ACFE CFE - Financial Transactions and Fraud Schemes Exam Dumps & Practice Test Questions

Question 1:

Which of the following behaviors is most likely to signal that a company is engaged in a need recognition scheme?

A. The organization places orders when stock levels hit the optimal reorder threshold
B. The company maintains an extensive list of alternative vendors
C. The business reports excessively high inventory or stock requirements
D. The firm writes off only a small number of surplus materials as scrap

Correct Answer: C

Explanation:

In procurement and inventory management, a need recognition scheme refers to a deceptive or manipulative practice where an organization artificially inflates its demand for goods or materials. This is typically done to justify unnecessary purchases, possibly to take advantage of bulk pricing, achieve personal or departmental incentives, or mislead stakeholders. Identifying such behavior is important for auditors, risk analysts, and procurement professionals to ensure transparency and efficient resource use.

Among the options listed, the most compelling red flag indicating such a scheme is when a company has unusually high requirements for stock and inventory levels. This signals a potential misalignment between actual operational needs and reported material demand.

Let’s examine each option:

• A. The organization places orders at the optimal reorder point
  This reflects standard best practices in inventory control. Reorder points are calculated based on usage rates, lead time, and safety stock. Using such methods helps maintain balanced inventory levels, which promotes efficiency rather than signaling abuse.

• B. The company maintains an extensive list of alternative vendors
  While a large vendor list may warrant further scrutiny, it's generally considered good risk management. Diversifying suppliers helps ensure business continuity and negotiate better prices. This behavior, by itself, is not suspicious.

• C. The business reports excessively high inventory or stock requirements
  This is a classic sign of a need recognition scheme. When inventory levels seem disproportionately high compared to usage or historical norms, it suggests potential manipulation. The excess could be a strategy to create artificial demand or meet hidden objectives, such as benefiting from volume discounts or hiding procurement inefficiencies.

• D. The firm writes off only a small number of surplus materials as scrap
  Fewer scrap write-offs usually indicate effective inventory usage and accurate forecasting. It suggests materials are used efficiently, not over-ordered or wasted, which contradicts the behavior seen in a need recognition scheme.

Ultimately, the inflation of stock requirements stands out as the most concerning signal, especially if it's not justified by production schedules or sales forecasts. This discrepancy between reported need and actual consumption is often what initiates deeper investigations into procurement ethics and compliance.

Question 2:

Which of the following is not a core characteristic typically associated with a Ponzi scheme?

A. Participants are encouraged to actively recruit new members
B. Early investors receive returns funded by contributions from newer investors
C. Investors are led to believe their funds are going into legitimate ventures
D. The scheme’s operators conduct little to no real business or investments

Correct Answer: A

Explanation:

A Ponzi scheme is a fraudulent financial operation where returns to earlier investors are paid from the contributions of newer participants, rather than from actual profits or legitimate business activities. It is named after Charles Ponzi, who orchestrated such a scam in the early 20th century. The scheme relies on continuous inflows of new funds to remain viable, eventually collapsing when new investments dwindle.

Let’s evaluate the defining characteristics of Ponzi schemes and identify which option does not belong.

• A. Participants are encouraged to actively recruit new members
  This is not a defining feature of a Ponzi scheme. While recruitment is often seen in pyramid schemes, which rely heavily on growing a network of participants, Ponzi schemes typically operate differently. The focus is on attracting new investments through promises of high returns, often without requiring participants to recruit others. Recruitment may happen informally but is not central to the Ponzi model, making this the correct choice as the non-distinguishing characteristic.

• B. Early investors receive returns funded by newer participants
  This is the central mechanism of a Ponzi scheme. There are no real profits; instead, returns are simply redistributed from new investors to older ones to create the illusion of a successful and profitable enterprise. This practice is unsustainable and eventually leads to collapse.

• C. Investors believe their money is being put into legitimate ventures
  A key aspect of a Ponzi scheme is deception. Investors are misled into thinking their funds are used in credible businesses or investment strategies. This trust encourages more investment, even though no legitimate activity backs the promised returns.

• D. The scheme’s promoters engage in little or no real commerce or investment
  This is another core trait of Ponzi schemes. Unlike legal investment firms that generate returns through assets or market performance, Ponzi scheme operators do not engage in real economic activity. Their business model is simply collecting money from new investors and using it to pay others.

