysis.

Detailed Explanation:

Rationale for Correct Answer: Short-term skimming schemes include tactics like unrecorded sales , understated sales , and theft of incoming checks . These involve diverting funds before recording and typically last for a shorter duration because of higher detection risk.

Analysis of Incorrect Options:

B. Dual endorsements – Relates more to check fraud, not skimming.

C. False company accounts – Typically used in long-term fraud concealment.

D. Check-for-currency substitutions – More relevant to larceny and kiting schemes.

Key Concept: Short-term skimming schemes involve quick thefts before recording transactions.

Detailed Explanation:

Rationale for Correct Answer: According to the Fraud Examiners Manual (2020 International Edition) , offenders can be categorized into types. Absconders are individuals who commit fraud and immediately flee with the proceeds (“take the money and run”). They differ from long-term violators who maintain their frauds for extended periods while concealing them. Thus, the correct answer is A. Absconders .

Analysis of Incorrect Options:

B. Long-term violators – These offenders commit frauds over a long period and often maintain their positions of trust while continuing the scheme.

C. Offender types – Too vague; not a specific classification.

D. None of the above – Incorrect, since “Absconders” directly matches.

Key Concept: Offender Typologies — distinguishing between absconders and long-term violators in occupational fraud.

The ACFE Fraud Examiners Manual includes Kickback Schemes in the corruption section and specifically identifies Diverting Business to Vendors as a type of kickback scheme.

This question states that Bob, a purchasing agent , directed business to Oak Company, and in return Oak’s sales manager agreed to pay Bob a percentage of the extra profits . That is a classic kickback arrangement : the employee steers company business to a favored vendor in exchange for a personal financial benefit. The Manual’s examples of corruption also discuss a vendor bribing or paying a purchasing agent to receive more business.

Why the other options are incorrect

A. Economic extortion scheme

The Manual defines economic extortion as obtaining money, property, or services through coercion or threatened adverse action. That is not what happened here; Bob was paid for steering business, not coercing payment through threats.

C. Illegal gratuity scheme

The Manual explains that illegal gratuities are items of value given to reward a decision, often after the recipient has already made the decision, and this concept is primarily discussed in the public-sector context. Here, the payment is part of an agreement to direct business and share in profits, which is more accurately a kickback .

D. Diversion scheme

The relevant Manual terminology is Diverting Business to Vendors , but that appears as a subtype under Kickback Schemes . Therefore, the best answer among the options is the broader and correct classification: kickback scheme .

References

ACFE Fraud Examiners Manual, 2020 International Edition

Corruption — Kickback Schemes

Corruption — Diverting Business to Vendors

Example involving a purchasing agent receiving improper payments to steer business to a vendor

Economic Extortion definition

Illegal Gratuities definition

The correct answer is B. Separating the purchasing and payment functions is a core preventive control against billing schemes. Billing fraud often occurs when an employee can initiate purchases, approve vendors, authorize invoices, and process payments without independent review. By segregating these duties, the organization reduces the opportunity for fictitious vendors, shell company invoices, inflated invoices, and personal purchases with company funds. Option A might assist procurement negotiations, but it does not directly address internal authorization and payment control. Option C would weaken procurement controls because competitive bidding helps prevent favoritism and inflated pricing. Option D is also improper because employees should have independent reporting channels, such as hotlines, not only direct supervisors. The ACFE materials emphasize separation of duties, approvals, documentation, and competitive bidding as billing-fraud controls.

================

Detailed Explanation:

Rationale for Correct Answer: This statement is False . Shrinkage is a general term for unaccounted-for inventory losses, and it can indeed result from theft, errors, damage, or waste . To say shrinkage does not result from theft is misleading because theft is one of its primary causes.

Analysis of Incorrect Options:

A. True – Incorrect, as theft is often a major contributor to shrinkage.

B. False – Correct, since shrinkage can include theft.

Key Concept: Shrinkage includes theft as a cause of unexplained inventory loss.

Detailed Explanation:

Rationale for Correct Answer: Bid pooling occurs when vendors collude to divide contracts among themselves. They agree in advance who will submit the lowest bid for certain contracts, ensuring each participant gets a share of the business.

Analysis of Incorrect Options:

A. Bid opening – The formal process of opening bids, not fraud.

B. Fictitious bidding – Not a standard fraud term.

D. Bid log – A record of submitted bids, not a scheme.

Key Concept: Bid pooling — collusion among vendors in bid-rigging schemes.

Detailed Explanation:

Rationale for Correct Answer: Financial statement fraud typically involves overstating assets or revenues (e.g., inflating inventory, recognizing fictitious sales) and understating liabilities or expenses (e.g., hiding obligations, capitalizing expenses). This combination enhances profitability and net worth, misleading stakeholders.

Analysis of Incorrect Options:

A – Understating assets/revenue is rare since fraud usually aims to inflate results.

C – Overstating both assets and liabilities would not improve financial performance.

D – Understating both would reduce reported performance, contrary to typical fraud objectives.

Key Concept: Common patterns in financial statement fraud.

Detailed Explanation:

Rationale for Correct Answer: By definition, conflict of interest fraud arises when an employee has a hidden financial or ownership interest in another entity with which the employer does business. The fraudster’s loyalty is divided because their interest lies outside of their primary employer.

Analysis of Incorrect Options:

B. False – Incorrect because the essence of conflict of interest is precisely that the fraudster’s interest lies outside their company.

Key Concept: Conflict of Interest (divided loyalty).

