ACFE CFE - Financial Transactions and Fraud Schemes (Certified Fraud Examiner - Financial Transactions and Fraud Schemes) Practice Test 100

Question 990

An examination of sim-swap account takeover begins with this observation: Phone-service interruption immediately precedes password resets and account logins. Which follow-up procedure gives the most direct evidence?

  1. Correlate telecom SIM-change records with account recovery and transaction history.
  2. Review failed-login patterns, device fingerprints and successful account access.
  3. Inspect liveness testing results and compare trusted identity references.
  4. Compare date of birth and identity verification data with account origination records.

Explanation

Correct Answer

A:

For the SIM-swap account takeover concern, the procedure tests source evidence behind this observation: Phone-service interruption immediately precedes password resets and account logins. This matters because control of a phone number can intercept recovery codes without ownership of the underlying account; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

B:

This comparison primarily addresses Credential-stuffing identity abuse, in which reused passwords let attackers impersonate customers through online credential abuse; because the present question instead concerns SIM-swap account takeover, reviewers should correlate telecom SIM-change records with account recovery and transaction history rather than apply a check designed for Credential-stuffing identity abuse.

C:

This comparison primarily addresses Deepfake onboarding deception, in which synthetic audiovisual media can defeat naive identity checks without involving a genuine person; because the present question instead concerns SIM-swap account takeover, reviewers should correlate telecom SIM-change records with account recovery and transaction history rather than apply a check designed for Deepfake onboarding deception.

D:

This comparison primarily addresses Child identity misuse, in which children's identifiers can be exploited because misuse may remain unnoticed for years; because the present question instead concerns SIM-swap account takeover, reviewers should correlate telecom SIM-change records with account recovery and transaction history rather than apply a check designed for Child identity misuse.

Question 991

Two separate review files raise different issues. File A: A restaurateur maintains one sales ledger for management and reports a smaller cash-sales total to the tax authority. File B: A taxpayer invents supplier invoices to reduce declared profit and taxes. Which pairing accurately classifies both files?

  1. File A: Fabricated deductible business cost; File B: Unreported cash taxable income.
  2. File A: Unreported cash taxable income; File B: Lawful tax planning distinction.
  3. File A: False consumption-tax input credit; File B: Fabricated deductible business cost.
  4. File A: Unreported cash taxable income; File B: Fabricated deductible business cost.

Explanation

Correct Answer

D:

File A is Unreported cash taxable income because knowingly concealing taxable receipts can constitute tax evasion rather than lawful tax planning, while File B is Fabricated deductible business cost because a fictitious expense reduces reported taxable income without a genuine economic cost. The evidence chains differ: for File A, reviewers should reconcile independent sales evidence with filed taxable income; for File B, they should verify claimed costs against real supplier transactions and business purpose.

Incorrect Answers

A:

File A is misidentified as Fabricated deductible business cost instead of Unreported cash taxable income; File B is misidentified as Unreported cash taxable income instead of Fabricated deductible business cost. With the proposed pairing Fabricated deductible business cost / Unreported cash taxable income, the distinction is substantive: File A shows that payment processor and inventory records indicate sales above the tax returns, whereas File B shows that claimed deductions lack actual payments or received services. For these Unreported cash taxable income and Fabricated deductible business cost files, choosing the pair Fabricated deductible business cost / Unreported cash taxable income would misdirect the review away from at least one of these mechanisms.

B:

File B is misidentified as Lawful tax planning distinction instead of Fabricated deductible business cost. With the proposed pairing Unreported cash taxable income / Lawful tax planning distinction, the distinction is substantive: File A shows that payment processor and inventory records indicate sales above the tax returns, whereas File B shows that claimed deductions lack actual payments or received services. For these Unreported cash taxable income and Fabricated deductible business cost files, choosing the pair Unreported cash taxable income / Lawful tax planning distinction would misdirect the review away from at least one of these mechanisms.