In summary, while recruitment of new members can occur, it’s not a defining element of a Ponzi scheme. Unlike pyramid schemes that require active recruitment to generate income, Ponzi schemes disguise themselves as traditional investments and rely on continuous new capital rather than recruitment hierarchies.

Question 3:

Geoffrey is a homeowner who recently hired a contractor to build a patio at the back of his house. The contractor demanded full payment upfront to cover material costs. A week later, Geoffrey is alarmed to find that the contractor hasn't started any work and is no longer answering calls. 

Based on this situation, which type of fraud did Geoffrey most likely experience?

A. Deposit scheme
B. Scavenger scheme
C. Block hustle scheme
D. Advance-fee scheme

Correct Answer: D

Explanation:

Geoffrey’s case illustrates a classic instance of fraud where a service provider demands money in advance, promising to deliver materials or services, and then disappears after receiving the funds. This is commonly referred to as an advance-fee scheme, and it’s one of the most recognizable types of consumer fraud.

In an advance-fee scheme, the fraudster asks the victim to pay upfront under the pretense of covering costs for materials, labor, or services that are supposedly scheduled. However, the service is never actually performed, and once the payment is made, the scammer becomes unreachable. This fraud technique preys on the trust of individuals, especially in contexts where upfront payments may seem standard—like home improvement or freelance services.

Let’s evaluate the other options to clarify why they don’t fit this case:

• A. Deposit scheme – While similar, a deposit scheme typically refers to a small good-faith payment to secure a service or item. The difference lies in scope: Geoffrey paid the full amount upfront, not just a partial deposit. Though both involve nondelivery of promised services, advance-fee schemes more accurately describe scams involving full prepayment.

• B. Scavenger scheme – This form of fraud generally involves reselling or acquiring products or services for profit, often through unethical or illegal means. It doesn’t involve upfront payments by a victim for a promised service. Therefore, it doesn’t fit Geoffrey’s situation.

• C. Block hustle scheme – This is a street-level term sometimes used to describe scams that involve manipulating entire groups or systems, often associated with more organized or investment-related fraud. It is not commonly used to describe contractor scams or one-on-one fraud situations like Geoffrey’s.

• D. Advance-fee scheme – This is the most accurate classification. The key elements—an upfront payment, a promised service, and a sudden disappearance of the service provider—are hallmarks of this scheme. Geoffrey believed he was securing materials and labor for his patio, but in reality, he was manipulated into transferring money to someone with no intention of delivering on their promises.

In summary, Geoffrey was targeted using an advance-fee scheme, where fraudsters ask for prepayment and then vanish without providing the agreed-upon services or goods. This scheme is common in contractor fraud, rental scams, and fake job offers.

Question 4:

Neil, a Certified Fraud Examiner (CFE), investigates a case where a borrower used the same piece of property as collateral to secure multiple loans from different lenders. 

These loans were acquired before the earlier ones appeared on the borrower’s credit record. What type of loan fraud best fits this scenario?

A. Single-family housing loan fraud
B. Linked financing
C. Double-pledging collateral
D. Reciprocal loan arrangements

Correct Answer: C

Explanation:

The situation Neil uncovered involves a borrower who pledged the same property to secure multiple loans from various financial institutions. This behavior is fraudulent and is referred to as double-pledging collateral. It involves using a single asset as security for more than one loan without informing the involved lenders, which can lead to severe financial complications and is considered a form of deception.

In a standard lending agreement, collateral is used to secure a loan, ensuring that the lender can recover their losses if the borrower defaults. When the same asset is used for multiple loans—especially before those loans are publicly recorded or reflected on credit reports—it becomes almost impossible for the lenders to recognize the duplicate claims. This deliberate concealment is a violation of financial laws and constitutes loan fraud.

Let’s review the incorrect options for clarity:

• A. Single-family housing loan fraud – This term generally applies to misrepresentations or false information provided during the mortgage application process for single-family homes. Examples might include inflating income or lying about occupancy. However, it doesn’t capture the fraudulent practice of using the same asset for multiple loans.

• B. Linked financing – This concept typically refers to transactions where one loan or financial obligation is tied to another. While linked financing can be part of complex fraud, it doesn’t involve the deceptive reuse of collateral, which is the central issue in this case.

• C. Double-pledging collateral – This is the accurate and most fitting term. It refers specifically to the situation where the same collateral is pledged to back more than one loan, usually without the lenders’ knowledge. Because these transactions occurred before being reported, lenders had no indication of risk, making the fraud hard to detect. This type of scheme undermines lender confidence and can have significant legal and financial consequences.

