ACFE CFE - Financial Transactions and Fraud Schemes (Certified Fraud Examiner - Financial Transactions and Fraud Schemes) Practice Test 5

Question 40

An examination of elder caregiver financial exploitation begins with this observation: Payments to caregiver-related accounts rise as the person's capacity or independence declines. Which follow-up procedure gives the most direct evidence?

  1. Check the claim using government contact channels obtained independently.
  2. Link relationship communications with payment destinations and platform authenticity.
  3. Verify asset custody, independent reserves and the reality of return generation.
  4. Review account authority, beneficiary connections and contemporaneous consent evidence.

Explanation

Correct Answer

D:

For the Elder caregiver financial exploitation concern, the procedure tests source evidence behind this observation: Payments to caregiver-related accounts rise as the person's capacity or independence declines. This matters because abuse of trust or access can divert assets from a vulnerable person without a public investment pitch; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Government-agent impersonation scam, in which authority impersonation exploits fear and urgency to make victims send funds; because the present question instead concerns Elder caregiver financial exploitation, reviewers should review account authority, beneficiary connections and contemporaneous consent evidence rather than apply a check designed for Government-agent impersonation scam.

B:

This comparison primarily addresses Online romance investment grooming, in which the fraud uses emotional trust to induce transfers, often without the promised investment existing; because the present question instead concerns Elder caregiver financial exploitation, reviewers should review account authority, beneficiary connections and contemporaneous consent evidence rather than apply a check designed for Online romance investment grooming.

C:

This comparison primarily addresses Guaranteed crypto yield scam, in which unsubstantiated investment guarantees can camouflage misappropriation rather than legitimate market profits; because the present question instead concerns Elder caregiver financial exploitation, reviewers should review account authority, beneficiary connections and contemporaneous consent evidence rather than apply a check designed for Guaranteed crypto yield scam.

Question 41

An exception review involving duplicate expense reimbursement identifies the following: Matching receipt hashes, amounts and dates appear in multiple paid claims. Which evidence comparison most directly evaluates the facts?

  1. Test cash refunds against original receipts, customer details and inventory returns.
  2. Compare normalized receipt images and merchant details across claim histories.
  3. Verify lodging invoices with approved travel itineraries and actual attendance.
  4. Match void timestamps with customer receipts and inventory movement.

Explanation

Correct Answer

B:

For the Duplicate expense reimbursement concern, the procedure tests source evidence behind this observation: Matching receipt hashes, amounts and dates appear in multiple paid claims. This matters because one real expense is reimbursed more than once, inflating the employee's recovery; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Fictitious register refund, in which the false disbursement is disguised as money returned to a customer; because the present question instead concerns Duplicate expense reimbursement, reviewers should compare normalized receipt images and merchant details across claim histories rather than apply a check designed for Fictitious register refund.

C:

This comparison primarily addresses Fictitious travel reimbursement, in which the claimant seeks payment for an expense that was never incurred; because the present question instead concerns Duplicate expense reimbursement, reviewers should compare normalized receipt images and merchant details across claim histories rather than apply a check designed for Fictitious travel reimbursement.

D:

This comparison primarily addresses Fraudulent sale void, in which voiding erases or reverses a legitimate recorded sale while the customer payment was retained; because the present question instead concerns Duplicate expense reimbursement, reviewers should compare normalized receipt images and merchant details across claim histories rather than apply a check designed for Fraudulent sale void.

Question 42

The review team observes the following: Refunds lack linked original sales or physical returned goods. It seeks one targeted detection step and one preventive measure that address the same underlying vulnerability. Which pairing is best?

  1. Diagnostic: Reconcile register paid-outs to approved source documents and purchases; safeguard: Use duplicate-claim analytics and retain searchable receipt records.
  2. Diagnostic: Test cash refunds against original receipts, customer details and inventory returns; safeguard: Require independent authorization and item verification for refunds.
  3. Diagnostic: Test cash refunds against original receipts, customer details and inventory returns; safeguard: Disallow unsupported cash paid-outs and require separate approval.
  4. Diagnostic: Match void timestamps with customer receipts and inventory movement; safeguard: Require independent authorization and item verification for refunds.

Explanation

Correct Answer

B:

The test addresses Fictitious register refund by targeting this observation: Refunds lack linked original sales or physical returned goods. The accompanying safeguard—require independent authorization and item verification for refunds—counters the same opportunity, so both checking and prevention concern one cause.