C:

File A is misidentified as False consumption-tax input credit instead of Unreported cash taxable income. With the proposed pairing False consumption-tax input credit / Fabricated deductible business cost, the distinction is substantive: File A shows that payment processor and inventory records indicate sales above the tax returns, whereas File B shows that claimed deductions lack actual payments or received services. For these Unreported cash taxable income and Fabricated deductible business cost files, choosing the pair False consumption-tax input credit / Fabricated deductible business cost would misdirect the review away from at least one of these mechanisms.

Question 992

Two separate review files raise different issues. File A: A provider separately charges component tests that should be billed together under applicable rules. File B: A clinic submits claims for consultations on days the listed patients were never seen. Which pairing accurately classifies both files?

  1. File A: Phantom patient encounters; File B: Unbundled procedure billing.
  2. File A: Medical identity misuse; File B: Phantom patient encounters.
  3. File A: Unbundled procedure billing; File B: Medical service upcoding.
  4. File A: Medical service upcoding; File B: Unbundled procedure billing.
  5. File A: Unbundled procedure billing; File B: Phantom patient encounters.

Explanation

Correct Answer

E:

File A is Unbundled procedure billing because splitting a bundled service into extra claim lines can produce unjustified reimbursement, while File B is Phantom patient encounters because billing nonexistent visits extracts payment for services not rendered. The evidence chains differ: for File A, reviewers should review code combinations against current payer bundling rules and medical records; for File B, they should match encounter claims to scheduling, patient attestations and clinical documentation.

Incorrect Answers

A:

File A is misidentified as Phantom patient encounters instead of Unbundled procedure billing; File B is misidentified as Unbundled procedure billing instead of Phantom patient encounters. With the proposed pairing Phantom patient encounters / Unbundled procedure billing, the distinction is substantive: File A shows that claim lines repeatedly contain component codes that belong to a bundled service, whereas File B shows that appointment, access and patient-confirmation records show no encounter. For these Unbundled procedure billing and Phantom patient encounters files, choosing the pair Phantom patient encounters / Unbundled procedure billing would misdirect the review away from at least one of these mechanisms.

B:

File A is misidentified as Medical identity misuse instead of Unbundled procedure billing. With the proposed pairing Medical identity misuse / Phantom patient encounters, the distinction is substantive: File A shows that claim lines repeatedly contain component codes that belong to a bundled service, whereas File B shows that appointment, access and patient-confirmation records show no encounter. For these Unbundled procedure billing and Phantom patient encounters files, choosing the pair Medical identity misuse / Phantom patient encounters would misdirect the review away from at least one of these mechanisms.

C:

File B is misidentified as Medical service upcoding instead of Phantom patient encounters. With the proposed pairing Unbundled procedure billing / Medical service upcoding, the distinction is substantive: File A shows that claim lines repeatedly contain component codes that belong to a bundled service, whereas File B shows that appointment, access and patient-confirmation records show no encounter. For these Unbundled procedure billing and Phantom patient encounters files, choosing the pair Unbundled procedure billing / Medical service upcoding would misdirect the review away from at least one of these mechanisms.

D:

File A is misidentified as Medical service upcoding instead of Unbundled procedure billing; File B is misidentified as Unbundled procedure billing instead of Phantom patient encounters. With the proposed pairing Medical service upcoding / Unbundled procedure billing, the distinction is substantive: File A shows that claim lines repeatedly contain component codes that belong to a bundled service, whereas File B shows that appointment, access and patient-confirmation records show no encounter. For these Unbundled procedure billing and Phantom patient encounters files, choosing the pair Medical service upcoding / Unbundled procedure billing would misdirect the review away from at least one of these mechanisms.

Question 993

Two separate review files raise different issues. File A: A small service business records large volumes of invented cash sales to commingle illicit funds. File B: Cash is physically moved across borders in concealed packages instead of through traceable transfers. Which pairing accurately classifies both files?

  1. File A: Bulk currency courier; File B: Cash-intensive front business.
  2. File A: Virtual-asset layering; File B: Bulk currency courier.
  3. File A: Cash-intensive front business; File B: Trade under-invoicing.
  4. File A: Cash-intensive front business; File B: Bulk currency courier.

Explanation

Correct Answer

D:

File A is Cash-intensive front business because fictitious sales provide a plausible bookkeeping story for introducing criminal cash, while File B is Bulk currency courier because physical transportation can shift criminal cash between jurisdictions outside routine bank wires. The evidence chains differ: for File A, reviewers should compare reported cash sales with independent capacity, procurement and customer evidence; for File B, they should trace travel logistics, border declarations and linked currency seizures.

Incorrect Answers

A:

File A is misidentified as Bulk currency courier instead of Cash-intensive front business; File B is misidentified as Cash-intensive front business instead of Bulk currency courier. With the proposed pairing Bulk currency courier / Cash-intensive front business, the distinction is substantive: File A shows that deposits and claimed revenue greatly exceed footfall, staffing and operating capacity, whereas File B shows that travel or shipment patterns and declared funds conflict with observed currency movements. For these Cash-intensive front business and Bulk currency courier files, choosing the pair Bulk currency courier / Cash-intensive front business would misdirect the review away from at least one of these mechanisms.

B:

File A is misidentified as Virtual-asset layering instead of Cash-intensive front business. With the proposed pairing Virtual-asset layering / Bulk currency courier, the distinction is substantive: File A shows that deposits and claimed revenue greatly exceed footfall, staffing and operating capacity, whereas File B shows that travel or shipment patterns and declared funds conflict with observed currency movements. For these Cash-intensive front business and Bulk currency courier files, choosing the pair Virtual-asset layering / Bulk currency courier would misdirect the review away from at least one of these mechanisms.

C:

File B is misidentified as Trade under-invoicing instead of Bulk currency courier. With the proposed pairing Cash-intensive front business / Trade under-invoicing, the distinction is substantive: File A shows that deposits and claimed revenue greatly exceed footfall, staffing and operating capacity, whereas File B shows that travel or shipment patterns and declared funds conflict with observed currency movements. For these Cash-intensive front business and Bulk currency courier files, choosing the pair Cash-intensive front business / Trade under-invoicing would misdirect the review away from at least one of these mechanisms.

Question 994

An examination of trade under-invoicing begins with this observation: Export records and comparable sale prices indicate substantial underpricing. Which follow-up procedure gives the most direct evidence?

  1. Compare reported cash sales with independent capacity, procurement and customer evidence.
  2. Compare bills of lading, pricing benchmarks and intercompany settlement flows.
  3. Trace travel logistics, border declarations and linked currency seizures.
  4. Reconcile trade invoices with shipping detail, customs declarations and market benchmarks.

Explanation

Correct Answer

D:

For the Trade under-invoicing concern, the procedure tests source evidence behind this observation: Export records and comparable sale prices indicate substantial underpricing. This matters because underpricing can move economic value to an offshore counterparty through an ostensibly normal sale; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Cash-intensive front business, in which fictitious sales provide a plausible bookkeeping story for introducing criminal cash; because the present question instead concerns Trade under-invoicing, reviewers should reconcile trade invoices with shipping detail, customs declarations and market benchmarks rather than apply a check designed for Cash-intensive front business.

B:

This comparison primarily addresses Trade over-invoicing, in which inflated trade prices can transfer value across borders under cover of legitimate commerce; because the present question instead concerns Trade under-invoicing, reviewers should reconcile trade invoices with shipping detail, customs declarations and market benchmarks rather than apply a check designed for Trade over-invoicing.

C:

This comparison primarily addresses Bulk currency courier, in which physical transportation can shift criminal cash between jurisdictions outside routine bank wires; because the present question instead concerns Trade under-invoicing, reviewers should reconcile trade invoices with shipping detail, customs declarations and market benchmarks rather than apply a check designed for Bulk currency courier.