Option D is correct because analytical review can reveal inventory theft when cost of goods sold changes disproportionately compared with sales. If inventory is stolen, the organization may experience higher inventory shrinkage or cost of goods sold without a corresponding increase in sales revenue. The ACFE material identifies analytical review, physical inventory counts, perpetual inventory records, and shipping-document review as methods for detecting inventory schemes. Option A is incorrect because analytical review can help identify unusual relationships or trends. Option B is weak because unchanged sales and unchanged cost of goods sold do not indicate a loss pattern. Option C is too absolute; changes in cost of goods sold must be evaluated in relation to sales, business conditions, and other explanations.

================

Detailed Explanation:

Rationale for Correct Answer: The matching principle under GAAP requires that revenues and the corresponding expenses incurred to generate those revenues be recorded in the same period. Failing to do so misstates income and violates accrual accounting.

Analysis of Incorrect Options:

B. Revenue and Income statement – The income statement is a report, not an item to be matched.

C. Income statement and Long-term contracts – Long-term contracts follow special rules (percentage of completion, completed contract), not the general matching principle.

D. Capitalized expenses and Liabilities – Not part of the matching principle.

Key Concept: Matching Principle — recording related revenues and expenses in the same period.

The ACFE Fraud Examiners Manual addresses Nonconforming Goods or Services under Contract and Procurement Fraud . The Manual states that, to detect nonconforming schemes, the fraud examiner should examine contract specifications, contractor statements, invoices, supporting documents, the received product, and test and inspection results for discrepancies with contract specifications. It then specifically adds:

“Additionally, to detect nonconforming schemes, the fraud examiner should:

• Review correspondence and contract files for indications of noncompliance.

• Request assistance from outside technical personnel to conduct after-the-fact tests.”

This language matches Option B exactly, so it is the most appropriate detection technique.

Why the other options are incorrect

A. Interviewing complaining contractors and unsuccessful bidders about the presence of red flags

This is a detection technique the Manual associates with change order abuse , not nonconforming goods or services schemes.

C. Comparing the direct and indirect labor account totals from the prior year to the current year

This type of comparative cost analysis is more consistent with testing for cost mischarging or other accounting irregularities, not the primary detection methods for nonconforming goods/services. The Manual’s nonconforming-scheme detection guidance focuses on specifications, inspection results, product testing, and contract/correspondence review.

D. Determining if the costs of the contract have exceeded or are expected to exceed the value of the contract

That is not identified by the Manual as the most appropriate method for detecting nonconforming goods or services. Again, the Manual directs the examiner to look for noncompliance with specifications and supporting documentation.

References

ACFE Fraud Examiners Manual, 2020 International Edition

Contract and Procurement Fraud — Nonconforming Goods or Services

Detecting Nonconforming Goods or Services Schemes

Related contrast: Detecting Change Order Abuse

Comprehensive and Detailed Explanation

Definition of Upcoding (ACFE Manual Reference)

The ACFE Manual identifies upcoding as a type of health care billing fraud in which the provider submits a claim for a more expensive or more complex service than what was actually provided.

Although the exact term “upcoding” appears within the health care fraud discussions, the broader category is part of Financial Transactions and Fraud Schemes concerning fraudulent billing practices . The manual describes fraud schemes in which the perpetrator:

Bills for services not provided ,

Bills for more expensive services than were actually delivered, or

Uses codes that misrepresent the level or nature of medical procedures.

Upcoding specifically involves:

Billing for a higher-cost procedure than what was actually performed, by using a code representing a more expensive service.

Why Option D Is Correct

Dr. Raul advised a patient with a small fracture to use crutches, but he submitted a claim using a code indicating that he placed a cast on the patient.

Actual service: Advice and crutches

Billed service: Application of a cast (more expensive procedure)

This is a textbook example of upcoding , as the provider is using a higher-cost CPT code to obtain greater reimbursement than the service warrants.

Why the Other Options Are Incorrect

Option A – Not Upcoding

Cindy receives a payment to undergo an unnecessary procedure , which is then billed fraudulently.

This is medically unnecessary services fraud , not upcoding.

Option B – Not Upcoding

Dr. Loomis uses three procedure codes instead of one .

This is an example of unbundling , which involves billing separate codes for procedures that should be billed as a single package.

Option C – Not Upcoding

Landon inflates the amount of a medical bill he wants reimbursed.

This is billing inflation or overstatement , but not misrepresentation via coding.

ACFE Manual Supporting Reference

The Manual’s section on fraudulent billing schemes discusses cases where perpetrators misrepresent medical procedures , including using false or inflated codes to obtain higher reimbursements.

The correct answer is C. Trade-based money laundering uses international trade transactions to disguise or move illicit value. A common method is misinvoicing, where colluding importers and exporters overstate or understate the price, quantity, or quality of goods. When goods are invoiced above market value, value can be transferred from the importer to the exporter under the appearance of a legitimate commercial payment. Option A involves laundering through virtual or digital assets, not trade-based laundering. Option B describes use of a front business, particularly a cash-intensive business, to mix illegal proceeds with legitimate revenue. Option D describes structuring or smurfing through small transfers. The international invoice manipulation in option C is the strongest example of trade-based money laundering.

================

The correct answer is C. Reviewing insurance policy applications for irregularities, inconsistencies, and missing information before coverage is granted is an effective preventive control. Many insurance fraud schemes begin at the application or underwriting stage through false statements, omitted risk factors, fictitious policies, or misrepresentations about the insured. Careful pre-issuance review helps identify suspicious information before the insurer assumes risk. Option A is generally impractical and may raise privacy and legal concerns after claim payment. Option B is inappropriate because combining underwriting and claims processing in one person weakens segregation of duties. Option D is also poor practice because information sharing, where lawful and appropriate, can help insurers identify patterns, duplicate claims, and suspicious applicants. Strong underwriting controls are essential to fraud prevention.