Incorrect Answers

A:

The evidence test relates to Unauthorized register cash payout, whereas the proposed safeguard protects against Duplicate expense reimbursement; neither directly resolves Fictitious register refund. Unlike the Unauthorized register cash payout test and Duplicate expense reimbursement safeguard, the investigation of Fictitious register refund requires reviewers to test cash refunds against original receipts, customer details and inventory returns, followed by assessment of the matching control point.

C:

The diagnostic correctly examines Fictitious register refund by having reviewers test cash refunds against original receipts, customer details and inventory returns, but the safeguard is for Unauthorized register cash payout. That prevention step responds to a different mechanism: The register balance is reduced through a purported business disbursement rather than a sale.

D:

The proposed safeguard is relevant to Fictitious register refund, but the diagnostic tests Fraudulent sale void rather than the identified anomaly. That test is aimed at records involving voids cluster under one cashier after high-cash transactions; the specified case instead calls for reviewers to test cash refunds against original receipts, customer details and inventory returns.

Question 43

A reviewer wants to distinguish recruitment-driven pyramid from adjacent risk patterns. Which observation is the most diagnostic indicator?

  1. Compensation depends on enrollment fees and chain recruitment despite weak retail sales.
  2. A surprise prize demand has no verifiable entry and requires upfront payment.
  3. Redemptions correlate with fresh investor money instead of investment profits.
  4. The demand uses urgency and an implausible nonofficial payment method.

Explanation

Correct Answer

A:

This observation is a pertinent indicator of Recruitment-driven pyramid because recruitment dependence distinguishes a pyramid structure from ordinary retail distribution. The practical corroborating procedure is to analyze compensation flows and genuine external customer transactions; the indicator by itself does not establish intent or error.

Incorrect Answers

B:

The proposed observation fits Advance-fee lottery fraud, where the promise of future value is used to extract an immediate fee without a real award, rather than the particular mechanism in Recruitment-driven pyramid. Unlike the clue for Advance-fee lottery fraud, the more directly related indicator for Recruitment-driven pyramid is this: Compensation depends on enrollment fees and chain recruitment despite weak retail sales.

C:

The proposed observation fits Ponzi payout financing, where a Ponzi structure pays old investors with new funds while misrepresenting actual returns, rather than the particular mechanism in Recruitment-driven pyramid. Unlike the clue for Ponzi payout financing, the more directly related indicator for Recruitment-driven pyramid is this: Compensation depends on enrollment fees and chain recruitment despite weak retail sales.

D:

The proposed observation fits Government-agent impersonation scam, where authority impersonation exploits fear and urgency to make victims send funds, rather than the particular mechanism in Recruitment-driven pyramid. Unlike the clue for Government-agent impersonation scam, the more directly related indicator for Recruitment-driven pyramid is this: Compensation depends on enrollment fees and chain recruitment despite weak retail sales.

Question 44

The review team observes the following: Biometric session artifacts disagree with independently verified identity and device provenance. It seeks one targeted detection step and one preventive measure that address the same underlying vulnerability. Which pairing is best?

  1. Diagnostic: Inspect liveness testing results and compare trusted identity references; safeguard: Verify taxpayer identity and flag anomalous refund destination changes.
  2. Diagnostic: Compare reported URLs and capture artifacts with official government portals; safeguard: Apply robust liveness checks with additional risk-based identity verification.
  3. Diagnostic: Inspect liveness testing results and compare trusted identity references; safeguard: Apply robust liveness checks with additional risk-based identity verification.
  4. Diagnostic: Cross-check filing authentication, prior history and payout beneficiaries; safeguard: Use multifactor authentication and automated attack throttling with credential hygiene.

Explanation

Correct Answer

C:

The test addresses Deepfake onboarding deception by targeting this observation: Biometric session artifacts disagree with independently verified identity and device provenance. The accompanying safeguard—apply robust liveness checks with additional risk-based identity verification—counters the same opportunity, so both checking and prevention concern one cause.

Incorrect Answers

A:

The diagnostic correctly examines Deepfake onboarding deception by having reviewers inspect liveness testing results and compare trusted identity references, but the safeguard is for Identity-based tax refund diversion. That prevention step responds to a different mechanism: The scheme monetizes stolen taxpayer identity through a fraudulent government refund claim.

B:

The proposed safeguard is relevant to Deepfake onboarding deception, but the diagnostic tests Phishing identity-document collection rather than the identified anomaly. That test is aimed at records involving lookalike website records and user complaints connect to identity-document uploads; the specified case instead calls for reviewers to inspect liveness testing results and compare trusted identity references.

D:

The evidence test relates to Identity-based tax refund diversion, whereas the proposed safeguard protects against Credential-stuffing identity abuse; neither directly resolves Deepfake onboarding deception. Unlike the Identity-based tax refund diversion test and Credential-stuffing identity abuse safeguard, the investigation of Deepfake onboarding deception requires reviewers to inspect liveness testing results and compare trusted identity references, followed by assessment of the matching control point.

Question 45

The case file describes the following: A company publicly claims verified emissions reductions while internal measurements show the opposite. Which classification best explains the events?

  1. Broker front-running client order
  2. Unregistered brokerage solicitation
  3. False sustainability disclosures
  4. Excessive-account churning

Explanation

Correct Answer

C:

False sustainability disclosures fits the facts because nonfinancial representations can deceive securities investors when inaccurate or unsupported; the distinguishing observation is that external sustainability claims disagree with underlying meter and assurance records. To test this interpretation, a reviewer should trace public environmental claims to primary data, methodology and validation evidence.

Incorrect Answers

A:

Broker front-running client order would involve a different sequence from False sustainability disclosures: misusing confidential customer-order knowledge for personal gain creates market-abuse and conflict risks. Unlike the rejected Broker front-running client order label, the evidence concerns False sustainability disclosures, since external sustainability claims disagree with underlying meter and assurance records; reviewers should trace public environmental claims to primary data, methodology and validation evidence.

B:

Unregistered brokerage solicitation would involve a different sequence from False sustainability disclosures: securities-related compensation and solicitation can trigger registration obligations under relevant laws. Unlike the rejected Unregistered brokerage solicitation label, the evidence concerns False sustainability disclosures, since external sustainability claims disagree with underlying meter and assurance records; reviewers should trace public environmental claims to primary data, methodology and validation evidence.

D:

Excessive-account churning would involve a different sequence from False sustainability disclosures: excessive trading for broker compensation can constitute churning when control and other relevant elements are present. Unlike the rejected Excessive-account churning label, the evidence concerns False sustainability disclosures, since external sustainability claims disagree with underlying meter and assurance records; reviewers should trace public environmental claims to primary data, methodology and validation evidence.

Question 46

Two separate review files raise different issues. File A: A manager orders unneeded specialized equipment from a connected vendor despite usable equipment already available. File B: After winning at a low price a contractor and project manager approve unjustified scope changes at high unit rates. Which pairing accurately classifies both files?

  1. File A: Contractor cost mischarging; File B: Post-award change-order inflation.
  2. File A: Invented procurement need; File B: Post-award change-order inflation.
  3. File A: Post-award change-order inflation; File B: Invented procurement need.
  4. File A: Invented procurement need; File B: Split purchases to evade tender threshold.

Explanation

Correct Answer

B:

File A is Invented procurement need because procurement fraud can begin before bids when a false organizational need is created, while File B is Post-award change-order inflation because post-award modifications can recoup an artificially low bid or extract excessive payments. The evidence chains differ: for File A, reviewers should compare proposed purchase needs with inventory, utilization and operational plans; for File B, they should compare original scope, approved modifications and actual field measurements.

Incorrect Answers

A:

File A is misidentified as Contractor cost mischarging instead of Invented procurement need. With the proposed pairing Contractor cost mischarging / Post-award change-order inflation, the distinction is substantive: File A shows that demand forecasts and asset utilization records contradict the justification, whereas File B shows that change orders grow quickly without matching design changes or documented quantities. For these Invented procurement need and Post-award change-order inflation files, choosing the pair Contractor cost mischarging / Post-award change-order inflation would misdirect the review away from at least one of these mechanisms.

C:

File A is misidentified as Post-award change-order inflation instead of Invented procurement need; File B is misidentified as Invented procurement need instead of Post-award change-order inflation. With the proposed pairing Post-award change-order inflation / Invented procurement need, the distinction is substantive: File A shows that demand forecasts and asset utilization records contradict the justification, whereas File B shows that change orders grow quickly without matching design changes or documented quantities. For these Invented procurement need and Post-award change-order inflation files, choosing the pair Post-award change-order inflation / Invented procurement need would misdirect the review away from at least one of these mechanisms.

D:

File B is misidentified as Split purchases to evade tender threshold instead of Post-award change-order inflation. With the proposed pairing Invented procurement need / Split purchases to evade tender threshold, the distinction is substantive: File A shows that demand forecasts and asset utilization records contradict the justification, whereas File B shows that change orders grow quickly without matching design changes or documented quantities. For these Invented procurement need and Post-award change-order inflation files, choosing the pair Invented procurement need / Split purchases to evade tender threshold would misdirect the review away from at least one of these mechanisms.

Question 47

The available records suggest ach beneficiary substitution: Recent bank-account changes precede transfers while invoices remain otherwise valid. Which TWO actions together provide one direct check and one targeted preventive measure? Choose TWO.

  1. Compare beneficiary master-file history with verified supplier instructions and payment files.
  2. Trace supplier origin, price history and ultimate ownership of intermediaries.
  3. Verify account changes using independently sourced supplier contact details.
  4. Independently vet new vendors and segregate setup, approval and payment.
  5. Payments to related beneficiaries lack independent authorization or economic support.

Explanation

Correct Answers

A:

This procedure verifies the records implicated by ACH beneficiary substitution; the observed anomaly is that recent bank-account changes precede transfers while invoices remain otherwise valid. For the ACH beneficiary substitution concern, it can distinguish errors and innocent explanations from possible misstatements or wrongdoing before reaching a conclusion.

C:

This safeguard directly reduces ACH beneficiary substitution exposure because the fraud redirects a genuine disbursement through altered settlement coordinates. The control should be monitored using records from this check: Compare beneficiary master-file history with verified supplier instructions and payment files.

Incorrect Answers

B:

This procedure tests Pass-through purchasing scheme rather than the named ACH beneficiary substitution concern. The Pass-through purchasing scheme evidence is purchase prices exceed direct market quotes while a hidden related party sits in the chain, while the ACH beneficiary substitution path requires reviewers to compare beneficiary master-file history with verified supplier instructions and payment files.

D:

The chosen preventive action chiefly mitigates Shell-company invoice billing, where a nonoperating entity receives organizational money against false billing support. For ACH beneficiary substitution, unlike Shell-company invoice billing, the targeted safeguard is to verify account changes using independently sourced supplier contact details because the exposure occurs at a different point.

E:

The listed warning sign specifically concerns Authorized-maker self-payment, where authority to sign does not confer permission to take company funds for personal use, not the requested ACH beneficiary substitution review. Unlike the Authorized-maker self-payment indicator, the relevant signal for ACH beneficiary substitution is this: Recent bank-account changes precede transfers while invoices remain otherwise valid.

Question 48

The team is assessing a potential unauthorized equipment personal use discrepancy. Initial observation: Equipment checkout history shows extended absence without approved projects. Which verification step is most informative?

  1. Match shipment scans and carrier proof of delivery to authorized sales or transfers.
  2. Inspect scrap authorizations against production defects, quantities and recycler receipts.
  3. Reconcile cycle counts, stock movements and exception adjustments by custodian.
  4. Compare asset-location audits and access logs with authorized lending records.

Explanation

Correct Answer

D:

For the Unauthorized equipment personal use concern, the procedure tests source evidence behind this observation: Equipment checkout history shows extended absence without approved projects. This matters because temporary unauthorized use is misuse of a noncash asset even where permanent theft is unproven; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Fictitious outbound shipment, in which false shipment records disguise a physical theft as normal logistics activity; because the present question instead concerns Unauthorized equipment personal use, reviewers should compare asset-location audits and access logs with authorized lending records rather than apply a check designed for Fictitious outbound shipment.

B:

This comparison primarily addresses False scrap classification, in which misclassification makes valuable inventory appear worthless before it leaves the site; because the present question instead concerns Unauthorized equipment personal use, reviewers should compare asset-location audits and access logs with authorized lending records rather than apply a check designed for False scrap classification.

C:

This comparison primarily addresses Warehouse stock diversion, in which the employee converts recorded merchandise to private use by exploiting physical access; because the present question instead concerns Unauthorized equipment personal use, reviewers should compare asset-location audits and access logs with authorized lending records rather than apply a check designed for Warehouse stock diversion.

Question 49

The review team observes the following: Nominal directors cannot explain operations and ownership trails end in opaque nominees. It seeks one targeted detection step and one preventive measure that address the same underlying vulnerability. Which pairing is best?

  1. Diagnostic: Follow control and ownership links to natural persons using reliable independent evidence; safeguard: Screen relevant counterparties and monitor end-use risk under applicable sanctions and AML rules.
  2. Diagnostic: Follow control and ownership links to natural persons using reliable independent evidence; safeguard: Identify and verify beneficial owners under applicable customer-due-diligence rules.
  3. Diagnostic: Trace source and destination of funds and the identity of ultimate recipients; safeguard: Apply licensing and risk controls to remittance networks based on local requirements.
  4. Diagnostic: Review linked transactions and record the rationale for a report under applicable law; safeguard: Identify and verify beneficial owners under applicable customer-due-diligence rules.

Explanation

Correct Answer

B:

The test addresses Opaque beneficial-ownership layers by targeting this observation: Nominal directors cannot explain operations and ownership trails end in opaque nominees. The accompanying safeguard—identify and verify beneficial owners under applicable customer-due-diligence rules—counters the same opportunity, so both checking and prevention concern one cause.

Incorrect Answers

A:

The diagnostic correctly examines Opaque beneficial-ownership layers by having reviewers follow control and ownership links to natural persons using reliable independent evidence, but the safeguard is for Terrorist-financing source distinction. That prevention step responds to a different mechanism: Terrorist financing can involve legitimately sourced money; destination and intended use are central concerns.

C:

The evidence test relates to Terrorist-financing source distinction, whereas the proposed safeguard protects against Alternative remittance settlement; neither directly resolves Opaque beneficial-ownership layers. Unlike the Terrorist-financing source distinction test and Alternative remittance settlement safeguard, the investigation of Opaque beneficial-ownership layers requires reviewers to follow control and ownership links to natural persons using reliable independent evidence, followed by assessment of the matching control point.

D:

The proposed safeguard is relevant to Opaque beneficial-ownership layers, but the diagnostic tests Suspicious-activity reporting decision rather than the identified anomaly. That test is aimed at records involving a documented pattern raises a reasonable suspicion even though proof of an offense is incomplete; the specified case instead calls for reviewers to follow control and ownership links to natural persons using reliable independent evidence.

Question 50

The case file describes the following: A competitor plants a contractor inside a laboratory to photograph confidential prototypes. Which classification best explains the events?

  1. Corporate espionage by infiltration
  2. Spear-phishing product drawings
  3. Lawful public competitive intelligence
  4. Trade-secret client-list theft

Explanation

Correct Answer

A:

Corporate espionage by infiltration fits the facts because covert acquisition of nonpublic secrets for competitive gain is espionage rather than ordinary market research; the distinguishing observation is that contractor access exceeds project need and coincides with unexplained lab photography. To test this interpretation, a reviewer should review visitor sponsorship, badge events and camera policy exceptions.

Incorrect Answers

B:

Spear-phishing product drawings would involve a different sequence from Corporate espionage by infiltration: deceptive credential collection enables unauthorized access to proprietary engineering data. Unlike the rejected Spear-phishing product drawings label, the evidence concerns Corporate espionage by infiltration, since contractor access exceeds project need and coincides with unexplained lab photography; reviewers should review visitor sponsorship, badge events and camera policy exceptions.

C:

Lawful public competitive intelligence would involve a different sequence from Corporate espionage by infiltration: competitive intelligence based on public information differs from unauthorized acquisition of trade secrets. Unlike the rejected Lawful public competitive intelligence label, the evidence concerns Corporate espionage by infiltration, since contractor access exceeds project need and coincides with unexplained lab photography; reviewers should review visitor sponsorship, badge events and camera policy exceptions.

D:

Trade-secret client-list theft would involve a different sequence from Corporate espionage by infiltration: protected business information can be misappropriated even without physical property theft. Unlike the rejected Trade-secret client-list theft label, the evidence concerns Corporate espionage by infiltration, since contractor access exceeds project need and coincides with unexplained lab photography; reviewers should review visitor sponsorship, badge events and camera policy exceptions.

Certified Fraud Examiner - Financial Transactions and Fraud Schemes (CFE - Financial Transactions and Fraud Schemes) Practice Tests