This free guide covers the CFE Fraud Schemes and Financial Crimes section using the structure launched June 2, 2026, current for the supplied October 16, 2026 scope. Twenty original multiple-choice questions provide one representative item per domain; sixty lessons develop the allocated accounting, scheme-recognition, prevention, and detection skills. Work through transaction evidence, distinguish similar schemes, and calculate supported financial effects. The actual section contains 120 questions in 150 minutes and is closed book. This preview's allocations are editorial, not official domain question counts. Citations establish syllabus relevance and exam structure; technical explanations use established subject knowledge. Legal conclusions and reporting duties remain jurisdiction-specific.
What this guide covers
Practice 20 original CFE financial-crime questions and learn 60 concepts aligned with the June 2026 outline.
Accounting Concepts
1. The accounting equation and balanced concealment
The balance sheet expresses assets = liabilities + equity at a particular date. Double-entry accounting records equal debits and credits, but a balanced entry can still be false. An invented receivable and invented revenue increase assets and equity together without creating genuine economic value. Paying a recorded liability reduces both cash and liabilities, ordinarily without a new expense. Fraud analysis therefore tests existence, ownership, obligations, valuation, and timing rather than accepting arithmetic agreement as evidence of validity. Distinguish transaction effects from account labels: an account called an asset may contain costs that should have been expensed.
Worked example: A company reports assets of $250,000 and liabilities of $90,000, implying equity of $160,000. An examiner identifies a fictitious $25,000 receivable recorded through revenue. Removing it reduces assets to $225,000 and equity to $135,000; the equation remains balanced.
Common mistake: Assuming that a balanced trial balance validates transactions overlooks fabricated entries that preserve debit-credit equality while misstating economic reality.
Official syllabus reference: [3]
2. Accrual revenue, gross profit, and net income
Accrual accounting recognizes revenue and expenses according to the applicable recognition requirements, rather than simply following receipts and payments. Gross profit generally equals revenue less cost of goods sold; net income also reflects operating expenses and other applicable income and expense items. Customer advances can create liabilities, credit sales can create receivables, and unpaid expenses can create payables. These distinctions explain why profitable operations may consume cash and cash-rich operations may report losses. In fraud work, reconcile reported performance with underlying obligations and delivery evidence before treating a cash movement as revenue or an expense.
Worked example: A retailer earns $100,000 revenue, incurs $60,000 cost of goods sold, and records $25,000 other expenses. Gross profit is $40,000 and net income is $15,000. Collecting an additional $10,000 customer advance for next month's deliveries does not automatically increase either profit measure.
Common mistake: Treating all cash received as current revenue confuses financing or performance obligations with earnings and can conceal premature revenue recognition.
Official syllabus reference: [3]
3. Cash-flow categories and the indirect reconciliation
A statement of cash flows separates operating, investing, and financing cash movements under the applicable reporting framework. The indirect operating reconciliation starts with profit and adjusts for noncash items and relevant working-capital changes. Depreciation is generally added back; increases in trade receivables generally reduce operating cash relative to profit. Equipment acquisitions typically concern investing, while borrowing principal typically concerns financing. Classification details can differ by framework, so establish the governing policy before alleging misclassification. Fraud indicators include operating cash inflated by financing receipts or unexplained divergence between earnings growth and customer collections.
Worked example: A company reports $70,000 net income, $10,000 depreciation, a $25,000 receivables increase, and a $5,000 payables increase. Assuming no other adjustments, operating cash flow is $60,000. A separate $40,000 bank loan increases cash but does not explain stronger operating collections.
Common mistake: Adding loan proceeds to operating cash flow overstates cash generated by operations even though total cash may still reconcile correctly.
Official syllabus reference: [3]
4. GAAP, IFRS, and policy-dependent comparisons
Generally accepted accounting principles refer to the governing accounting requirements within a particular reporting setting; IFRS Accounting Standards provide another major reporting framework. Applicable requirements depend on jurisdiction, entity type, listing obligations, and reporting purpose. Differences in recognition, measurement, presentation, or permitted policies can produce legitimate differences between apparently similar companies. Before identifying manipulation, establish the framework, reporting period, accounting policy, and relevant facts. Consistent application and adequate disclosure matter, but consistency does not justify a policy that the applicable framework prohibits. A management preference or tax treatment is not automatically a valid financial-reporting policy.
Worked example: An examiner compares two manufacturers' development costs. One reports under a framework and circumstances allowing specified development expenditure to be capitalized; the other expenses the expenditure under its governing requirements. The examiner first assesses eligibility and disclosure rather than treating the differing margins as proof of fraud.
Common mistake: Assuming that every international accounting difference indicates manipulation ignores legitimate framework requirements and the transaction-specific conditions governing recognition.
Official syllabus reference: [3]
Financial Statement Fraud
5. Revenue recognition, cutoff, and side agreements
Revenue manipulation includes fictitious sales, premature recognition, concealed returns, and arrangements whose substance differs from the recorded transaction. Cutoff testing asks whether revenue belongs in the reporting period under the applicable recognition requirements. An invoice date alone does not establish that performance occurred or control transferred. Side agreements may introduce cancellation rights, acceptance conditions, or obligations inconsistent with the recorded sale. Examine contracts, delivery evidence, customer communications, subsequent returns, and cash receipts together. A later collection can support collectibility but does not necessarily establish that revenue was earned before year-end.
Worked example: A seller records $80,000 revenue on December 30 for equipment still awaiting required customer acceptance. January correspondence shows unresolved testing and a cancellation option. The examiner evaluates those conditions against the applicable recognition policy rather than accepting the December invoice as sufficient cutoff evidence.
Common mistake: Equating billing with earned revenue overlooks substantive acceptance conditions and side agreements that can change when a sale qualifies for recognition.
Official syllabus reference: [3]
6. Expense deferral, omitted liabilities, and disclosures
Improper capitalization defers current expenses by recording them as assets without satisfying the applicable recognition criteria. Omitting accrued expenses suppresses both expenses and liabilities. Both can inflate profit, but they affect different balance-sheet accounts and require different tests. Inspect capital additions for routine operating costs and search subsequent payments and unmatched receiving records for unrecorded obligations. Improper disclosure can also conceal related-party dealings, commitments, or risks despite arithmetically correct totals. Assess disclosure obligations under the governing framework; a footnote cannot cure an amount that should have been recognized differently.
Worked example: Management records $45,000 of routine cleaning as equipment and omits a $12,000 year-end service payable. Assuming no depreciation or tax effects, profit is overstated $57,000, assets $45,000, and liabilities understated $12,000. The examiner separately tests asset eligibility and obligation completeness.
Common mistake: Searching only recorded expense accounts misses costs hidden in assets and liabilities excluded entirely from the general ledger.
Official syllabus reference: [3]
7. Horizontal, vertical, and ratio analysis
Horizontal analysis compares amounts across periods, while vertical analysis expresses each line as a proportion of a common base, such as sales or total assets. Ratios examine relationships including margins, liquidity, and collection patterns. A change identifies a question rather than proving fraud. Compare consistent periods and definitions, and investigate business changes, seasonality, acquisitions, and accounting policies before interpreting an anomaly. Combining measures is useful: rising sales, rising receivables, and weaker operating cash may justify revenue testing even when each individual amount appears plausible. Avoid calculating percentage changes from an unsuitable or zero base.
Worked example: Sales rise from $500,000 to $600,000, a 20% increase, while receivables rise from $100,000 to $180,000, an 80% increase. Receivables as a percentage of sales rise from 20% to 30%, directing attention to collection terms, cutoff, and possible fictitious balances.