================

Detailed Explanation:

Rationale for Correct Answer: Revenue recognition requires that delivery has occurred or services have been rendered . If installation, testing, and customer acceptance have not occurred (A), or if a written order exists but with a right of return (B), delivery is not considered complete. Both scenarios prevent proper revenue recognition. Hence, the correct answer is C. Both A & B .

Analysis of Incorrect Options:

A – Correct condition, but incomplete.

B – Correct condition, but incomplete.

D. Neither A nor B – Incorrect, as both conditions do prevent recognition.

Key Concept: Revenue recognition fraud risks — recognizing revenue prematurely.

Detailed Explanation:

Rationale for Correct Answer: By definition, financial statement fraud is intentional . Errors or accidents in reporting are not fraud; they are mistakes. Fraud requires deliberate misrepresentation to deceive users of financial statements.

Analysis of Incorrect Option:

A. True – Incorrect because it includes “accidental” misstatements, which fall outside fraud.

Key Concept: Intentional misstatement is the defining element of financial statement fraud.

The red flag is that Fran has made multiple insurance claims in the past. Prior claims history can indicate a pattern of suspicious or repeated losses, especially when a new claim involves valuable property. Receipts and photographs generally support a claim rather than create suspicion by themselves, although they should still be verified for authenticity. Including bulky items in a fire loss claim is not automatically suspicious because fires can destroy many types of property, including large household goods. The ACFE insurance fraud materials identify red flags as indicators requiring further review, not proof of fraud. Fran’s repeated claim history would justify closer examination of the claim details, supporting documentation, timing, policy coverage, and any prior loss patterns.

================

Detailed Explanation:

Rationale for Correct Answer: Fair value is defined as the price an asset would fetch in an orderly transaction between willing market participants. It reflects current market conditions, not historical cost.

Analysis of Incorrect Options:

A. Absolute value – Mathematical concept, not accounting.

C. Cost value – Historical cost, not current market.

D. Material value – Not a recognized accounting term.

Key Concept: Fair Value Measurement under GAAP/IFRS.

The correct answer is C. Government and public sector organizations might need to conduct and respond to fraud risk assessments more frequently because their risks can change with political priorities, public programs, emergency funding, legislative mandates, and changing public expectations. Public entities are accountable to citizens, regulators, oversight bodies, and funding authorities. Option A is incorrect because the absence of shareholders does not permit higher fraud tolerance; public stewardship often requires strong accountability. Option B is inaccurate because public sector priorities can shift quickly based on laws, budgets, and government initiatives. Option D is also incorrect because public organizations usually have less autonomy than private entities due to statutory requirements, public scrutiny, procurement rules, and oversight obligations. Fraud risk assessment should therefore be dynamic and responsive.

================

Detailed Explanation:

Rationale for Correct Answer: When a single employee is responsible for opening the mail and recording payments, the risk of theft of incoming checks is greatest. This lack of segregation of duties allows one person both custody of funds and recordkeeping authority, a classic internal control weakness.

Analysis of Incorrect Options:

B & C – Involving two or more employees provides better segregation of duties, reducing the risk.

D. None of the above – Incorrect since option A directly matches.

Key Concept: Segregation of duties to prevent skimming/theft of incoming checks.

The correct answer is A because the accounting equation is Assets = Liabilities + Owners’ Equity. If a fraudster removes a liability from the books, total liabilities decrease. To keep the equation balanced without drawing attention to the improper removal, the fraudster could increase another liability account. This offsets the decrease and keeps total liabilities from appearing reduced. Decreasing owners’ equity or creating a fictitious expense would further reduce the right side of the equation and would not conceal the removal in the same way. Increasing an asset would increase the left side, worsening the imbalance unless another entry were also made. The ACFE accounting concepts materials explain that understanding debit-credit relationships and the accounting equation is essential in detecting concealment entries.

Detailed Explanation:

Rationale for Correct Answer: The accounting definition of assets , as cited by Marshall and in GAAP frameworks, is “probable future economic benefits obtained or controlled by a particular entity as a result of past transactions or events.” This definition underlies balance sheet recognition of assets.

Analysis of Incorrect Options:

B. Liabilities – Represent probable future sacrifices, not benefits.

C. Credentials – Irrelevant to financial reporting.

D. None of the above – Incorrect since “assets” directly matches.

Key Concept: Definition of Assets under financial accounting frameworks.

Detailed Explanation:

Rationale for Correct Answer: Fraudulent schemes involving returns and allowances can be detected by analyzing accounts for unusually high transactions in these categories. This is a common red flag for concealment of theft or manipulation of sales.

Analysis of Incorrect Options:

A. Allowances by vendors – Too narrow, not a standard analytic test.

B. Disposals of allowances than reorders – Not a recognized search method.

D. None of the above – Incorrect, since option C is valid.

Key Concept: Returns and allowances analysis for fraud detection.

The required element is that the investment is in a common enterprise. The ACFE material explains that the investment-contract analysis parallels the Howey test, under which all required elements must exist: an investment of money or other assets, a common enterprise, an expectation of profit, and profits derived primarily from the efforts of others. Option A is incorrect because profits must come from the efforts of people other than the investor, not solely from the investor’s own management efforts. Option B is too narrow because the investment may involve money or another asset. Option C is incorrect because notarization is not an element of an investment contract. Therefore, the common-enterprise requirement makes option D correct.

================

Detailed Explanation:

Rationale for Correct Answer: Fraudulent financial statements (or “fraudulent statement”) refer to the intentional misrepresentation of financial condition, typically through overstating revenues, understating expenses, inflating assets, or concealing liabilities. The intent is to mislead stakeholders such as investors, creditors, or regulators.

