CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Questions and Answers

According to the 2014 International Fraud Examiners Manual:

“The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional. The fraud examination process encompasses a variety of tasks that might include:

• Obtaining evidence

• Reporting

• Testifying

• Assisting in fraud detection and prevention”.

Similarly, in the CFE Prep - Investigations study guide:

“Fraud examination is best described as… a methodology for resolving fraud allegations from inception to disposition. The term fraud examination refers to a process of resolving allegations of fraud from inception to disposition, and it is the primary function of the anti-fraud professional”.

This clearly verifies that fraud examination is the correct term for the process of resolving fraud allegations from beginning (inception) to end (disposition).

Therefore, the correct answer is D. Fraud examination.

CFE methodology stresses that fraud examinations should be conducted with the assumption that the matter could end in litigation, which directly affects evidence-handling decisions. If litigation is reasonably anticipated, organizations often must preserve potentially relevant records through measures such as litigation holds and suspension of normal record-retention/destruction practices. Disposing of evidence while litigation is likely (or while a duty to preserve could exist) can create serious consequences, including sanctions, adverse inferences, monetary penalties, and other legal repercussions for spoliation or failure to preserve evidence. Because the central risk is future legal proceedings—civil, criminal, regulatory, or employment-related—the most important consideration when deciding whether evidence can be disposed of is whether additional litigation is likely or could reasonably arise. The physical form of evidence (A) affects preservation techniques, but it is not the key decision driver for disposal. Reporting summaries (C) do not replace original evidence. Whether evidence is direct or circumstantial (D) is not the deciding factor; both can be critical depending on the case. Thus, likelihood of future litigation is the most important factor.

Both the Manual and CFE Prep guides emphasize that forensic imaging is essential because:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging… allows a fraud examiner to view and analyse… without altering the original data in any way”.

A forensic image is an exact, sector-by-sector copy of the drive. Thus, imaging preserves evidence integrity.

Best practices for admission-seeking interviews emphasize building rapport, presenting a morally acceptable reason, and maintaining empathy to encourage a confession. The manual states examiners should “present a morally acceptable reason for the suspect’s behavior” and avoid creating hostility . Minimizing empathy is counterproductive and not recommended.

During admission-seeking interviews, when suspects persist with denials or alibis, examiners are trained to diffuse them. Accepted techniques include:

Discussing testimony of witnesses,

Displaying physical evidence, and

Downplaying the strength of evidence.

However, manuals caution that discussing a suspect’s prior deceptions is not an effective or recommended method to diffuse alibis. It risks confrontation and may damage rapport, reducing chances of confession.

Therefore, option C is the exception.

The 2014 International Fraud Examiners Manual states:

“The information contained on a wire transfer generally will include the following items:

• The amount of the transfer

• The date of the transfer

• The name of the sender or originator

• The routing number of the originating bank or financial institution.”

Therefore, the correct answer is C.

The manual states:

“When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence.”

Thus, B is the least accurate statement.

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

The Fraud Examiners Manual notes that when witnesses become hostile or argumentative, the interviewer should generally remain calm and avoid reacting to hostility. Reacting, reasoning, or arguing often escalates the situation. Instead, the interviewer should maintain control and neutrality .

The Fraud Examiners Manual warns against phrasing admissions as direct questions using emotive terms:

“The admission-seeking interview begins with a direct accusation… The accusation should be phrased as though the accused’s guilt has already been established. Emotive words such as steal, fraud, and crime should be avoided… Wrong: ‘Did you do this?’”.

Thus, phrasing the question as “Did you steal the money?” is least effective.

The Fraud Examiners Manual defines:

“Testimonial evidence is that evidence which is presented in the form of witness statements, whether oral or written, offered in response to questions” (Fraud Examiners Manual – Evidence section).The colleague’s statement overhearing a conversation is testimonial evidence.