Question 995

The case file describes the following: An applicant deliberately omits a material medical history fact when applying for coverage and that omission affects underwriting. Which classification best explains the events?

  1. Workers compensation malingering
  2. Duplicate casualty claims
  3. Fictitious beneficiary change
  4. Concealed preexisting condition

Explanation

Correct Answer

D:

Concealed preexisting condition fits the facts because material misrepresentation at policy inception differs from fabricating a later insured loss; the distinguishing observation is that earlier medical records contradict answers on the application. To test this interpretation, a reviewer should compare authorized medical evidence with disclosed underwriting history.

Incorrect Answers

A:

Workers compensation malingering would involve a different sequence from Concealed preexisting condition: misstated disability status can sustain benefits inconsistent with actual capacity. Unlike the rejected Workers compensation malingering label, the evidence concerns Concealed preexisting condition, since earlier medical records contradict answers on the application; reviewers should compare authorized medical evidence with disclosed underwriting history.

B:

Duplicate casualty claims would involve a different sequence from Concealed preexisting condition: multiple recoveries for one loss can exceed the legitimate indemnifiable damage. Unlike the rejected Duplicate casualty claims label, the evidence concerns Concealed preexisting condition, since earlier medical records contradict answers on the application; reviewers should compare authorized medical evidence with disclosed underwriting history.

C:

Fictitious beneficiary change would involve a different sequence from Concealed preexisting condition: the scheme tampers with policy entitlement rather than misrepresenting the insured event. Unlike the rejected Fictitious beneficiary change label, the evidence concerns Concealed preexisting condition, since earlier medical records contradict answers on the application; reviewers should compare authorized medical evidence with disclosed underwriting history.

Question 996

The risk team has identified the following unsuitable securities recommendation exposure: A sale can be improper because the recommendation does not match the customer's circumstances, not because the product itself is inherently unlawful. Which proposed prevention step is most effective?

  1. Require comprehensive disclosure diligence and independent review of material risks.
  2. Monitor commission-driven activity and require supervisory review of high-turnover accounts.
  3. Monitor promotional claims and suspicious trading around low-liquidity securities.
  4. Require documented suitability assessment and independent review of high-risk recommendations.

Explanation

Correct Answer

D:

The control directly addresses the failure point in Unsuitable securities recommendation, since a sale can be improper because the recommendation does not match the customer's circumstances, not because the product itself is inherently unlawful. A subsequent independent review could compare recommended product risk with the suitability and client-knowledge records to identify exceptions that bypassed the safeguard.

Incorrect Answers

A:

This safeguard is directed primarily at Misleading offering prospectus rather than Unsuitable securities recommendation, because omission of decision-useful facts can mislead investors even where some published numbers are accurate. Unlike the control for Misleading offering prospectus, the more direct design for Unsuitable securities recommendation is to require documented suitability assessment and independent review of high-risk recommendations; a different safeguard cannot substitute for it.

B:

This safeguard is directed primarily at Excessive-account churning rather than Unsuitable securities recommendation, because excessive trading for broker compensation can constitute churning when control and other relevant elements are present. Unlike the control for Excessive-account churning, the more direct design for Unsuitable securities recommendation is to require documented suitability assessment and independent review of high-risk recommendations; a different safeguard cannot substitute for it.

C:

This safeguard is directed primarily at Pump-and-dump stock promotion rather than Unsuitable securities recommendation, because false hype can induce investor purchases while manipulators unload inflated positions. Unlike the control for Pump-and-dump stock promotion, the more direct design for Unsuitable securities recommendation is to require documented suitability assessment and independent review of high-risk recommendations; a different safeguard cannot substitute for it.

Question 997

An analyst is selecting warning signs for tender specifications tailored to one supplier. Which recorded pattern should receive focused attention?

  1. Winners rotate predictably among a stable bidder group despite changing cost conditions.
  2. Site access and staffing records contradict skill grades and hours on invoices.
  3. Extensions exceed stated options and bypass mandated review dates.
  4. Specifications mirror one vendor catalog while alternatives meet the operational need.
  5. Planning records show sufficient lead time and no genuine critical shortage.