Analysis of Incorrect Options:

B. Corruption – Refers to abuses of influence and conflicts of interest, not misreporting financial information.

C. Asset misappropriations – Involve theft of assets, not misrepresentation of reports.

D. None of the above – Incorrect since option A is correct.

Key Concept: Financial Statement Fraud — misrepresentation of organizational performance and position.

The correct answer is A. Baker used the company’s purchasing function to acquire goods for his personal benefit, making the scheme a personal purchase with company funds. This type of billing scheme occurs when an employee causes the organization to pay for goods or services that are not for legitimate business use. The fact that Baker ordered unnecessary supplies and used them to improve his house shows a personal benefit disguised as a business purchase. A pass-through scheme involves an intermediary company used to resell goods or services at inflated prices. A pay-and-return scheme involves overpaying a vendor and diverting the refund. Theft of inventory is less precise because Baker fraudulently caused the company to purchase the items.

================

Detailed Explanation:

Rationale for Correct Answer: The journal is the core of the bookkeeping system because it provides a chronological record of all business transactions. Each transaction is recorded as a journal entry before posting to the ledger.

Analysis of Incorrect Options:

A. Asset – A resource, not a recording system.

B. Liability – An obligation, not the recording medium.

C. Checkbook – Tracks cash disbursements, but not all transactions.

Key Concept: Journal as the primary book of original entry.

Detailed Explanation:

Rationale for Correct Answer: Market division and allocation agreements are a classic bid-rigging scheme in which contractors collude to evade competition by assigning territories, customers, or project types among themselves. This undermines free and open competition.

Analysis of Incorrect Options:

B – Fake contracts are not a recognized collusion tactic in competitive bidding.

C – Publishing solicitations in different outlets does not evade competition.

D – Submitting false invoices is fraud, but it occurs after contract award , not during the bidding process.

Key Concept: Bid rigging and collusion in procurement fraud.

Shoulder surfing is the practice of obtaining personal or confidential information by watching or listening while a victim uses or discloses it. Common examples include observing someone enter a PIN, password, access code, or account number, or overhearing a person provide sensitive details during a conversation. Option A is inaccurate because impersonating a bank or financial institution to obtain confidential information is closer to phishing or vishing, not baiting. Option B is inaccurate because pharming redirects users to fraudulent websites, while searching used devices is a discarded-device or data-recovery risk. Option D describes dumpster diving, not phishing. The ACFE identity theft materials distinguish these methods because recognizing the specific technique is important for prevention, investigation, and victim response.

================

The correct answer is A because businesses should protect employees’ and customers’ personal information, particularly when it is transmitted over wireless networks. Encryption reduces the risk that identity thieves can intercept and misuse sensitive information. Option B is poor practice because using government identification numbers as employee identification numbers increases exposure if internal records are accessed. Option C is too broad and not risk-based; access to customer information should be limited to employees with a legitimate business need, not simply management status. Option D is incorrect because regular audits and reviews of information-handling practices help identify weaknesses and improve identity theft prevention. The ACFE material emphasizes methods of preventing identity theft for businesses, including safeguards for personal identifying information.

================

Detailed Explanation:

Rationale for Correct Answer: Accruals represent expenses that have been incurred but not yet paid. Under the accrual basis of accounting, these must be recognized in the same period as the related revenues or obligations. Common examples include accrued wages and accrued interest.

Analysis of Incorrect Options:

B. Depreciations – Allocation of asset cost, not unpaid expenses.

C. Expenses – A broader term, but not specific to unpaid obligations.

D. Financial record – Too vague.

Key Concept: Accruals under the accrual basis of accounting.

Detailed Explanation:

Rationale for Correct Answer: This is True . Fraudulent financial reporting often involves manipulating depreciation. By lowering or delaying depreciation expense, companies can inflate profits and overstate asset values. This is a common method of financial statement fraud related to earnings management.

Analysis of Incorrect Options:

B. False – Incorrect, as understatement of depreciation clearly inflates reported profits.

Key Concept: Depreciation Manipulation in Financial Statement Fraud .

Detailed Explanation:

Rationale for Correct Answer: The accounting cycle is the complete process of recording transactions, adjusting the books, preparing trial balances, and producing financial statements. Journal entries are part of the process, but the entire structured sequence is called the accounting cycle.

Analysis of Incorrect Options:

A. Journal Entries – Steps within the cycle, not the entire process.

C. Financial statement – Output of the cycle, not the process itself.

D. None of all – Incorrect since the accounting cycle is the correct term.

Key Concept: Accounting Cycle — structured process of recording and adjusting transactions.

Detailed Explanation:

Rationale for Correct Answer: EFT fraud involves the unauthorized transfer of money from victims’ accounts using stolen access credentials. A hacker using stolen log-in details to redirect funds is the textbook example.

Analysis of Incorrect Options:

A – Describes identity theft/credit card fraud, not EFT fraud.

C – Describes skimming of card data, not EFT.

D – Describes payroll fraud , not EFT.

Key Concept: EFT fraud = unauthorized access to electronic banking/payment systems.

Detailed Explanation:

Rationale for Correct Answer: During the solicitation phase , corrupt employees may attempt to eliminate legitimate competitors by restricting the list of vendors invited to bid. This unfairly favors a particular supplier, often in exchange for bribes or kickbacks.

Analysis of Incorrect Options:

A. Need recognition – Involves creating false or unnecessary demand, not restricting bidders.

C. False specification – Relates to vague or tailored specifications, not bid solicitation.

D. Submission – Occurs after solicitation when vendors submit bids.

Key Concept: Solicitation phase schemes — restricting competition.