CFE investigative guidance recognizes online databases as valuable tools for locating public records quickly, but it also highlights practical limitations. The most significant limitation is that availability and coverage differ widely by jurisdiction. Some jurisdictions provide extensive online access to court files, property records, corporate registrations, and liens, while others provide limited access, partial indexing, or require in-person requests. This variability affects completeness and can create false negatives (records exist but are not available electronically). The guidance also cautions that online results may be abstracts, may not include supporting documentation, and can lag behind official updates—so investigators should verify key records with the originating agency when accuracy and completeness matter. Option A is not the primary limitation described; the more common problem is incomplete access rather than excessive detail. Option C is too absolute; errors can occur, but CFE methodology emphasizes validation, not the claim that records are “rarely correct.” Option D is also overstated; while source credibility matters, the fundamental limitation is uneven jurisdictional availability and completeness.

The Fraud Examiners Manual states that admission-seeking interviews should avoid yes/no questions like “Did you steal the money?” because they encourage denials. Instead, the question should be phrased as if guilt has already been established. The Manual explicitly warns:

“The accusation should be made in the form of a statement; it should not be made in the form of a question… Avoid emotive words such as steal, fraud, and crime… Example: ‘It is not so much a question of what you did, but why you did it.’”

Thus, the most effective admission-seeking phrasing is: “Why did you take the money?” because it presumes involvement and encourages explanation rather than denial.

“In jurisdictions that regulate credit information and personal data, a fraud examiner will generally need a legally acceptable reason for accessing such information from third parties… some common circumstances include when: the individual has given consent”.

Thus, with the individual’s consent, Leslie could obtain the report.

Benford’s Law applies to naturally occurring sets of numbers such as invoice amounts, expense reports, and transaction data. The Fraud Examiners Manual shows Benford’s Law tests applied to vendor payments to detect anomalies like duplicate or inflated invoices. Telephone numbers, employee IDs, and bank account numbers are assigned numbers and do not follow Benford’s distribution, so they are unsuitable for this test.

The Fraud Examiners Manual states:

“The expenditures method works best when the subject spends illicit income on consumables (e.g., travel and entertainment), because when the subject spends the illicit income, it will not cause an increase in net worth.”

CFE Prep confirms:

“The expenditures method … is best used when the subject spends illicit income on consumables (such as travel and entertainment) that would not cause an increase in net worth.”

Thus, the correct answer is A.

The Fraud Examiners Manual lists required steps before seizing evidence:

Obtain legal authority.

Review privacy issues.

Ensure software/hardware are validated.

Document surroundings, inspect for traps, image drives, etc.

There is no requirement to assemble a team exclusively of outside experts.

Before seizing evidence in a digital forensic investigation, the 2014 International Fraud Examiners Manual outlines several critical steps:

Obtain legal authority / review orders:

“Before obtaining evidence, ensure that there is legal authority to seize evidence and review the data associated with the evidence. This might require obtaining a warrant in a criminal matter or ensuring that internal policies authorise seizure for an internal investigation.”

Determine privacy issues:

“Before the fraud examiner can seize evidence, he must take certain steps to help ensure that the evidence will be admissible: He must determine whether there are any privacy interests in the item(s) to be searched… In every case where it becomes necessary to seize a computer or other device capable of storing digital evidence, the investigator should consult with legal counsel.”

Use only trained professionals/software:

“It is important to allow a trained examiner to conduct a proper seizure and examination of digital evidence to help ensure that the information can be used in a legal proceeding.”

✅ These are all valid required steps.

In contrast, the idea that the team must be composed only of outside digital forensic experts is NOT a required step. The Manual stresses flexibility in team composition:

“Some organisations have their own in-house personnel… while others might prefer the use of an outside examiner. Sometimes retrieving digital data is as easy as searching the target computer’s hard drive, but other times retrieval requires a thorough knowledge of computers.”

Thus, requiring only outside experts is not a standard step, since investigations may use internal, external, or a mix of specialists depending on the situation.

Detailed Explanation with Extracts = The Fraud Examiners Manual states:

“When reporting the results of a fraud examination, it is best to include copies (not originals) of important documents in the formal report”.

Originals should be safeguarded separately for evidence; reports should use copies.

Therefore, the statement is true.

The Fraud Examiners Manual explains:

“A Certified Fraud Examiner should not promise confidentiality or leniency to an informant to obtain testimony… the confidentiality relationship runs first to the client or employer”.

Thus, Lisa cannot guarantee full confidentiality but may state she will do her best.

“Electronic payment records can be valuable in tracing investigations… they can reveal, among other things, assets the subject has purchased”.

They can also reveal loans, real estate taxes, and business locations, but not directly whether Lottie is “skimming” funds.