Explanation

Correct Answer

D:

This observation is a pertinent indicator of Tender specifications tailored to one supplier because bid tailoring manipulates the solicitation before vendors compete. The practical corroborating procedure is to compare requirement drafts, market alternatives and supplier communications; the indicator by itself does not establish intent or error.

Incorrect Answers

A:

The proposed observation fits Bid rotation agreement, where bid rotation is an agreement to allocate wins rather than genuine independent competition, rather than the particular mechanism in Tender specifications tailored to one supplier. Unlike the clue for Bid rotation agreement, the more directly related indicator for Tender specifications tailored to one supplier is this: Specifications mirror one vendor catalog while alternatives meet the operational need.

B:

The proposed observation fits Time-and-materials labor padding, where misstated labor grade or effort inflates reimbursable service cost after award, rather than the particular mechanism in Tender specifications tailored to one supplier. Unlike the clue for Time-and-materials labor padding, the more directly related indicator for Tender specifications tailored to one supplier is this: Specifications mirror one vendor catalog while alternatives meet the operational need.

C:

The proposed observation fits Unauthorized contract extension, where improper continuation can give an incumbent business without the required competition, rather than the particular mechanism in Tender specifications tailored to one supplier. Unlike the clue for Unauthorized contract extension, the more directly related indicator for Tender specifications tailored to one supplier is this: Specifications mirror one vendor catalog while alternatives meet the operational need.

E:

The proposed observation fits Artificial urgency sole-source award, where false urgency defeats normal competitive sourcing under an unjustified exception, rather than the particular mechanism in Tender specifications tailored to one supplier. Unlike the clue for Artificial urgency sole-source award, the more directly related indicator for Tender specifications tailored to one supplier is this: Specifications mirror one vendor catalog while alternatives meet the operational need.

Question 998

The review team observes the following: Dispatch scans lack matching customer orders or destination acknowledgments. It seeks one targeted detection step and one preventive measure that address the same underlying vulnerability. Which pairing is best?

  1. Diagnostic: Match shipment scans and carrier proof of delivery to authorized sales or transfers; safeguard: Release inventory only against validated orders and independently reviewed destinations.
  2. Diagnostic: Compare asset-location audits and access logs with authorized lending records; safeguard: Release inventory only against validated orders and independently reviewed destinations.
  3. Diagnostic: Match shipment scans and carrier proof of delivery to authorized sales or transfers; safeguard: Separate storage custody from inventory write-offs and conduct blind counts.
  4. Diagnostic: Reconcile cycle counts, stock movements and exception adjustments by custodian; safeguard: Require independent condition verification and controlled disposal logs.

Explanation

Correct Answer

A:

The test addresses Fictitious outbound shipment by targeting this observation: Dispatch scans lack matching customer orders or destination acknowledgments. The accompanying safeguard—release inventory only against validated orders and independently reviewed destinations—counters the same opportunity, so both checking and prevention concern one cause.

Incorrect Answers

B:

The proposed safeguard is relevant to Fictitious outbound shipment, but the diagnostic tests Unauthorized equipment personal use rather than the identified anomaly. That test is aimed at records involving equipment checkout history shows extended absence without approved projects; the specified case instead calls for reviewers to match shipment scans and carrier proof of delivery to authorized sales or transfers.

C:

The diagnostic correctly examines Fictitious outbound shipment by having reviewers match shipment scans and carrier proof of delivery to authorized sales or transfers, but the safeguard is for Warehouse stock diversion. That prevention step responds to a different mechanism: The employee converts recorded merchandise to private use by exploiting physical access.

D:

The evidence test relates to Warehouse stock diversion, whereas the proposed safeguard protects against False scrap classification; neither directly resolves Fictitious outbound shipment. Unlike the Warehouse stock diversion test and False scrap classification safeguard, the investigation of Fictitious outbound shipment requires reviewers to match shipment scans and carrier proof of delivery to authorized sales or transfers, followed by assessment of the matching control point.