Detailed Explanation:

Rationale for Correct Answer: Biometric authentication (fingerprints, facial recognition) is one of the strongest defenses against identity theft. It prevents unauthorized logins even if passwords are compromised.

Analysis of Incorrect Options:

A – Password reuse should be avoided altogether, not just limited.

B – Updates should be installed promptly, not annually.

C – Personal information should rarely, if ever, be transmitted via email, even with reputable companies.

Key Concept: Identity theft prevention through strong authentication.

Detailed Explanation:

Rationale for Correct Answer: The phases of the bidding process include:

Presolicitation (need recognition/specification stage),

Solicitation (inviting bids),

Submission (vendors submit bids). There is no standard phase called Postsolicitation .

Analysis of Incorrect Options:

A. Presolicitation – Valid phase.

C. Solicitation – Valid phase.

D. Submission – Valid phase.

B. Postsolicitation – Not recognized as a formal bidding stage.

Key Concept: Bidding process phases — presolicitation, solicitation, submission.

Submitting token bids is a common collusive procurement fraud method known as complementary bidding, also called protective, shadow, or cover bidding. In this scheme, competing contractors submit bids that are not serious attempts to win the contract. These bids might be intentionally too high, technically unacceptable, or structured with unfavorable terms so the preferred contractor wins while the process still appears competitive. This undermines the purpose of competitive bidding, which is to place bidders on equal terms and obtain the best price and conditions. Option B is inconsistent with market division, where conspirators divide markets rather than seek all areas. Option C refers more generally to shell or fictitious bidding, and option D is a billing fraud issue, not the common collusive bidding method described here.

================

Detailed Explanation:

Rationale for Correct Answer: Prenumbering and controlling shipping documents is a strong preventive measure against inventory theft because it ensures all inventory leaving the warehouse is properly authorized and tracked.

Analysis of Incorrect Options:

A. Same person for requisition and receiving – Violates segregation of duties.

B. Purchasing supervisor counting inventory – Creates conflict; inventory should be counted by independent staff.

D. Same person for shipping and scrap – Increases fraud risk.

Key Concept: Inventory theft prevention — control over documentation.

Detailed Explanation:

Rationale for Correct Answer: This is a false sale scheme , in which an employee processes fictitious transactions (such as false refunds, voids, or no-sales) to conceal theft of merchandise. Here, Brenda pretends to conduct a sale but records no payment.

Analysis of Incorrect Options:

A. Register disbursement scheme – Involves fraudulent refunds or disbursements of cash, not merchandise theft.

C. Purchasing and receiving scheme – Refers to inventory fraud during procurement, not point-of-sale theft.

D. Skimming scheme – Involves theft of cash before it enters accounting records, not merchandise theft.

Key Concept: Cash receipts and register manipulation schemes.

Detailed Explanation:

Rationale for Correct Answer: Failing to write off obsolete inventory inflates reported inventory, overstating assets and potentially net income. Fraudsters may leave unusable goods on the books to make financial statements appear stronger.

Analysis of Incorrect Options:

A – An allowance for sales returns relates to revenue recognition, not inventory overstatement.

B – Relates to accounts receivable, not inventory.

C – Applying lower of cost or NRV reduces inventory to fair value, not overstates it.

Key Concept: Overstating assets through improper inventory valuation.

Rationale for Correct Answer: In occupational fraud, the primary culprit is generally the employee (insider) who abuses their position of trust. By definition, occupational fraud involves someone inside the organization exploiting their role.

Key Concept: Employee perpetrator as the primary fraud actor in occupational fraud schemes.

Detailed Explanation:

Rationale for Correct Answer: This is True . After the closing process, expense accounts are reset to zero for the new accounting period. They remain only as part of historical financial statements and supporting records. Because of this, expense accounts can be a target for fraud concealment (fraudulent disbursements), since closed accounts are rarely scrutinized again.

Analysis of Incorrect Options:

B. False – Incorrect, as the closing process does make expense accounts historical.

Key Concept: Expense accounts in fraud concealment — vulnerabilities due to being closed at period end.

The ACFE Manual includes a section titled New Account Fraud Schemes under Financial Institution Fraud . The table of contents for this section specifically lists:

False Identification

Business Accounts Using Stolen Checks

Personal Accounts Using Fraudulent Checks

Mobile Deposit Fraud

Automated Teller Machine Deposits

Prevention

The best answer is Option C because mobile deposits present elevated risk in new account fraud environments precisely because they can occur without in-person verification. The Manual’s inclusion of mobile deposit fraud as a specific new account fraud scheme supports the conclusion that remote, non-face-to-face deposit channels are vulnerable.

Why the other options are incorrect

A. Fraud is more likely to occur in established accounts than in accounts that are newly opened.

This is not supported by the Manual’s treatment of new account fraud as a distinct fraud risk category. The very existence of a separate section on new account fraud indicates that newly opened accounts pose a meaningful risk.

B. Automated teller machines (ATMs) are rarely targets of new account fraud because most ATMs have cameras installed.

This is inaccurate. The Manual expressly lists Automated Teller Machine Deposits within New Account Fraud Schemes , showing that ATMs are in fact a recognized target of this type of fraud.

D. New account fraud can be defined as any fraud that occurs on an account within the first year that it is open.

This is too broad and not the Manual’s definition. The Manual classifies new account fraud by the nature of the scheme , such as false identification, fraudulent checks, mobile deposit fraud, and ATM deposit fraud, not by an arbitrary one-year timeframe.