The Fraud Examiners Manual specifies:

“Fraud examinations should proceed from the general to the specific. That is, they should begin with general information that is known and then move to more specific details.”

Therefore, statement B is false, making it the correct answer.

The CFE Prep – Investigations states:

“If a fraud examiner gets a verbal confession from the fraudster, it does not matter whether the fraudster claims his conduct was an accident. The following items of information should be obtained … admission that the accused knew the conduct was wrong, facts known only to the confessor, the accused’s motive, approximate dates, involvement of others, physical evidence, and disposition of illicit income.”

Thus, the examiner does not need a statement about accident.

Both the Manual and CFE Prep guides emphasize that deleted files are recoverable until overwritten. Once overwritten, the original data cannot be retrieved:

“Deleted files are recoverable until they are overwritten because data is not erased… until overwritten. So, deleted files that have been overwritten generally are not recoverable.”

Other file types (deleted shortcuts, hidden files, etc.) can often be recovered, but overwritten files are lost permanently.

“Opinions or conclusions concerning the guilt or innocence of a fraud suspect is outside the scope of a fraud examination and should never be included in a report”.

Functions of a fraud examination report include presenting evidence, corroborating facts, and supporting credibility. Communicating the examiner’s qualifications to provide opinions is not a function.

Therefore, option D is not a function of a fraud examination report.

Pretexting is defined as impersonating someone else or making false/misleading statements to obtain information. Many jurisdictions specifically prohibit pretexting against financial institutions, which includes pretending to be a customer to access their bank account information.

The Manual emphasizes that interviews should be held where the respondent feels comfortable and secure, not threatened:

“When possible, the interview should be held in a venue where the subject will feel comfortable and secure”.

Holding it in an uncomfortable setting is counterproductive and contrary to best practices.

The recommended questioning order is:

“As a general rule, questioning should proceed from the general to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

The 2014 International Fraud Examiners Manual and CFE Prep - Investigations explicitly state:

“Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. … when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.”

Thus, the correct answer is C.

Signs of stress (e.g., shallow breathing, stuttering, shifting posture) do not automatically equal deception. The Fraud Examiners Manual states:

“Signs of stress do not always mean a subject is lying. An honest subject might feel stress simply by being questioned. Conclusions must be based on clusters of behavior and corroborating evidence, not a single indicator”.

The Fraud Examiners Manual explains:

“Before running tests on the data, the fraud examiner must make certain the data being analysed are relevant and reliable for the objective of the engagement… Using the profile of potential frauds as a guide, the fraud examiner must identify the target data for analysis”.

The Fraud Examiners Manual advises:

“Do not slow down the interview process for note-taking. Instead, jot down key words … In general, it is better to err on the side of taking too few notes rather than too many.”

Therefore, the best practice is C.

The Manual says admission-seeking interviews should be conducted only when:

There is reasonable probability the subject committed the act,

All other reasonable investigative steps are complete, and

“The interviewer can reasonably control the place, time, and subject matter of the interview.”.Therefore, Erica must ensure control of time, place, and content before scheduling.

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

A memorandum recording a whistleblower tip is a written record. The Fraud Examiners Manual defines documentary evidence as evidence “presented in the form of documents such as memoranda, contracts, emails, or other records”. Testimonial evidence comes from oral statements; here, the memorandum itself is the evidence, so it is documentary.

Referring to the informant in the memorandum using the informant's initials

Best practice requires that informants be identified only by symbols (e.g., I-1, I-2), not by initials, to protect their identity. Cash payments are acceptable but must be accompanied by a receipt.

The Manual and Prep Guide state:

“Before conducting a covert operation, it is essential that the basis for the operation be committed to writing, preferably in a memo. The memorandum should clearly state: the information upon which the covert operation will be based; the information that is expected to be gained from the operation; the identities of suspects, if known; operatives under the fraud examiner’s care, custody, or control. Confidential sources’ identities should not be disclosed.”

Thus, expected information belongs, but confidential source identities must not

For publicly traded companies, the best source for information on officers and directors is regulatory securities records. These records typically include “identification of officers and directors, financial statements, significant owners, and accountants and attorneys”.