Common mistake: Treating an unusual ratio as conclusive fraud evidence skips the corroboration needed to distinguish manipulation from legitimate operating changes.
Official syllabus reference: [3]
Asset Misappropriation: Cash Receipts
8. Sales skimming and evidence outside the ledger
Skimming removes receipts before they enter the organization's accounting records. Sales skimming can leave no recorded sale or receivable, so reconciling recorded receipts to recorded deposits may not expose the missing business. Detection uses independent evidence of activity, such as sequential tickets, inventory movement, service appointments, customer confirmations, or transaction-system logs. Prevention links service delivery to controlled transaction recording and separates cash handling from reconciliation. Adjust for legitimate discounts, returns, wastage, and timing when estimating loss. A missing ticket is an exception requiring explanation, rather than automatic proof of a stolen sale.
Worked example: A recreation center records 180 paid admissions, but controlled entry scans identify 210 chargeable admissions after excluding staff and complimentary passes. At the stated $12 admission price, the unexplained difference is $360. Investigators compare attendant shifts, tickets, and payment evidence before attributing the shortage.
Common mistake: Relying only on ledger-to-bank agreement misses receipts that were stolen before either the sale or the cash receipt was recorded.
Official syllabus reference: [3]
9. Receivables lapping and customer-level tracing
Lapping conceals a missing customer receipt by applying a later customer's payment to the earlier account. The concealment can continue as each subsequent receipt fills another gap. Aggregate cash totals may appear reasonable while customer allocations and posting dates are false. Match remittance details and deposited items to customer-level credits, inspect posting delays, and investigate complaints about previously paid balances. Independent statements and separation of receipt custody from receivables posting reduce opportunity. Trace the chain to its origin and endpoint; an observed misapplication may be a clerical error unless the wider evidence supports deliberate concealment.
Worked example: After diverting Alder's $2,500 payment, a clerk credits Alder with Birch's later $2,500 receipt. Birch is credited using Cedar's payment. Matching bank images to the credited accounts exposes the substitutions even though the later deposits and ledger totals agree.
Common mistake: Assuming a current receivable balance rules out theft overlooks the possibility that another customer's money temporarily cleared the affected account.
Official syllabus reference: [3]
10. Cash larceny and deposit reconciliation
Cash larceny takes receipts after they have been recorded, distinguishing it from skimming. Concealment may involve deposit shortages, false cash counts, manipulated reconciliation items, or unauthorized adjustments. Reconcile register or receipt records to independent cash counts, deposit documentation, and bank credits by date and location. Examine the composition of deposits, not just totals, because substitutions between cash and checks can mask shortages. Separate receipt handling, deposit preparation, bank reconciliation, and approval of reconciling adjustments where practicable. Timing differences should be resolved with subsequent bank evidence rather than repeatedly carried forward without support.
Worked example: A store records $9,200 of receipts but deposits only $8,700. The deposit preparer labels the $500 difference 'cash in transit' for three weeks. Independent inspection finds no later deposit supporting that item, prompting investigation of recorded cash stolen before banking.
Common mistake: Calling every missing receipt skimming ignores whether the organization recorded the money before the theft, which changes the expected evidence trail.
Official syllabus reference: [3]
Asset Misappropriation: Fraudulent Disbursements
11. Fictitious refunds and post-sale voids
Register disbursement schemes use false refunds or voids to justify removing cash or redirecting card credits. A genuine sale can be voided after the customer leaves, or an invented return can create a payout without returned goods. Test transaction chronology, original tender, refund destination, inventory returns, customer evidence, and employee permissions. Manager approval is stronger when based on independent support rather than a routine override. Analyze refund rates within comparable roles and shifts; differences in product mix or return-desk assignments can explain elevated activity. Preserve the original sale and adjustment linkage for meaningful review.
Worked example: A cashier records a $90 cash refund against yesterday's sale, but the goods never reenter inventory and the customer's original payment was by card. Reviewing customer confirmation and register logs helps determine whether the cash payout was fictitious or a properly authorized exception.
Common mistake: Assuming a refund is valid because it references a real sale overlooks invented returns and diversion to a different payment destination.
Official syllabus reference: [3]
12. Check tampering and issued-payment integrity
Check tampering includes forged maker signatures, altered payees or amounts, forged endorsements, and unauthorized use of legitimately signed instruments. Identify the point at which the payment changed: creation, approval, custody, or negotiation. Compare approved payment records with bank-cleared images and investigate endorsement or destination discrepancies through authorized channels. Secure blank stock, restrict signature access, independently review cleared payments, and use bank matching services where available. Matching services have defined coverage and exceptions; an amount-only comparison may not detect an altered payee. A genuine signature does not establish that the final payment remained authorized.
Worked example: A company approves a $6,400 check to a maintenance contractor. The cleared image shows the same amount but a different payee. Comparing the approved register, original issue record, and bank image focuses the inquiry on alteration after approval rather than an unsupported maintenance invoice.
Common mistake: Checking only the payment amount can miss payee alteration that preserves the approved total while redirecting the funds.
Official syllabus reference: [3]
13. Electronic payment-file and master-data tampering
Electronic payment tampering redirects an otherwise valid obligation by changing beneficiary details, modifying a payment file, or abusing payment-release credentials. Separate supplier-master maintenance, invoice approval, file creation, and release so one user cannot control the full chain. Verify bank changes through independently maintained contacts and compare the approved payment population with the file actually transmitted. Review access logs and beneficiary changes near payment runs. Encryption protects transmission but does not make an internally altered beneficiary legitimate. Controls must address authorization and integrity before transmission, including emergency and manual-payment routes.
Worked example: An employee changes a supplier's bank account, releases a legitimate $28,000 invoice, and restores the original account afterward. A before-and-after master-file snapshot misses the temporary change, while the change log and transmitted beneficiary record reveal the redirection.
Common mistake: Assuming an encrypted bank connection prevents payment fraud confuses secure transmission with the correctness and authorization of payment instructions.
Official syllabus reference: [3]
14. Shell suppliers and pass-through billing
A shell billing scheme uses an entity to submit unsupported charges, often under an employee's concealed control. A pass-through scheme instead interposes an intermediary that acquires real goods or services and resells them to the victim, capturing an undisclosed margin. Supplier ownership, actual delivery, economic contribution, pricing, and conflicts determine the appropriate analysis. Verify vendors independently, match invoices to reliable receiving evidence, and examine ownership links where authorized. An address match or high margin alone is not conclusive: shared service locations and legitimate distribution services can produce similar patterns.
Worked example: A manager's undisclosed company buys standard parts for $18 each and immediately resells them to the employer for $29 without adding services. Delivery confirms real parts, so the inquiry targets the concealed intermediary and $11 margin rather than assuming the invoices represent nonexistent goods.
Common mistake: Treating delivery as proof of honest billing overlooks pass-through arrangements in which real goods conceal an undisclosed employee-controlled markup.
Official syllabus reference: [3]
15. Duplicate payments and diverted vendor refunds
Duplicate billing can create repeated payment of one obligation through altered invoice identifiers, separate processing channels, or resubmitted copies. A pay-and-return scheme may deliberately overpay a legitimate vendor and divert the resulting refund. Search using combinations of supplier, amount, service date, purchase order, and normalized invoice number rather than exact text alone. Reconcile vendor statements and credits, and direct refunds to independently controlled organizational accounts. Distinguish deliberate duplication from processing errors, recurring charges, installment invoices, and valid credit-rebill sequences. A duplicate payment establishes an exception; benefit and intent require additional evidence.
Worked example: Invoices 'INV-0731' and 'INV0731' each trigger a $7,800 payment for the same delivery. The vendor later issues one refund, which an employee directs to a personal account. Linking the duplicate, vendor correspondence, and refund destination exposes the full scheme.
Common mistake: Using exact invoice-number matching alone misses duplicates created through punctuation changes, leading zeros, alternative channels, or altered supplier records.
Official syllabus reference: [3]
16. Ghost employees and payroll-master authorization
Ghost-employee schemes pay nonexistent workers, former workers kept active, or real people who do not perform the represented work. The fraudster must generally establish or retain a payroll identity, authorize compensation, and obtain the proceeds. Reconcile payroll with independently controlled personnel records, verified employment status, work evidence, and authorized payment details. Review shared bank accounts carefully because legitimate family arrangements can exist. Separate hiring, master-file changes, time approval, and payment release. Headcount confirmation should establish identity and work performed, rather than merely asking the manager who may control the fictitious record.
Worked example: A supervisor leaves a departed employee active and redirects the next three $2,200 salary payments. Personnel records show the termination date, while payroll change logs identify the new bank details. Independent confirmation establishes that no authorized post-termination compensation explains the $6,600.
Common mistake: Assuming every payroll identity represents a current worker overlooks terminated employees retained in the system and real identities used without genuine employment.
Official syllabus reference: [3]
17. Commission manipulation and verified collection eligibility
Commission fraud can arise when employees inflate the sales base, accelerate eligibility, or conceal refunds used to calculate payroll. Begin with the employer's actual commission terms: invoicing, delivery, and collection can trigger different entitlements. For collection-based plans, trace customer receipts to bank records and individual sales, establish eligibility, and account for refunds and exclusions before applying the rate. Removing canceled invoices from billed sales does not establish that the remainder was collected. Compare the independently calculated entitlement with payment records, then examine authorization and intent before characterizing an overpayment as fraud.
Worked example: A distributor pays 3% of eligible customer collections, net of related refunds, with no other adjustments. Bank and sales records establish $76,000 of eligible collections and $4,000 of related refunds. A salesperson receives $3,000. Earned commission is ($76,000 − $4,000) × 3% = $2,160; the overpayment is $840.
Common mistake: Assuming uncanceled invoices represent earned commissions overlooks collection and eligibility requirements; even a verified overpayment requires additional evidence before concluding that fraud occurred.
Official syllabus reference: [3]
18. Expense reimbursement scheme distinctions
Expense reimbursement fraud includes fictitious expenses, inflated amounts, mischaracterized personal spending, and multiple reimbursement of the same cost. Each mechanism calls for different corroboration. Verify vendor evidence for existence, compare claimed and actual amounts for inflation, establish business purpose for mischaracterization, and match across cards and reimbursement channels for duplication. A genuine receipt proves a transaction occurred but does not establish who paid, business eligibility, or whether reimbursement already occurred. Apply the organization's stated policy rather than inventing a universal limit. Resolve refunds and shared costs before calculating the unsupported amount.
Worked example: An employee submits a genuine $420 hotel receipt for reimbursement after the same stay was paid on the corporate card. Matching date, vendor, amount, and card settlement identifies duplicate funding. The receipt's authenticity does not justify a second payment to the employee.
Common mistake: Accepting every authentic receipt as reimbursable overlooks personal purpose, corporate-card payment, refunds, and repeated claims for the same expenditure.
Official syllabus reference: [3]
Asset Misappropriation: Inventory and Other Assets
19. Inventory theft, false adjustments, and movement evidence
Inventory theft may involve physical removal, unauthorized transfers, fabricated shipments, or false scrap and damage adjustments. Detection combines independent physical counts with perpetual records, receiving evidence, shipping records, and adjustment approvals. Count both from records to the floor for existence and from the floor to records for completeness. Control movement during counts or reconcile movements explicitly. Inspect condition and ownership because goods present may be unusable or held for others. Independent approval of write-offs and witnessed disposal challenge concealment. A count variance alone does not identify theft; timing, unit conversions, and recording errors also matter.
Worked example: Records show 320 pumps, while an independent count finds 290. Thirty pumps were written off as damaged after the count, but no inspection or disposal record exists. Investigators reconstruct movement dates and authorization to determine whether the adjustment concealed removal.
Common mistake: Assuming an inventory adjustment resolves a shortage confuses changing the records with demonstrating where the goods went and why.
Official syllabus reference: [3]
Corruption
20. Bribery, gifts, and kickback exchanges
Bribery involves an improper benefit intended to influence a decision or action; a kickback commonly returns part of business proceeds to someone who helped obtain favorable treatment. Benefits can include travel, employment, discounts, or payments to associates, rather than cash alone. Examine purpose, timing, concealment, decision authority, and the connection to business outcomes. A gift is not automatically an unlawful bribe, and exact offenses depend on jurisdiction and applicable public- or private-sector rules. Organizational gift controls help identify conflicts, but policy compliance alone does not settle the legal or economic substance.
Worked example: A supplier pays a buyer's family holiday immediately after receiving a contract and calls it a marketing expense. Emails linking the trip to contract approval provide stronger evidence of an improper exchange than the travel payment's timing alone.
Common mistake: Looking only for cash envelopes overlooks valuable benefits routed through travel, employment opportunities, relatives, discounts, or third-party payments.
Official syllabus reference: [3]
21. Conflicts of interest and concealed ownership
A conflict of interest arises when a personal interest can impair an employee's duty to act for the organization. Fraud concerns intensify when the interest is concealed and the employee uses decision authority to benefit themselves or an associate. Unlike a kickback, a conflict need not involve a separate supplier paying a secret rebate. Examine beneficial ownership, family links, referral fees, decision participation, and disclosure or recusal requirements. Competitive pricing does not eliminate a concealed conflict, although pricing and delivery affect loss analysis. Disclosure alone is insufficient if required independent approval or recusal never occurred.
Worked example: A facilities manager steers maintenance work to a business secretly owned by their spouse. The prices match the market, but the manager approves selection and invoices without disclosure. The conflict concerns concealed influence; any overcharge must be assessed separately.
Common mistake: Assuming fair pricing eliminates a conflict overlooks the separate duty to disclose interests and avoid unauthorized participation in related decisions.
Official syllabus reference: [3]
22. Economic extortion and coercive demands
Economic extortion uses a threat of adverse economic action to obtain an improper benefit. An employee may demand personal payment to release money already owed, avoid arbitrary obstruction, or preserve an existing commercial relationship. The distinguishing investigative issue is coercion, including who initiated the demand and what consequence was threatened. Examine messages, invoice status, authority, prior dealings, and the sequence of payments. Extortion and bribery labels can overlap under particular laws, so scheme classification does not replace jurisdiction-specific legal analysis. A supplier's payment may reflect pressure rather than a voluntary agreement to buy preferential treatment.
Worked example: An accounts manager tells a contractor that approved invoices will remain blocked unless the contractor pays a private 'release fee.' The contractor's contemporaneous complaint and messages connect the personal demand to withheld payment, helping distinguish coercion from an ordinary processing delay.
Common mistake: Classifying every improper supplier payment as a voluntary kickback overlooks threats that force payment to obtain treatment already contractually owed.
Official syllabus reference: [3]
23. Concealed benefits through intermediaries and false services
Improper benefits can be concealed as consulting fees, commissions, charitable contributions, loans, subcontract payments, or purchases from connected entities. Trace the payment beyond its accounting label to the recipient, beneficial owner, services delivered, and ultimate use. Review contracts, work products, pricing, timing, and links to relevant decisions. Intermediaries can perform legitimate services, so vague descriptions or high commissions are leads rather than proof. Controls combine proportionate third-party diligence, approval of unusual compensation, conflict checks, and verification of performance. Analytical patterns should direct documentary corroboration rather than substitute for it.
Worked example: A consultant receives $50,000 after a permit decision but supplies no documented work. Authorized ownership research links the consultant to the decision-maker's relative. Investigators examine engagement communications and onward transfers to determine whether the fee concealed a benefit tied to the decision.
Common mistake: Accepting a signed consulting contract as proof of legitimate services overlooks fabricated engagements designed to disguise the destination and purpose of payments.
Official syllabus reference: [3]
Theft of Data and Intellectual Property
24. Trade secrets, access rights, and competitive intelligence
Intellectual property and confidential business information can include designs, source code, customer data, research results, and commercially valuable secrets. Their legal protection differs by category and jurisdiction; not every internal document satisfies a trade-secret definition. Competitive intelligence generally relies on authorized sources and legitimate analysis, whereas espionage may involve deception, inducement, or unauthorized acquisition. Assess the information's nature, confidentiality measures, ownership, permitted use, and acquisition method. An employee's access for work does not automatically authorize copying for a competitor. Conversely, similar independently developed products do not alone establish theft.
Worked example: A researcher downloads a restricted formulation database for transfer to a future employer. Their work access explains how the file was obtained but not whether outside disclosure was authorized. Public patent searches by the future employer would present a different acquisition method.
Common mistake: Equating authorized workplace access with unrestricted ownership ignores limits on copying, use, retention, and disclosure of the organization's confidential information.
Official syllabus reference: [3]
25. Insider exfiltration and data-loss controls
Data theft can occur through personal email, cloud uploads, removable storage, excessive downloads, screenshots, or compromised credentials. Map the path from sensitive repository to destination and identify which identity, device, and authorization were involved. Least privilege, controlled sharing, encryption, and data-loss prevention reduce exposure, while access and transfer logs support detection. Encryption at rest does not prevent an authorized user from exporting readable files. Unusual volume or timing requires corroboration because backups and legitimate project transfers can resemble exfiltration. Preserve metadata and contextual records through authorized procedures without unnecessarily distributing the sensitive content.
Worked example: An engineer downloads an entire design repository at midnight and uploads an archive to a personal cloud account. Project records show no approved migration. Correlating repository, endpoint, and cloud logs tests whether the same files moved outside the authorized environment.
Common mistake: Treating every large download as theft overlooks legitimate transfers, while treating valid credentials as authorization overlooks misuse by insiders or attackers.
Official syllabus reference: [3]
Identity Theft
26. Stolen identities versus synthetic identities
Identity theft can impersonate an existing person or construct a synthetic identity from fabricated attributes and, sometimes, genuine stolen identifiers. Full impersonation attempts to pass as a particular person; a synthetic identity may accumulate account history without corresponding to one real individual. Validate the coherence of the identity, not merely one identifier. Examine document authenticity, independent records, identity history, and links among applications within lawful access limits. Thin records can reflect young or newly arrived legitimate applicants, so limited history is not conclusive. Separate identity verification from assessing income, repayment ability, or creditworthiness.
Worked example: An applicant combines a stolen identification number with an invented name and birth date, then uses a new telephone number across several credit applications. The inconsistent attributes suggest synthetic construction, whereas using the victim's complete matching profile would indicate impersonation.
Common mistake: Assuming that a genuine identification number authenticates the entire applicant overlooks fabricated attributes and identifiers stolen from unrelated people.
Official syllabus reference: [3]
27. Identity proofing, authentication, and recovery abuse
Identity proofing establishes who a person is, authentication tests control of credentials, and authorization determines permitted actions. Attackers can defeat one stage without defeating every stage, particularly through weak account recovery or contact-detail changes. AI-generated documents, voice cloning, phishing, and social engineering can support impersonation. Use layered verification appropriate to risk, independently verified recovery channels, and review of unusual device, contact, or beneficiary changes. A successful password or one-time-code check does not prove the underlying person is genuine or that a transaction is authorized. Shared devices and travel can also create legitimate anomalies.
Worked example: A caller uses a cloned voice to reset a customer's password and replace the recovery telephone number. Reviewing only the later successful login misses the initiating recovery abuse. Comparing recovery evidence, device changes, and new payment instructions reveals the connected sequence.
Common mistake: Treating successful authentication as proof of genuine identity overlooks stolen credentials, compromised recovery procedures, and transactions exceeding the user's authority.
Official syllabus reference: [3]
Financial Institution Fraud
28. Loan and mortgage misrepresentations
Loan fraud can misstate income, employment, occupancy, collateral value, existing obligations, or the identity of the true borrower. Distinguish repayment-capacity deception from collateral manipulation and concealed participants. Corroborate application facts through independent, authorized sources rather than contact details supplied solely by the applicant or broker. Recalculate lending ratios only after validating their inputs. Early repayment performance does not establish that origination information was truthful. Valuation differences can be legitimate; investigate unsupported assumptions, coordinated documents, and incentives before inferring intent. Separate errors, changing circumstances, and deliberate misrepresentation when evaluating the evidence.
Worked example: A borrower claims $9,000 monthly salary, but independently obtained payroll evidence supports $5,500. A broker-supplied telephone reference repeats the higher amount. The examiner verifies the reference's identity and recalculates affordability using supported income rather than accepting mutually consistent application documents.
Common mistake: Assuming matching application documents are independent corroboration overlooks coordinated fabrication and references controlled by the applicant or intermediary.
Official syllabus reference: [3]
29. New-account bust-outs and customer-account theft
New-account fraud can use false identities, manipulated deposits, or manufactured repayment history to obtain credit before rapid withdrawal or default. A bust-out pattern builds apparent credibility and then exhausts available credit without intended repayment. Theft from customer accounts may instead involve outsiders taking over an account or insiders misusing legitimate access. Distinguish the account's origin, control changes, credit expansion, and funds destination. Monitor linked applications and unusual changes while considering legitimate business growth. Independent customer confirmation and restricted employee privileges address account theft differently from stronger onboarding controls against fraudulent new accounts.
Worked example: Several new businesses make small timely repayments, request large credit increases, and then rapidly transfer the limits to a shared beneficiary. The linked timing and destination justify a bust-out inquiry, while ordinary early repayments alone would not establish fraudulent intent.
Common mistake: Treating a short history of timely payments as conclusive creditworthiness overlooks deliberate credibility-building before a coordinated withdrawal or credit exhaustion.
Official syllabus reference: [3]
Money Laundering
30. Placement, layering, and integration
Money laundering seeks to conceal or disguise the criminal origin, movement, ownership, or control of proceeds. Placement introduces proceeds into an economic or financial channel, layering obscures the trail through transactions, and integration presents value as apparently legitimate wealth. These are analytical stages, not mandatory separate events or a universal chronological checklist. Noncash proceeds may enter the system without a cash-deposit stage. Trace source, movement, control, and economic purpose rather than classifying transactions solely by their number or geography. Lawful-looking documentation and legitimate assets can be used to give criminal proceeds an apparently ordinary explanation.
Worked example: Cash from crime enters a business's takings, moves through several controlled entities, and later funds a property purchase represented as investment income. The stages help organize the analysis, but investigators still trace ownership and funds rather than relying on the labels.
Common mistake: Assuming every laundering case must begin with a cash deposit overlooks digital proceeds and schemes in which the conceptual stages overlap.
Official syllabus reference: [3]
31. Structuring, smurfing, and inflated business revenue
Structuring deliberately arranges transactions to evade applicable reporting or recordkeeping requirements. Smurfing commonly uses multiple participants to conduct smaller transactions. Amounts below a threshold are not automatically suspicious, and thresholds and legal elements vary by jurisdiction. A front business can also disguise proceeds by overstating sales and commingling illicit funds with genuine revenue. Test deposits against plausible operating capacity, inventory purchases, customer activity, and payment methods. Evaluate related transactions together rather than treating each independently. A busy cash business can generate legitimate frequent deposits, so transaction pattern and intent require contextual corroboration.
Worked example: A small café reports twice the revenue supported by till records, ingredients, and customer counts. Several associates repeatedly deposit cash into related accounts. Investigators examine the unsupported sales and coordinated deposits without assuming a universal reporting threshold or treating deposit size alone as proof.
Common mistake: Flagging every transaction below a familiar threshold as structuring ignores jurisdiction, aggregation rules, ordinary customer behavior, and evidence of deliberate evasion.
Official syllabus reference: [3]
32. Trade pricing and alternative value-transfer vehicles
Trade-based laundering can move value through over-invoicing, under-invoicing, multiple invoicing, false descriptions, or shipments inconsistent with documents. Compare quantity, quality, pricing, counterparties, and payment flows using suitable evidence. Over-invoicing can move excess payment from importer to exporter; under-invoicing can shift value in the opposite direction through underpriced goods. Other vehicles include real estate, casinos, virtual assets, gift cards, money mules, and alternative remittance arrangements. Their use is not inherently illicit. Identify who supplies value, who receives it, who controls the parties, and whether the stated transaction explains the economic result.
Worked example: An importer pays $500,000 for goods independently supported at $200,000, and the exporter forwards $300,000 to the importer's owner's associate. The apparent excess identifies a value-transfer hypothesis. Quality differences, freight, services, and genuine commercial terms must still be checked.
Common mistake: Assuming virtual assets or cross-border trade are themselves proof of laundering substitutes the payment vehicle for evidence about source, control, and purpose.
Official syllabus reference: [3]
33. CDD, beneficial ownership, and risk-based AML
An anti-money laundering program combines governance, risk assessment, customer due diligence, transaction monitoring, training, independent review, and applicable reporting. Customer due diligence examines identity, beneficial ownership, purpose, and expected activity; legal ownership alone may conceal effective control. FATF Recommendations provide an international framework implemented through jurisdiction-specific requirements, rather than directly supplying identical duties everywhere. Distinguish threshold-based transaction reports from suspicion-based STRs or SARs. Terrorist financing can involve funds from lawful sources, so source-of-proceeds analysis alone is insufficient. Reporting decisions, confidentiality, escalation routes, and beneficial-ownership obligations depend on applicable rules.
Worked example: A trading company identifies a registered shareholder but cannot explain who directs its payments. Due diligence follows the ownership and control chain, while monitoring compares actual transfers with the stated business. Any reporting decision follows the institution's applicable jurisdictional requirements.
Common mistake: Treating customer identification as a one-time name check overlooks beneficial control, evolving activity, transaction purpose, and ongoing risk-based review.
Official syllabus reference: [3]
Securities Fraud
34. Investment contracts and regulatory roles
Securities can include shares, debt instruments, and arrangements classified as investment contracts under applicable law. In United States federal analysis, the Howey framework examines an investment of money in a common enterprise with a reasonable expectation of profits derived from others' efforts. Apply facts and relevant legal interpretation rather than relying on labels such as token or membership. The SEC is a government securities regulator; FINRA is a self-regulatory organization overseeing member broker-dealers under regulatory oversight. Other jurisdictions use different classifications and institutions. Registration, licensing, product legality, and freedom from fraud are separate questions.
Worked example: A United States promoter sells interests in a pooled enterprise and promises returns from its management team's work. Calling the interests 'digital memberships' does not settle their classification. The examiner evaluates the economic arrangement and identifies the relevant regulator and intermediary status.
Common mistake: Assuming that a novel product name avoids securities regulation overlooks substance-based classification, while assuming registration guarantees investment quality confuses distinct regulatory questions.
Official syllabus reference: [3]
35. Material statements, insider information, and suitability
Securities fraud concerns can arise from false statements, material omissions, misuse of confidential information, unsuitable recommendations, or unauthorized intermediary activity. ESG and sustainability claims require the same attention to evidence and significance as financial claims. Distinguish factual misrepresentation from a recommendation poorly matched to an investor's objectives, risk tolerance, and circumstances. Insider-trading analysis depends on jurisdiction-specific duties, information, trading, and other legal elements; possessing nonpublic information alone does not resolve liability. Verify offering claims, actual reports, intermediary authorization, and transaction patterns. No single impressive disclosure establishes that an investment is genuine or appropriate.
Worked example: A fund markets its holdings as independently verified low-emission assets, but its files contain only untested issuer estimates. The examiner compares the claimed verification with actual procedures. Separately, recommending the volatile fund to an investor needing near-term liquidity raises a different suitability question.
Common mistake: Treating ESG claims as mere marketing overlooks potentially significant factual representations, while confusing suitability with falsity obscures the actual conduct being tested.
Official syllabus reference: [3]
Payment Fraud
36. Counterfeit, altered, and repeatedly presented checks
Check fraud includes counterfeit instruments, alteration of genuine checks, forged signatures or endorsements, and repeated presentation through different channels. Distinguish a manufactured check from an authentic instrument whose payee or amount changed. Reconcile approved issuance data with cleared images and investigate duplicate presentments, especially when mobile deposit and physical processing coexist. Bank matching tools and exception review can reduce risk, but coverage depends on the service and fields checked. Apparent funds availability does not necessarily mean a deposited check is finally collected. Operational deadlines and remedies vary by bank agreement and jurisdiction.
Worked example: A business issues a genuine $3,200 supplier check. The supplier deposits it through a mobile application, and the same instrument later appears through another channel. Matching check number, amount, image, and clearing history tests duplicate presentment rather than assuming two separate supplier obligations.
Common mistake: Treating a visible account credit as final collection can expose the recipient to loss when a fraudulent or duplicate check is later returned.
Official syllabus reference: [3]
37. EFT, mobile payments, and account takeover
Electronic and mobile payment fraud may exploit stolen credentials, substituted beneficiaries, device compromise, SIM-related account recovery abuse, or manipulated authorization. Separate account takeover from a genuine user being deceived into authorizing a payment; evidence and available remedies can differ. Review login context, credential resets, contact changes, beneficiary creation, approval records, and actual transfer destinations. Layered authentication, independent verification, appropriate transaction controls, and separate approval reduce distinct risks. Device familiarity alone does not establish consent because sessions and devices can be compromised. Payment reversibility and liability depend on the system, contract, and jurisdiction.
Worked example: A customer's recovery number changes, a new device enrolls, and a new beneficiary receives the account balance within an hour. Correlating those events tests takeover. A different case in which the customer personally sends money after impersonation requires analysis of deception and authorization.
Common mistake: Assuming every fraudulent transfer reflects stolen credentials overlooks scams where the real user authorizes payment under a false understanding.
Official syllabus reference: [3]
38. Card skimming, shimming, and counterfeit use
Skimming captures payment-card data, often from magnetic-stripe transactions or compromised readers. Shimming uses a thin device associated with chip-card interfaces to intercept data, but intercepted chip information does not automatically enable creation of a fully functioning chip clone. Dynamic transaction protections, fallback behavior, and the data captured affect how stolen information can be abused. Detect through terminal inspections, tamper controls, transaction monitoring, and common-point-of-compromise analysis. Distinguish counterfeit-card activity from card-not-present misuse. A genuine physical card remaining with its owner does not rule out compromise of its payment data.
Worked example: Several customers retain their cards but report unauthorized purchases after using the same unattended terminal. Investigators compare transaction timing and inspect the terminal, while the issuer determines whether misuse involved counterfeit stripe transactions or online purchases. The pattern does not establish chip cloning.
Common mistake: Assuming intercepted chip data can simply reproduce every chip transaction ignores dynamic protections and the specific limitations of the compromised data.
Official syllabus reference: [3]
39. Prepaid-card diversion and rapid value movement
Prepaid and gift-card fraud can involve stolen funding instruments, account takeover, tampered card packaging, fraudulent activation, or coercing victims to reveal redemption codes. Value may move quickly through redemption or resale, complicating recovery. Controls should address acquisition, activation, loading, access, and redemption rather than treating all prepaid products identically. Monitor patterns such as repeated failed funding attempts, linked accounts, unusual loads, or immediate redemption while considering legitimate payroll and benefit uses. Product identification and transaction records matter because closed-loop gift cards and reloadable payment products differ in capabilities and applicable requirements.
Worked example: A scammer impersonates a utility provider and directs a customer to buy gift cards and transmit the codes to prevent disconnection. The payment instruction and rapid redemption reveal the value-transfer mechanism. The mere purchase of a gift card would not establish fraud.
Common mistake: Treating all prepaid products as anonymous and untraceable overlooks differing identity requirements, issuer records, load histories, and redemption evidence.
Official syllabus reference: [3]
Insurance Fraud
40. Premium diversion, false coverage, and insurer asset abuse
An agent or broker may collect premiums without remitting them, misrepresent whether coverage exists, or alter policy information to conceal diversion. Reconcile customer payments, intermediary records, insurer receipts, and policy issuance or cancellation directly. A certificate or receipt from the intermediary may not establish that the insurer issued the represented coverage. Asset-based insurer schemes instead misuse or strip the insurer's assets, potentially through related-party transactions or inflated investments. These mechanisms differ from a policyholder understating exposure or exaggerating a claim. Licensing, trust-account duties, and coverage consequences depend on the relevant jurisdiction and contract.
Worked example: A broker gives a business a premium receipt, but the insurer confirms that no policy was issued and no premium arrived. Tracing the customer's payment into the broker's operating account tests diversion. Investigators separately determine what coverage representations the broker made.
Common mistake: Assuming an intermediary's receipt proves active coverage overlooks failure to remit premiums, fabricated documents, and misrepresentations about insurer acceptance.
Official syllabus reference: [3]
41. Exposure understatement versus fabricated benefit claims
Premium fraud misstates rating inputs such as payroll, occupation, property use, or insured exposure to reduce the price of coverage. Claim or benefit fraud misstates an event, loss amount, disability, death, or continuing eligibility to obtain payment. Compare each representation with independent records appropriate to the policy. Property claims may involve staged damage or preexisting loss; workers' compensation claims may misrepresent work activity or limitations. A discrepancy does not by itself establish intent, and legitimate impairment can coexist with some activity. Quantify using the actual policy terms and supported facts rather than universal rates.
Worked example: Under a stated 3% payroll rate, an employer reports $600,000 instead of $750,000, understating premium by $4,500. Separately, a claimant submits invented repair invoices after a genuine storm. The first concerns exposure pricing; the second concerns the amount claimed.
Common mistake: Calling every insurance misrepresentation claim fraud obscures premium schemes and directs investigators toward loss documents instead of the rating inputs actually misstated.
Official syllabus reference: [3]
Health Care Fraud
42. Phantom services, upcoding, and unbundling
Provider fraud can bill for services not rendered, describe a lower-level service as a higher-paying one, or separately bill components that the payer requires to be bundled. These are different mechanisms: existence, coding intensity, and payment grouping respectively. Compare claims with authenticated records, appointment and service evidence, coding definitions, and the payer rules applicable to the date. A chart entry alone may be fabricated, while an unusual code alone may be justified. Use qualified coding or clinical expertise where needed to interpret evidence; do not substitute a fraud analyst's judgment for clinical necessity or diagnosis.
Worked example: A payer's stated rule pays $250 for a combined procedure, but a provider knowingly bills its two components for $160 each. The $320 claim creates $70 excess through unbundling. If neither component occurred, the principal issue would instead be nonexistent services.
Common mistake: Treating every high-payment claim as upcoding overlooks whether the actual issue is nonexistent care, duplicated billing, or prohibited separation of components.
Official syllabus reference: [3]
43. Patient and insurer deception in the claims chain
Health care fraud is not confined to providers. Patients may use another person's identity, conceal eligibility facts, or submit fabricated reimbursement claims. Insurers or groups may misrepresent benefits, coverage, claims processing, or financial information in ways that involve intentional deception. Distinguish a disputed denial, administrative error, or ambiguous contract from a knowingly false representation. Trace enrollment, authorization, service, claim adjudication, and payment records to locate the actual mechanism. Protect patient information and use authorized access. Investigative findings concern representations and transactions; they should not direct patients to alter treatment or discontinue necessary care.
Worked example: A plan tells members that a stated benefit was excluded, although the governing documents include it and internal instructions direct staff to use the false exclusion. Comparing policy terms, denial notices, and instructions tests insurer deception rather than presuming provider billing fraud.
Common mistake: Assuming every denied claim is fraudulent overlooks legitimate coverage disputes, while assuming only providers commit fraud excludes patient and insurer deception.
Official syllabus reference: [3]
Consumer Fraud and Scams
44. Advance fees and relationship-based investment scams
Advance-fee schemes obtain money for a promised benefit, such as a loan, prize, recovery, or investment withdrawal, that is not delivered as represented. Relationship-based scams build trust through romance, friendship, impersonation, or prolonged investment coaching before seeking funds. Crypto interfaces and fabricated account balances can create an appearance of investment success without genuine assets. Verify counterparties and custodians independently, and examine actual movement of funds rather than screenshots. Elder victims may also face coercion by relatives or caregivers. Age or emotional involvement alone does not prove incapacity or fraud; focus on deception, control, and exploitation.
Worked example: After months of friendly messages, a contact directs an investor to a platform showing large gains. Withdrawal supposedly requires a new 'tax clearance' payment to a personal wallet. Investigators verify the platform and payment demand independently instead of accepting the displayed balance.
Common mistake: Assuming a successful small withdrawal proves legitimacy overlooks staged early payouts intended to build confidence before larger deposits or invented release fees.
Official syllabus reference: [3]
45. Ponzi cash sources versus pyramid recruitment
A Ponzi scheme pays purported investment returns or withdrawals using later investors' funds rather than sufficient genuine earnings. A pyramid scheme primarily depends on recruitment-linked contributions or purchases to compensate participants, although real products may be present. Distinguish the actual source of payouts and incentives rather than relying on the promoter's label. Reconcile external revenue, investor inflows, commissions, withdrawals, and represented returns. Positive statements and regular distributions can be fabricated or funded by victims. Some schemes combine both mechanisms, so classification should not prevent tracing the complete cash cycle and participant obligations.
Worked example: An operator receives $400,000 from new investors and pays $90,000 to earlier investors despite earning only $5,000 from genuine activity. That funding pattern supports a Ponzi inquiry. A separate network paying rewards mainly for purchasing recruitment packages raises a pyramid analysis.
Common mistake: Assuming every scheme with referral rewards is a pyramid ignores whether genuine customer sales or recruitment contributions actually fund compensation.
Official syllabus reference: [3]
Bankruptcy Fraud
46. Liquidation, reorganization, and insolvency roles
Liquidation generally realizes assets for distribution under the applicable priority system, while reorganization seeks to restructure obligations or operations. Receivership typically places specified property or a business under a receiver's control under an appointment, but its scope varies by jurisdiction. Courts, trustees, administrators, liquidators, and insolvency practitioners have different powers and responsibilities. Identify the proceeding, appointment documents, control of assets, and reporting duties before evaluating conduct. A business continuing to trade does not establish that no insolvency process exists. Fraud analysis follows the actual obligations and authority, rather than importing one country's terminology into another system.
Worked example: A company continues trading while an appointed administrator evaluates restructuring options. An examiner first reads the appointment and applicable authority to establish who may sell assets and approve payments. Continued operations alone do not show that directors retain unrestricted control.
Common mistake: Assuming every bankruptcy immediately closes the business overlooks reorganization and other proceedings designed to preserve operations while addressing creditor claims.
Official syllabus reference: [3]
47. Concealed assets and transfers lacking genuine value
Bankruptcy schemes may conceal assets, omit ownership interests, fabricate debts, transfer value to associates, or incur obligations as part of a planned fraudulent collapse. Compare schedules and disclosures with bank records, prior financial statements, asset registers, ownership evidence, and prefiling transfers. Test genuine consideration rather than relying on contracts or circular deposits. A related-party transfer or distressed sale is not automatically fraudulent; applicable law determines avoidance grounds, intent standards, periods, and remedies. Distinguish an inaccurate valuation from concealed ownership, and separately quantify assets removed, obligations invented, and value actually received.
Worked example: Before filing, a debtor transfers a vehicle to an associate for a stated $18,000. Bank tracing shows the debtor supplied the associate's payment funds the previous day. The examiner evaluates net consideration, ownership, and disclosure rather than treating the matching deposit as independent value.
Common mistake: Assuming any prefiling transfer is lawful because it predates the case overlooks transfers that may affect the estate under applicable insolvency law.
Official syllabus reference: [3]
Tax Fraud
48. Tax evasion, avoidance, and offshore arrangements
Tax evasion generally involves deliberate unlawful reduction or concealment of tax obligations, while avoidance commonly describes arranging affairs within applicable law. Terminology, anti-abuse provisions, disclosure duties, and legal outcomes vary by jurisdiction. Offshore entities, tax havens, and shelters can serve legitimate or abusive purposes; location alone does not establish evasion. Examine ownership, residence, economic substance, income source, reporting, and the representations made. Distinguish an honestly disputed interpretation from invented facts or concealed income. A formally documented arrangement can still fail applicable substantive requirements, while tax efficiency alone does not prove fraudulent intent.
Worked example: An investor lawfully claims a deduction expressly permitted in the governing jurisdiction and discloses the transaction. Another taxpayer fabricates offshore service fees for work never performed. The contrast concerns legal entitlement and truthful facts, rather than whether either arrangement reduces tax.
Common mistake: Treating every offshore account as tax evasion ignores legitimate cross-border activity and shifts attention away from actual reporting and substantive obligations.
Official syllabus reference: [3]
49. Income suppression, false deductions, and consumption-tax chains
Tax schemes include undeclared income, fictitious deductions, stolen taxpayer identities, and manipulation of consumption taxes such as VAT. VAT fraud can exploit false input-credit claims or trading chains in which tax is collected but not remitted, depending on the governing system. Match reported sales and purchases to independent transaction evidence and validate supplier existence, goods movement, and eligibility for claimed credits. Stolen-identity refund schemes instead seek payment through a false taxpayer filing. Separate tax-base misstatement from payment diversion, and use the applicable jurisdiction's rules rather than assuming every invoice creates a deductible expense or credit.
Worked example: Under a stated invoice-credit tax system, a trader claims $14,000 input tax using invoices for goods never purchased. Bank transfers circulate back to the trader through related entities. The examiner tests genuine supply and credit eligibility, not merely whether the invoices display tax.
Common mistake: Assuming a tax invoice guarantees a valid deduction or credit overlooks nonexistent supplies, ineligible costs, stolen identities, and circular payment evidence.
Official syllabus reference: [3]
Cyberfraud
50. Business email compromise and deepfake authority cues
Business email compromise manipulates business communications to induce unauthorized payments, data disclosure, or account changes. Attackers may spoof an address, control a genuine mailbox, hijack a thread, or reinforce the request with a cloned voice or video. Familiar formatting and internal knowledge do not independently authenticate the requester. Verify unusual instructions through established independent channels and retain the required approval structure. Examine mailbox access, forwarding rules, message history, and beneficiary changes through authorized incident procedures. Deepfake detection by appearance alone is unreliable, so transaction controls should remain effective even when the impersonation looks convincing.
Worked example: An apparent finance director joins a video call and asks for a confidential supplier-account change before the payment run. The analyst independently contacts the director through established details and obtains the normal second approval, addressing identity and authorization as separate requirements.
Common mistake: Trusting a request because it arrives in an existing email thread overlooks mailbox compromise and attackers' access to genuine business context.
Official syllabus reference: [3]
51. Phishing, pharming, and destination verification
Phishing uses deceptive communications to induce disclosure, payment, or execution of malicious content. Targeted variants tailor the message to the recipient's role or known activities. Pharming redirects users toward a fraudulent destination, potentially through compromised name resolution or device configuration, even when the intended address appears familiar. Distinguish the lure from the redirection mechanism to identify useful evidence and controls. Secure access routes, protected DNS configuration, domain monitoring, and phishing-resistant authentication address different vulnerabilities. A padlock indicates an encrypted connection to a site, not proof that the site's operator is the intended organization.
Worked example: A payroll clerk types the usual portal address but reaches a convincing counterfeit after a local network setting is altered. The inquiry examines redirection and configuration evidence rather than searching only for a deceptive email link. The fraudulent site's encrypted connection does not authenticate its business identity.
Common mistake: Assuming that typing the address or seeing a padlock guarantees a legitimate destination overlooks redirection attacks and certificates issued to deceptive domains.
Official syllabus reference: [3]
52. Malware roles: infostealers, ransomware, worms, and botnets
Malware categories describe behavior and can overlap. An infostealer extracts credentials or other data; ransomware extorts through encryption, data theft, or related threats. A virus attaches to a host file or program, while a worm can propagate between systems without that same attachment model. A botnet is a network of compromised devices under coordinated control, rather than one particular payload. Identify observed capabilities and effects instead of assuming a single label describes the whole incident. A malicious attachment or compromised website can deliver several components, so investigation should examine credential exposure as well as visible disruption.
Worked example: An employee opens a malicious attachment that steals browser session information and later installs an extortion payload. Restoring encrypted files may recover operations but does not invalidate stolen sessions. The response must address the observed credential theft and the ransomware effects.
Common mistake: Assuming restored files resolve every malware consequence overlooks stolen credentials, persistent access, copied data, and additional payloads deployed before recovery.
Official syllabus reference: [3]
53. Layered prevention and correlated detection evidence
Cyberfraud controls address entry, privilege, movement, payment authority, detection, and recovery. Patching reduces exploitable weaknesses; least privilege restricts actions; segmentation limits movement; protected backups support restoration. Logging and monitoring identify suspicious sequences across identity, endpoints, applications, and payments. Correlate time, actor, device, and destination rather than treating alerts in isolation. A backup does not prevent theft or authorize a payment, and multifactor authentication has differing resistance to phishing and session compromise. Establish reliable timestamps and log integrity so event sequences support defensible conclusions. Authorized containment should preserve relevant evidence where practicable.
Worked example: A new login is followed by an administrator grant, bulk export, and supplier-bank change. Each event could have an explanation, but their linked sequence warrants investigation. Identity, application, endpoint, and payment logs together test whether one compromised session connected the actions.
Common mistake: Treating a single security product as complete prevention ignores different attack stages and the need to connect technical events with financial consequences.
Official syllabus reference: [3]
Government and Public Sector Fraud
54. Grant eligibility, restricted costs, and duplicate funding
Public-program fraud can misrepresent applicant eligibility, disaster losses, project activity, beneficiaries, or allowable costs. Begin with the particular grant or loan terms: a real expense may still be ineligible, while overlapping funding may be permitted when properly allocated. Trace application claims to independent evidence and expenditures to delivery, payment, and program purpose. Cross-program matches help detect duplicate charges but require verification of cost scope, allocation, reversals, and recipient identity. Distinguish unsupported expenditure from established fraud; intent and responsibility require evidence. Avoid treating one program's restrictions as universal public-sector law.
Worked example: Two grants each reimburse an organization's $36,000 equipment invoice. Their terms prohibit charging the same cost twice. Investigators verify the item, payment status, allocation, and refunds before quantifying duplication; the matching invoice is a lead rather than an automatic finding of intent.
Common mistake: Assuming that a genuine invoice establishes grant eligibility overlooks funding restrictions, allocation rules, duplicate recovery, and whether the goods served the funded purpose.
Official syllabus reference: [3]
55. Emergency-program speed and fragmented-data controls
Public-sector prevention can be constrained by emergency deadlines, dispersed delivery, legacy systems, incomplete applicant data, and limits on lawful data sharing. These constraints shape control design without eliminating accountability. Combine proportionate upfront verification with exception queues, documented overrides, targeted post-payment review, and recovery processes where authorized. Data matching requires sound identifiers and validation because shared addresses, name changes, and incomplete records can generate false matches. Separate urgency-driven control weaknesses from proof that a particular recipient committed fraud. Evaluate whether controls address actual program risks and whether unresolved exceptions receive timely, accountable follow-up.
Worked example: A disaster-loan agency processes urgent applications before all external data arrive. It records exceptions and later matches claims against verified business records. Reviewers investigate apparent duplicate entities using ownership and location evidence instead of rejecting every applicant sharing an address.
Common mistake: Assuming emergency speed requires abandoning verification overlooks phased controls, while assuming a data match proves fraud ignores identity and data-quality limitations.
Official syllabus reference: [3]
Procurement Fraud
56. Procurement phases and fabricated need recognition
Procurement ordinarily moves through need identification, specification, solicitation, evaluation, award, contract performance, acceptance, and payment. Risks differ at each phase. Need-recognition schemes create or inflate demand to benefit a supplier or employee before bids even exist. Test operational necessity, available inventory, utilization, alternatives, budgeting, and who initiated the request. A valid competitive process cannot cure a fabricated underlying need. Separate requesting, approving, buying, receiving, and paying where feasible, and preserve the justification linking the purchase to an actual requirement. Emergency needs may be genuine but still require support appropriate to the circumstances.
Worked example: A department requests 80 replacement devices while 65 compatible unused devices remain in storage. The requester has an undisclosed supplier interest. Reviewing utilization and stock records tests whether the need was inflated, rather than concentrating solely on whether three bids were obtained.
Common mistake: Assuming competitive bidding guarantees legitimate procurement overlooks purchases engineered around an unnecessary or exaggerated requirement before suppliers are invited.
Official syllabus reference: [3]
57. Bid tailoring and manipulation of evaluation
Bid tailoring designs requirements to favor a particular supplier without a legitimate operational basis. Manipulation can also change scoring, leak confidential information, suppress bids, or apply criteria inconsistently. Compare specifications with documented needs, market alternatives, drafting history, supplier communications, and published evaluation rules. A restrictive requirement can be justified by compatibility, safety, or performance, so establish necessity rather than assuming exclusivity proves corruption. Independent technical review and controlled changes reduce opportunity. Evaluate the criteria announced to bidders and the criteria actually used; a well-documented score can still reflect biased or undisclosed inputs.
Worked example: A tender requires a proprietary connector available from one supplier, although an independently tested adapter meets the documented performance need. Draft history shows the supplier supplied the wording. Investigators test technical justification and employee communications before concluding the specification was improperly tailored.
Common mistake: Treating every single-source specification as fraudulent overlooks legitimate technical constraints, while accepting technical wording without review can conceal favoritism.
Official syllabus reference: [3]
58. Cover bids, bid rotation, and market allocation
Contractor collusion can use deliberately losing cover bids, coordinated bid suppression, rotation of winners, or geographic and customer allocation. Employee collusion may supply confidential estimates, exclude competitors, or override evaluation. Analyze bidder relationships, submission metadata, recurring errors, price patterns, subcontracting, and historical winner sequences. Similar prices can reflect common costs, and repeated winners can reflect genuine capability, so corroborate patterns with communications and economic evidence. Independent bid handling and protected procurement information reduce employee-assisted manipulation. Distinguish collaboration allowed by the solicitation, such as disclosed joint bidding, from concealed agreements that undermine competition.
Worked example: Across six comparable tenders, three bidders rotate wins while the losers submit similarly structured higher prices. The winner then subcontracts work to a losing bidder. The pattern supports investigation of coordination, but market conditions and legitimate subcontracting must also be evaluated.
Common mistake: Assuming parallel prices prove collusion ignores shared cost conditions, while dismissing coordinated losing bids overlooks how apparent competition can be manufactured.
Official syllabus reference: [3]
59. Change-order abuse and low-bid recovery
Post-award change-order abuse can inflate scope, quantities, rates, or urgency after a contractor wins on an artificially low bid. Some schemes exploit intentionally incomplete specifications or collusion with approving staff. Compare each modification with original scope, field evidence, contractual pricing rules, independent estimates, and approval authority. Analyze cumulative changes and repeated justifications rather than reviewing each in isolation. Legitimate unforeseen conditions can require substantial modifications, so cost growth alone is not proof of fraud. Determine whether the additional work occurred, was necessary, was properly authorized, and was priced according to the contract.
Worked example: A contractor wins for $700,000 and quickly requests $240,000 for work described as unforeseen. Original surveys already identify the condition, and internal messages discuss recovering the low bid through modifications. The examiner tests scope knowledge, authorization, actual work, and pricing separately.
Common mistake: Treating every change order as suspicious overlooks genuine unforeseen work, while reviewing only signed approvals can miss fabricated need or collusive pricing.
Official syllabus reference: [3]
60. Service substitutions and conditional contractual credits
Post-award procurement fraud can involve billing for qualified personnel while supplying less costly substitutes. Compare contractual staffing requirements with work records, credentials, invoices, and substitution approvals. A price adjustment clause may apply only when a designated official authorizes the substitution. Establish that condition before calculating an omitted credit. Unauthorized performance can raise separate acceptance, replacement, or damages issues whose resolution depends on the contract and applicable law. Distinguish confirmed pricing errors from unresolved remedies, and examine whether the supplier knowingly concealed departures. Independent staffing verification and approval-linked invoice review help detect this mechanism.
Worked example: A translation contract credits $65 per trainee hour when substitution is approved. Records confirm 18 trainee hours, with written approval for 12; no credit was applied. The established omitted credit is 12 × $65 = $780. The other six hours require separate contractual review before quantifying a remedy.
Common mistake: Multiplying every substituted hour by an approval-dependent credit can overstate established entitlement; unauthorized substitutions require analysis of the remedies that actually govern them.
Official syllabus reference: [3]