References

ACFE Fraud Examiners Manual, 2020 International Edition

Financial Institution Fraud — New Account Fraud Schemes

Detailed Explanation:

Rationale for Correct Answer: Disclosure is required whenever individuals in positions of trust are indicted or otherwise compromised. Transparency ensures stakeholders are aware of potential conflicts or risks.

Analysis of Incorrect Options:

A. Conflict of interest – A scheme, not the corrective measure.

B. Turnaround sale or flip – Specific scheme, irrelevant here.

D. Resource diversion – A fraud method, not a governance requirement.

Key Concept: Importance of Disclosure in preventing or responding to conflicts of interest.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters may solicit bids from fictitious suppliers (phony vendors) to create the illusion of competition. This ensures that the favored vendor wins while maintaining the appearance of a legitimate competitive bidding process.

Analysis of Incorrect Options:

B. Solicit transactions from fictitious vendors – Incorrect phrasing; bids, not transactions, are solicited.

C. Solicit bid-splitting… – Bid-splitting is a different fraud scheme, not part of solicitation.

D. None of the above – Incorrect, since A is accurate.

Key Concept: Phony bid solicitation as a corruption tactic in procurement.

The correct answer is D. Users being denied access to files they normally use is a significant indicator of possible network intrusion. Such denial might result from unauthorized permission changes, malware, ransomware encryption, account compromise, or malicious alteration of access controls. In a professional fraud examination context, this condition should trigger immediate incident-response procedures, including review of system logs, firewall records, router logs, and affected files. Options A and C describe routine security and system maintenance activities. Option B is not inherently suspicious because the country has a legitimate client connection. The ACFE computer and internet fraud materials emphasize that compromised systems should be treated as suspect and reviewed for irregularities and abnormal activity.

================

Detailed Explanation:

Rationale for Correct Answer: The statement of cash flows has three standard sections:

Cash flows from operating activities

Cash flows from investing activities

Cash flows from financing activities Thus, option B is correct.

Analysis of Incorrect Options:

A – No section called “purchasing activities”; such outflows fall under investing or operating.

C – No section called “earnings activities”; related cash flows are operating.

D – “Strategic activities” is not a formal category in GAAP or IFRS.

Key Concept: Structure of the statement of cash flows.

Detailed Explanation:

Rationale for Correct Answer: By double-entry accounting rules, every accounting entry affects at least two accounts (debit and credit). Fraudulent entries must also follow this rule, meaning manipulation will show up in at least two categories on the financial statements.

Analysis of Incorrect Options:

A. One – Impossible in double-entry accounting.

C. More than two – Possible, but not always; the minimum is two.

D. None of above – Incorrect since “at least two” is correct.

Key Concept: Double-entry accounting ensures at least two accounts are affected in every transaction, including fraudulent ones.

The correct answer is D because cash larceny involves stealing cash after it has already been recorded in the organization’s accounting records. Julia processes transactions as usual, meaning the sales and cash should already be reflected in the register records, and then she removes $100. Option A is closer to skimming because the payment is stolen before being reported. Option B is also skimming because Petra records only part of the sale and steals the unrecorded portion. Option C involves deleting the register log, which suggests an attempt to prevent the transactions from remaining recorded. The ACFE materials distinguish cash larceny from skimming based on whether the stolen funds were recorded before theft.

================

Detailed Explanation:

Rationale for Correct Answer: According to SAB 104 , revenue recognition requires persuasive evidence of an arrangement. This does not exist if there is no written contract, purchase order, or verbal agreement supporting the transaction.

Analysis of Incorrect Options:

A. Revenue and expenses don’t match – Violates matching principle, not persuasive evidence.

C. Timings not meet properly – Refers to delivery/performance, not evidence of arrangement.

D. Capitalized expenses and liabilities – Irrelevant to revenue recognition.

Key Concept: Revenue recognition requirement: Persuasive evidence of an arrangement.

The correct answer is C. An unusually close or overly friendly relationship between an employee and a third-party contractor can be a red flag of corruption. Such relationships may indicate favoritism, undisclosed conflicts of interest, kickbacks, bid manipulation, or preferential treatment in procurement decisions. The behavior is not proof of wrongdoing, but it warrants further review when combined with unusual awards, pricing, sole-source justifications, weak documentation, or repeated business with the same vendor. Option A reflects proper restraint, not suspicious conduct. Option B suggests the employee is not benefiting from bribery-prone markets. Option D is generally positive because disclosure of conflicts allows the organization to evaluate and manage ethical risks. Red flags must be assessed in context with documents, transactions, and relationships.

================

Detailed Explanation:

Rationale for Correct Answer: In collusive bidding , contractors coordinate to submit artificially high or uniform bids , with the appearance of competition. If all contractors submit bids that are consistently low relative to norms, it may indicate collusion to fix prices and share markets.

Analysis of Incorrect Options:

A – More competitors reduces collusion risk, not increases it.

C – Declining prices with new competition is expected in free markets.

D – Not subcontracting is not a standard collusion red flag.

Key Concept: Procurement fraud red flags – bid rigging and collusion.

The correct answer is B. Under cash-basis accounting, revenues and expenses are recorded based on the movement of cash. Revenue is recorded when cash is received, and expenses are recorded when cash is paid, regardless of when goods are delivered, services are performed, or obligations are incurred. Options A and C describe accrual-basis concepts. Accrual accounting records revenue when earned and matches related expenses to the same accounting period. Option D is incorrect because cash-basis accounting is generally simpler than accrual-basis accounting, although it can provide a less complete picture of financial performance. The ACFE materials emphasize that accrual accounting gives a truer financial picture and is required under GAAP.