Question 999

The monitoring team needs an observable indicator of authorized-maker self-payment. Which signal aligns most closely with the risk?

  1. Cleared check images show payee alterations inconsistent with the payment voucher.
  2. Recent bank-account changes precede transfers while invoices remain otherwise valid.
  3. Bank images identify a different beneficiary than the expense ledger suggests.
  4. Payments to related beneficiaries lack independent authorization or economic support.

Explanation

Correct Answer

D:

This observation is a pertinent indicator of Authorized-maker self-payment because authority to sign does not confer permission to take company funds for personal use. The practical corroborating procedure is to compare signers and beneficiaries with employee conflict declarations and contracts; the indicator by itself does not establish intent or error.

Incorrect Answers

A:

The proposed observation fits Altered check payee, where an otherwise authorized check is redirected by changing who can receive the proceeds, rather than the particular mechanism in Authorized-maker self-payment. Unlike the clue for Altered check payee, the more directly related indicator for Authorized-maker self-payment is this: Payments to related beneficiaries lack independent authorization or economic support.

B:

The proposed observation fits ACH beneficiary substitution, where the fraud redirects a genuine disbursement through altered settlement coordinates, rather than the particular mechanism in Authorized-maker self-payment. Unlike the clue for ACH beneficiary substitution, the more directly related indicator for Authorized-maker self-payment is this: Payments to related beneficiaries lack independent authorization or economic support.

C:

The proposed observation fits Concealed check diversion, where the cash leaves via an unauthorized payment camouflaged by accounting classification, rather than the particular mechanism in Authorized-maker self-payment. Unlike the clue for Concealed check diversion, the more directly related indicator for Authorized-maker self-payment is this: Payments to related beneficiaries lack independent authorization or economic support.

Question 1000

The case file describes the following: A fraud network cultivates a victim over weeks, displays fictitious trading profits and then blocks withdrawals unless new fees are paid. Which classification best explains the events?

  1. Online romance investment grooming
  2. Pig-butchering investment scam
  3. Advance-fee lottery fraud
  4. Ponzi payout financing

Explanation

Correct Answer

B:

Pig-butchering investment scam fits the facts because long-form social engineering combines relationship grooming with fabricated investment performance; the distinguishing observation is that platform balances rise without verifiable custody and withdrawal attempts trigger extra demands. To test this interpretation, a reviewer should verify platform licensing and wallet flows instead of trusting account screenshots.

Incorrect Answers

A:

Online romance investment grooming would involve a different sequence from Pig-butchering investment scam: the fraud uses emotional trust to induce transfers, often without the promised investment existing. Unlike the rejected Online romance investment grooming label, the evidence concerns Pig-butchering investment scam, since platform balances rise without verifiable custody and withdrawal attempts trigger extra demands; reviewers should verify platform licensing and wallet flows instead of trusting account screenshots.

C:

Advance-fee lottery fraud would involve a different sequence from Pig-butchering investment scam: the promise of future value is used to extract an immediate fee without a real award. Unlike the rejected Advance-fee lottery fraud label, the evidence concerns Pig-butchering investment scam, since platform balances rise without verifiable custody and withdrawal attempts trigger extra demands; reviewers should verify platform licensing and wallet flows instead of trusting account screenshots.

D:

Ponzi payout financing would involve a different sequence from Pig-butchering investment scam: a Ponzi structure pays old investors with new funds while misrepresenting actual returns. Unlike the rejected Ponzi payout financing label, the evidence concerns Pig-butchering investment scam, since platform balances rise without verifiable custody and withdrawal attempts trigger extra demands; reviewers should verify platform licensing and wallet flows instead of trusting account screenshots.

Certified Fraud Examiner - Financial Transactions and Fraud Schemes (CFE - Financial Transactions and Fraud Schemes) Practice Tests