• D. Reciprocal loan arrangements – This occurs when two or more parties agree to lend money to each other under a mutual understanding. While potentially unethical in some cases, this does not describe the act of using the same property to secure multiple loans.

In conclusion, double-pledging collateral is the most appropriate classification for the fraud Neil uncovered. It directly refers to the illegal reuse of the same asset for multiple loans and captures the essence of this deceptive tactic.

Question 5:

Which of the following options most clearly signals the presence of a bid tailoring scheme in a procurement process?

A. Detailed explanations accompany changes in specifications compared to previous versions.
B. Contracts are rebid because the minimum number of required bids was not reached.
C. A large number of vendors submit bids for the procurement.
D. The specifications for the required goods are unusually vague or broadly defined.

Correct Answer: D

Explanation:

A bid tailoring scheme is a deceptive procurement tactic where the requirements for a contract are intentionally manipulated to benefit a specific vendor. This unethical behavior undermines competitive bidding by subtly excluding other capable suppliers through the manipulation of technical or operational criteria. Recognizing the indicators of such fraud is essential to maintaining a fair and open procurement process.

Let’s evaluate each answer choice to determine which one is most likely to represent a red flag of bid tailoring:

A. When a procurement team provides detailed justifications for specification changes from earlier versions, it indicates a transparent and accountable process. This type of documentation is a hallmark of integrity and best practices. Far from being suspicious, it strengthens trust in the procurement process. Therefore, this is not a red flag.

B. Rebidding due to insufficient participation—such as receiving fewer bids than required—is a legitimate procedural step. Market conditions or vendor disinterest could result in a low response rate. In such cases, the organization may rebid to ensure broader competition. While worth monitoring, this behavior does not inherently suggest fraud or manipulation.

C. A high number of bidders typically reflects healthy market interest and open competition. This outcome suggests that the tender is fairly constructed and accessible to many vendors. Rather than signaling a problem, it shows that the procurement process is operating transparently. Thus, this is the opposite of a red flag.

D. On the other hand, broad or vague specifications are a well-known warning sign of bid tailoring. When requirements are written in general or ambiguous terms, it opens the door for subjective interpretation, enabling evaluators to steer the award toward a preferred vendor. This tactic can disqualify legitimate vendors while favoring one who has insider knowledge or was consulted during the drafting phase.

By keeping the specifications flexible and undefined, procurement personnel can tailor outcomes while creating the appearance of compliance. This is a classic technique used in bid manipulation, and it's a serious concern for auditors and compliance officers.

Therefore, the correct answer is: D, as overly broad specifications often indicate an intentional effort to steer the contract toward a pre-selected vendor.

Question 6:

Which of the following statements is incorrect regarding the methods commonly used by corporate spies to steal information from target organizations?

A. Spies sometimes create fake employee badges to gain unauthorized access to company facilities.
B. Spies may secure jobs in janitorial or security roles to gain insider access.
C. Technical surveillance usually involves gathering publicly available documents through open sources.
D. Social engineering involves manipulating individuals to reveal confidential data using trickery or persuasion.

Correct Answer: C

Explanation:

Corporate espionage involves gathering confidential, proprietary, or sensitive business information through illicit or unethical means. Spies targeting organizations may employ a mix of physical access, digital surveillance, and psychological manipulation to extract information that provides a competitive edge to a rival entity or criminal network. Understanding the methods commonly used in corporate spying is vital for improving organizational security and threat awareness.

Let’s examine each option to identify which statement is false.

A. Creating counterfeit employee badges is a common method of physical infiltration. By impersonating authorized personnel, spies can gain access to restricted areas, potentially allowing them to steal documents or install surveillance equipment. This tactic has been documented in real-world espionage cases and is a true representation of espionage techniques.

B. Corporate spies often seek employment in low-visibility roles such as janitorial or security staff. These positions offer legitimate access to areas that other employees may not enter. Because they operate behind the scenes, spies in these roles can observe operations, access equipment, or collect physical data without drawing attention. This method is also accurate and widely recognized.

C. This is the false statement. Technical surveillance refers to the use of tools like hidden microphones, wiretaps, hidden cameras, and signal interceptors to covertly monitor or record private communications or activities. It is not the same as gathering documents from open sources, which falls under open-source intelligence (OSINT). While OSINT is legal and involves searching public databases or the internet, technical surveillance is designed to capture information that the organization deliberately keeps private. Hence, this statement confuses two completely different types of intelligence gathering.

D. Social engineering is a widely known technique used by spies to trick employees into revealing passwords, account details, or internal procedures. It exploits human vulnerabilities rather than technical ones. Methods include phishing emails, impersonation, pretexting, or even friendly persuasion. This definition aligns with real-world scenarios and is correct.

In conclusion, the false statement is C because it incorrectly describes technical surveillance as being focused on publicly available data, which is actually a hallmark of OSINT, not covert surveillance operations.

Question 7:

Which scenario best represents a cash larceny scheme?

A. Michael processes a fake return for a $50 sweater and steals $50 from the register.
B. Scott uses a “no sale” function to open the drawer and takes a $100 bill.
C. Olive under-rings a $500 table for $400 and pockets the $100 difference.
D. Laura gives merchandise to a customer without recording the sale and keeps the cash.

Correct Answer: B

Explanation:

Cash larceny is a type of occupational fraud where an employee steals cash after it has already been recorded in the company’s accounting system, such as in a point-of-sale (POS) system or a cash register. It differs from skimming, which occurs before the transaction is logged. Understanding this distinction is crucial when evaluating which actions classify as cash larceny.

Let’s analyze each option:

Option A describes Michael processing a false return for a $50 item and taking cash. Although theft is involved, this is more accurately categorized as a refund fraud scheme. The cash is stolen under the pretense of a transaction (a return), which is falsified. Since the transaction is artificially created, it does not meet the definition of larceny.

Option B, which is the correct answer, depicts Scott initiating a “no sale” transaction to open the register and then taking $100. This action perfectly aligns with the definition of cash larceny. The drawer contains recorded sales money, and Scott removes it without authorization. The theft happens after the cash is officially in the register system, without altering or faking transactions.

Option C shows Olive undercharging a customer and keeping the extra money. This act, known as under-ringing or skimming, occurs before the full transaction is recorded. The system is never updated with the correct sale amount, meaning the $100 is never officially recorded. Hence, this is not larceny.

Option D involves Laura not recording the sale at all and pocketing the customer’s cash. Again, this falls under skimming, as the transaction is omitted entirely from the records. No sales data is entered, and therefore, the money taken was never logged.

In summary, cash larceny involves stealing money that has already been logged in the system. The critical element is the post-transaction theft, which is clearly illustrated in Option B. The rest involve manipulation or omission of transactions, which categorizes them under skimming or refund fraud.

Question 8:

Which of the following is not a core objective of information security in an e-commerce environment?

A. Ensuring data availability
B. Determining the materiality of data
C. Protecting the confidentiality of information
D. Maintaining data integrity

Correct Answer: B

Explanation:

In the realm of information security, especially for e-commerce systems, the main guiding principles are encapsulated in the CIA Triad—Confidentiality, Integrity, and Availability. These three pillars define the standard goals of securing digital information. Any measure designed to protect customer data, system reliability, and transactional accuracy falls within one or more of these categories.

Let’s examine each of the answer choices to determine which one does not belong:

Option A refers to availability, which ensures that data and system resources are accessible to authorized users whenever needed. In the context of e-commerce, this translates to reliable site access, payment processing, and uninterrupted account services. Downtime or service denial can lead to loss of business and customer trust, making availability a foundational security concern.

Option B, the correct answer, mentions materiality, a concept more commonly associated with financial auditing or legal evaluations. Materiality refers to how significant a piece of information is in influencing decisions, but it is not part of the standard security objectives. While materiality can guide risk assessments or prioritization of data types, it is not a technical security goal.

Option C highlights confidentiality, which involves protecting sensitive information from unauthorized access. In e-commerce, this encompasses customer names, payment details, addresses, and login credentials. Confidentiality is upheld using encryption, authentication, and access control mechanisms to prevent data breaches.

Option D refers to integrity, which guarantees that data remains accurate, reliable, and unaltered during storage or transmission. Integrity is essential in financial transactions, order processing, and inventory management. If integrity is compromised, it can lead to customer dissatisfaction or fraud.

In conclusion, while all other options represent established information security goals, materiality is an accounting and auditing concept—not a recognized part of the CIA triad or cybersecurity objectives. Therefore, it stands out as not belonging in the context of information security for e-commerce systems.

Question 9:

Jones, who works as an accounts payable clerk for Smith Company, deliberately issued a check to the wrong vendor. He then contacted the vendor, explained that the payment was a mistake, and asked them to return the check. 