================

The correct answer is A. Billing schemes often exploit weak segregation of duties in purchasing, receiving, and payment functions. If one person or department can request goods, approve receipt, authorize payment, and process invoices without independent verification, fictitious invoices, pass-through schemes, personal purchases, or inflated vendor billings are easier to conceal. Karen should therefore determine whether these functions operate independently. Option B is not the strongest choice as written because identifying employees with the same phone number does not directly test vendor billing fraud. Customer complaints about sales policies relate to revenue or consumer issues, not purchasing fraud. Accounts receivable and credit sales analysis is more relevant to revenue fraud. The ACFE materials classify billing schemes under fraudulent disbursements and emphasize purchasing, receiving, and invoice controls.

================

Renee’s scam is a mobile payment scheme because it uses a QR code scanned by a mobile device to direct victims to a fraudulent payment destination. The fraud depends on mobile-device interaction and the victim’s belief that the payment is going to a legitimate charity. Tokenization is a security process that substitutes sensitive payment data with a token; it is not the fraud being described. Electronic presentment generally relates to electronic billing or payment presentation systems, not a fake charity donation page. Business email compromise involves impersonating executives, vendors, or trusted parties to induce business payments, but Renee is conducting a mass QR-code donation scam. The ACFE materials treat online, mobile, and payment-system abuses as key payment fraud and cyberfraud risks.

================

Option A describes a card skimming or shimming scheme. Skimming involves using a hidden device to capture payment card information, often from a magnetic stripe, while shimming commonly involves a device inserted into a card reader to capture chip-card data. A small camera can also be used to record PIN entry. Automated teller machines and point-of-sale terminals are common targets because customers insert or swipe cards and enter authentication data. Option B involves theft or sale of card information but not skimming or shimming through a reader. Option C describes physical card theft or retention. Option D does not clearly show capture of card credentials. The ACFE material discusses ATM fraud, including skimming and shimming, as financial institution fraud risks.

================

Option A constitutes intellectual property theft because the corporate agent improperly accesses a competitor’s computer network and obtains confidential files about future pricing strategy. Proprietary business information, trade secrets, pricing plans, research, customer lists, and strategic documents can constitute valuable intangible assets. The ACFE material distinguishes lawful competitive intelligence from corporate espionage and theft of proprietary information. Option C describes open-source research, which is generally lawful if the information is publicly available. Option B is a false billing or fraudulent disbursement-type scheme, not intellectual property theft. Option D involves recruiting an employee and does not show improper acquisition or misuse of confidential information. The defining feature in option A is unauthorized access to confidential competitor information for business advantage.

================

Detailed Explanation:

Rationale for Correct Answer: Simply holding two jobs without disclosure is not inherently a conflict of interest unless the roles compete, overlap, or present divided loyalties. The other options all describe undisclosed financial or relational interests that conflict with the employer’s best interest.

Analysis of Incorrect Options:

A. Harriet’s stock ownership – Direct financial conflict.

C. Jennifer’s board positions – Competing loyalties between competitors.

D. Ernest hiring his brother – Nepotism without disclosure is a conflict.

Key Concept: Conflict of interest schemes in corruption.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters often use write-offs to remove stolen inventory or assets from the books. By recording items as obsolete, damaged, or uncollectible, they eliminate them from records, concealing theft.

Analysis of Incorrect Options:

A. Altered – Too broad, not a standard concealment term.

B. Perpetual – A system, not a concealment method.

C. False shipping slip – Used to divert assets, not write them off.

Key Concept: Write-offs as a method of concealing noncash asset theft.

Detailed Explanation:

Rationale for Correct Answer: The full disclosure principle requires that all material facts and deviations from GAAP be disclosed to readers of financial statements so that they are not misled. Transparency is essential for informed decision-making by investors, creditors, and regulators.

Analysis of Incorrect Options:

B. SAS – Refers to auditing standards, not accounting standards.

C. Writer – Incorrect; disclosures are intended for readers/users.

D. None of above – Incorrect since option A is correct.

Key Concept: Full disclosure principle — providing users with all material information.

Detailed Explanation:

Rationale for Correct Answer: The described scheme is lapping , a classic accounts receivable fraud. It involves covering up stolen payments by applying subsequent receipts from other customers to hide the shortage.

Analysis of Incorrect Options:

A. Padding – Usually refers to overstating expense reimbursements, not AR fraud.

C. Substitution – Refers to replacing missing assets with others, not AR manipulation.

D. Daisy chain – Not a recognized fraud concealment method in this context.

Key Concept: Skimming concealment techniques – lapping of receivables.

The correct answer is C. Multifactor authentication is an effective preventive control for electronic funds transfer fraud because it requires users to verify their identity through more than one authentication factor before initiating or approving payments. This reduces the risk that stolen usernames, passwords, or account credentials alone will allow unauthorized transfers through EBPP or P2P systems. Option A is unsafe because sending PINs, usernames, and passwords together increases exposure if the communication is intercepted. Option B is also poor practice because sensitive credentials should be encrypted. Option D weakens segregation of duties by allowing one employee to control both PIN issuance and access device information. The ACFE materials emphasize authentication, access controls, and segregation of duties in preventing EFT fraud.

================

Detailed Explanation:

Rationale for Correct Answer: Corrupt payments are not always made directly in cash. According to the Fraud Examiners Manual (2020) , one common method is disguising them as loans on favorable terms , which provide value to the recipient while appearing legitimate. This is recognized as a form of bribery or illegal gratuity.

Analysis of Incorrect Options:

B. Credit cards – Corrupt payments can be made via many channels, including credit, so this is incorrect.

C. Selling property above market value – Payments are typically disguised by undervaluing sales to recipients, not overvaluing.