The Fraud Examiners Manual notes:

“Companies are formed by submitting some type of organisational filing… these company records are generally public records and will include: corporate name, ownership information, location of the principal office, date of incorporation”.

The Prep guide also confirms: “A company’s organisational filing with the government generally includes information about the company’s ownership, initial shareholders, and the location of its principal office”.

“Due to the risks of illicit transactions, most jurisdictions require financial institutions to obtain information about the ownership and control of the foreign bank with which they maintain correspondent relationships”.

The Fraud Examiners Manual explains:

“Benford’s Law applies to data that is not assigned (such as IDs or phone numbers) but that occurs naturally in transactions. For example, payment amounts, invoice values, and expense reimbursements are well suited.”

Thus, payment amounts are best suited for Benford’s Law.

CFE guidance on tracing illicit transactions explains that financial institution records—especially account statements—are among the most important sources for tracing because they can reveal transfers, counterparties, and leads to additional evidence. In the cryptocurrency context, the Manual specifically notes that when reviewing account statements, fraud examiners should look for transactions involving cryptocurrency exchanges and for payments to or deposits from such exchanges. Those banking “on-ramps/off-ramps” can connect a real-world identity (account holder) to crypto activity and help establish ownership or control indicators (e.g., exchange deposits/withdrawals, recurring transfers, related payment records). Option B is incorrect because public blockchains show transactions and addresses, but they generally do not contain direct personal identifiers. Option C is too broad and not supported as a “most accurate” statement across jurisdictions; requirements vary and many exchanges apply identification controls. Option D is incorrect because the Manual states that most cryptocurrencies rely on public blockchains that make transactions visible, not private blockchains. Therefore, A is the most accurate statement: ownership clues can sometimes be derived from bank statements that show exchange-related activity and related financial footprints.

The organizational filings with the government of the jurisdiction in which the company is incorporated

Organizational filings (e.g., articles of incorporation) are generally public records and include ownership information, initial shareholders, and the location of the principal office.

According to CFE Prep – Investigations:

“In most jurisdictions, income tax records are not public records and cannot be accessed for pre-employment purposes”.

Common public sources include court, property, licensing, and utility records.Thus, searching income tax filings is not a common use of public sources.

A key principle in fraud examinations is confidentiality. Fraud examiners must avoid tipping off the suspect, which could lead to destruction of evidence or flight. Measures include limiting discussions, informing only those with a legitimate need-to-know, and investigating discreetly.

 “Before commencing a formal investigation (and especially before starting the evidence collection process), it might be necessary to prepare the subject organisation… such as preparing the managers of the employees who will be involved in the investigation, notifying key decision makers, and notifying the organisation’s legal counsel”.

 It is not good practice to notify the entire workforce or inform the suspect.

The manual notes:

“Records subpoenaed in a criminal case usually are available only to the government during the investigation, and perhaps thereafter if not disclosed at trial”.

Thus, statement D is false.

“Even when a victim refers a fraud case for criminal prosecution, the government will usually not disclose the contents of nonpublic records with the victim during the investigation”.

Thus, option D is most accurate.

The Fraud Examiners Manual lists specific queries for accounts payable analysis, including:

“Review recurring monthly expenses and compare to posted/paid invoices.”.

While comparing book vs. tax depreciation applies to asset management (not A/P), and identifying paycheck anomalies applies to payroll (not A/P), the most effective A/P-specific test is the recurring expense comparison. Hence, C is correct.

The digital forensics section of the Fraud Examiners Manual stresses:

No single forensic tool can recover everything.

Each has strengths and weaknesses.

Therefore, it is best to use a combination of tools during analysis.

Additionally, the examiner must look for both inculpatory and exculpatory evidence, while maintaining data integrity.

This aligns exactly with answer B.

CFE Prep clarifies entrapment:

“Entrapment occurs when law enforcement induces a person to commit a crime that he is not predisposed to commit… It is imperative that adequate predication exists before the operation is commenced. For example, if the officer received a reliable tip, that could serve as adequate predication.”

Here, the officer acted on a reliable tip, so the entrapment claim would fail.

Nonpublic records include banking, tax, credit, phone, credit card, and health care records.

Business entity organisational filings (corporate constitutions, articles of incorporation) are generally public records and can be obtained from the government.

Therefore, reviewing a company’s business filings does not require access to nonpublic records.