Once the vendor sent it back, Jones intercepted the returned check and deposited it into his personal account. What type of fraud scheme does this describe?

A. Shell company scheme
B. Pay and return scheme
C. Altered payee scheme
D. Pass-through scheme

Correct Answer: B

Explanation:

The scenario describes a type of occupational fraud where an employee manipulates the company's payment process to redirect funds for personal benefit. Jones purposely sent a check to the wrong vendor and then intervened when the check was returned, taking the opportunity to misappropriate the funds. This type of activity closely aligns with a pay and return scheme, a recognized form of asset misappropriation.

Let’s assess each choice:

A. Shell company scheme
A shell company scheme involves setting up a fictitious or non-operational business to receive fraudulent payments from the employer. The perpetrator typically fabricates invoices or purchase orders for nonexistent goods or services. However, in Jones’s case, there is no indication that a fake business was used. He redirected an existing transaction involving a legitimate vendor, so this is not a shell company scheme.

B. Pay and return scheme
This is the correct classification. A pay and return scheme occurs when an employee intentionally overpays a vendor or issues payment to the wrong party and later requests that the vendor return the excess funds. The fraudster then intercepts the refund or return and deposits the money into their own account. In this case, Jones manufactured the situation by sending a check to the wrong vendor, requesting a return, and intercepting the returned payment for personal use. This textbook example confirms that this was a pay and return scheme.

C. Altered payee scheme
This type of fraud involves changing the payee name on a legitimate check to divert funds to the fraudster or an accomplice. There’s no evidence Jones changed the name on the check or tampered with payee information. Instead, he manipulated the return process, not the payee, making this option inaccurate.

D. Pass-through scheme
In a pass-through scheme, an employee directs purchases through a third-party vendor (often a legitimate one that they control or have a stake in), inflates prices, and pockets the difference. Again, there’s no mention of a third-party vendor profiting or acting as a middleman. This choice doesn’t apply to Jones's behavior.

In summary, Jones’s actions demonstrate a clear instance of a pay and return scheme, where the fraud revolves around misdirected payments and intercepting returned funds for personal enrichment.

Question 10:

Which of the following statements most accurately describes a type of malicious software (malware)?

A. A worm is a program that may not be malicious but exhibits suspicious or potentially unwanted behavior.
B. Ransomware is a self-replicating malicious application that spreads by injecting code into other systems.
C. Spyware is a type of software that secretly gathers user data without their consent or knowledge.
D. A Trojan horse is a benign-looking program that passively records keystrokes but isn’t necessarily harmful.

Correct Answer: C

Explanation:

To determine the most accurate statement, it’s essential to understand the fundamental nature and behavior of various types of malware. Malware is an umbrella term for malicious software designed to damage, exploit, or otherwise compromise computer systems.

Let’s review each option:

A. Worm
This statement incorrectly describes a worm. A worm is not just potentially unwanted or suspicious—it is clearly malicious. Worms are self-replicating programs that spread independently across networks without user input. They exploit vulnerabilities in operating systems or software to propagate, often causing significant disruption. Thus, characterizing them as “not definitely malicious” is misleading.

B. Ransomware
This option is also inaccurate. Ransomware is malware that encrypts a user’s data or locks access to systems and demands a ransom for release. While malicious, ransomware is not self-replicating, which is a defining trait of worms and certain viruses. It typically spreads through phishing emails or malicious downloads rather than independently duplicating itself. So, this description misrepresents ransomware’s primary mechanism.

C. Spyware
This is the correct and most accurate description. Spyware operates covertly, collecting personal or sensitive information—such as browsing habits, passwords, or credit card numbers—without the user’s knowledge or approval. It can be bundled with free software, downloaded from unsafe websites, or installed via phishing tactics. Spyware typically runs in the background and can compromise user privacy, identity, and security. This explanation precisely captures spyware's deceptive and intrusive nature.

D. Trojan horse
The description given here mischaracterizes a Trojan horse. While it may masquerade as harmless or useful software, a Trojan is intentionally harmful. It often creates backdoors for hackers, steals sensitive data, or installs additional malware. Keylogging is a common Trojan behavior, but calling it “not definitely malicious” understates its threat. Trojans are explicitly designed for deceit and damage.

In conclusion, option C correctly defines spyware as software that stealthily collects data without user consent, making it the most accurate and complete answer among the choices provided.