D. Promises of favorable treatment – Promises alone can constitute bribery; this statement is false.

Key Concept: Methods of making corrupt payments .

Detailed Explanation:

Rationale for Correct Answer: Shrinkage refers to discrepancies between physical inventory counts and perpetual inventory records. Causes include theft, errors, waste, or fraud. It is one of the most common indicators of asset misappropriation.

Analysis of Incorrect Options:

A. Altered inventory – Not a recognized accounting term.

B. Account receivable – Unrelated to inventory.

D. Write-offs – A corrective accounting entry, not the variance itself.

Key Concept: Inventory shrinkage as a red flag for fraud.

Detailed Explanation:

Rationale for Correct Answer: Liabilities are defined as obligations to transfer assets or provide services to other entities in the future as a result of past transactions. They represent what the organization owes, distinguishing them from assets.

Analysis of Incorrect Options:

A. Supplies – Assets consumed within a year, not obligations.

B. Expenses – Costs incurred, but not necessarily amounts owed.

C. Assets – Resources owned, not obligations.

Key Concept: Definition of Liabilities in accounting.

Detailed Explanation:

Rationale for Correct Answer: An advance-fee scheme occurs when fraudsters request upfront payments (fees, commissions, or deposits) for services or opportunities that never materialize. The broker taking the fee without providing services is a classic case.

Analysis of Incorrect Options:

A. Bait and switch – Advertising one product/service but delivering another, not applicable here.

C. Split deposit scheme – Involves diversion of payroll or deposits, not loans.

D. Scavenger scheme – Charging for unnecessary services, often debt collection or foreclosure help, not applicable.

Key Concept: Advance-fee frauds as common financial scams.

Detailed Explanation:

Rationale for Correct Answer: One of the strongest internal controls against fraudulent billing schemes (such as shell companies, inflated invoices, and kickbacks) is to require competitive bidding . This ensures transparency, reduces favoritism, and makes it harder for employees and vendors to collude.

Analysis of Incorrect Options:

A – Fraud tips are valuable, but routing them only through supervisors may suppress reporting; hotlines are more effective.

B – Combining purchasing and payment increases fraud risk by reducing segregation of duties.

D – Outsourcing negotiations does not directly prevent billing fraud.

Key Concept: Internal controls and segregation of duties in preventing billing schemes.

Detailed Explanation:

Rationale for Correct Answer: Social engineering involves manipulating or deceiving people into revealing confidential information or taking actions that aid the attacker (e.g., clicking malicious links, sharing credentials). It targets human weaknesses rather than technical vulnerabilities.

Analysis of Incorrect Options:

A. IP spoofing – Forging an IP address to disguise origin.

B. Electronic piggybacking – Unauthorized use of someone else’s access connection.

C. Packet sniffing – Monitoring data traffic across a network.

Key Concept: Cyberfraud techniques – social engineering.

Detailed Explanation:

Rationale for Correct Answer: Journal entries record business activity, and credits increase equity (while debits reduce equity). Thus, journal entries and credits are the mechanisms that directly affect the equity account.

Analysis of Incorrect Options:

A. Journal Entries & Debit – Debits decrease equity, not increase.

B. Journal Entries & Transactions – Transactions are general; credits specify the effect.

D. None of all – Incorrect since option C is correct.

Key Concept: Equity changes recorded through journal entries and credits.

The correct answer is B. A paper property scheme involves an insurance claim for property that exists only “on paper,” meaning the claimed property never actually existed or was never owned by the claimant. The question describes a claim for destroyed items, such as a boat or expensive equipment, that did not exist. This differs from a staged theft, where an actual event is falsely created or arranged to appear like a theft. It also differs from an inflated theft or inflated inventory scheme, where property might exist but the claimant exaggerates the quantity, quality, or value of the loss. The ACFE insurance fraud material identifies property schemes, including phony or inflated thefts and paper boats, as property and casualty insurance fraud methods.

Detailed Explanation:

Rationale for Correct Answer: Fraudulent bid solicitation practices include issuing requests for proposals or bid documents that contain false statements or misleading conditions to favor a particular vendor.

Analysis of Incorrect Options:

B. Employment discussions – A conflict of interest, not bid solicitation fraud.

C. Withdraw low bids – A submission phase scheme.

D. Falsify bid log – A separate manipulation method, not solicitation criterion.

Key Concept: Fraudulent bid solicitation — using false or misleading statements to limit competition.

Detailed Explanation:

Rationale for Correct Answer: A disproportionate increase in COGS without a corresponding increase in sales is a red flag for inventory theft or misappropriation . Theft reduces ending inventory, which artificially inflates COGS, while sales remain unchanged or grow modestly.

Analysis of Incorrect Options:

A – Warranty liabilities affect expenses, not COGS.

B – Fewer sales would reduce both revenue and COGS proportionally, not cause a large disparity.

C – Sales returns reduce revenue, not inflate COGS.

Key Concept: Using analytical review to detect inventory theft via COGS anomalies.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters often attempt to influence or bribe employees who have access to sealed bids . Access to sealed bids provides unfair knowledge of competitors’ pricing and terms, enabling collusion or bid manipulation.

Analysis of Incorrect Options:

A. Bid-splitting – A fraud scheme, not what vendors seek access to.

C. General purchasing – Too broad; not specifically tied to vendor fraud.

D. Tailor specifications – A corruption scheme, but not the specific target of vendor bribery.

Key Concept: Sealed bid access as a key target in procurement fraud.

Detailed Explanation:

Rationale for Correct Answer: