ACFE CFE - Financial Transactions and Fraud Schemes (Certified Fraud Examiner - Financial Transactions and Fraud Schemes) Practice Test 50

Question 490

The team is assessing a potential fraudulent new bank account discrepancy. Initial observation: Onboarding identity records fail independent validation and the account has rapid pass-through activity. Which verification step is most informative?

  1. Review dormant-account transactions, access logs and beneficiary links.
  2. Compare application occupancy statements with objective property-use evidence.
  3. Review identity verification, account funding and withdrawal beneficiaries together.
  4. Verify stated earnings directly from reliable third-party employment records.
  5. Correlate session identifiers, device changes and outbound wire instructions.
  6. Trace down payments and property-control arrangements to the actual beneficiary.

Explanation

Correct Answer

C:

For the Fraudulent new bank account concern, the procedure tests source evidence behind this observation: Onboarding identity records fail independent validation and the account has rapid pass-through activity. This matters because the newly created account is established under false identity to receive or move illicit proceeds; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Insider customer-account embezzlement, in which an insider exploits entrusted bank access to misappropriate depositor funds; because the present question instead concerns Fraudulent new bank account, reviewers should review identity verification, account funding and withdrawal beneficiaries together rather than apply a check designed for Insider customer-account embezzlement.

B:

This comparison primarily addresses Occupancy-misrepresented mortgage, in which misstated intended use can improperly obtain lending terms reserved for a primary residence; because the present question instead concerns Fraudulent new bank account, reviewers should review identity verification, account funding and withdrawal beneficiaries together rather than apply a check designed for Occupancy-misrepresented mortgage.

D:

This comparison primarily addresses Falsified borrower income, in which borrower misrepresentation distorts credit assessment even before any default; because the present question instead concerns Fraudulent new bank account, reviewers should review identity verification, account funding and withdrawal beneficiaries together rather than apply a check designed for Falsified borrower income.

E:

This comparison primarily addresses Financial-account takeover, in which the account is legitimate but control of its credentials or session has been stolen; because the present question instead concerns Fraudulent new bank account, reviewers should review identity verification, account funding and withdrawal beneficiaries together rather than apply a check designed for Financial-account takeover.

F:

This comparison primarily addresses Mortgage straw-buyer scheme, in which a nominal applicant conceals the real party controlling the property and borrowing transaction; because the present question instead concerns Fraudulent new bank account, reviewers should review identity verification, account funding and withdrawal beneficiaries together rather than apply a check designed for Mortgage straw-buyer scheme.

Question 491

The review team observes the following: Travel or shipment patterns and declared funds conflict with observed currency movements. It seeks one targeted detection step and one preventive measure that address the same underlying vulnerability. Which pairing is best?

  1. Diagnostic: Link funding methods, card serials and redemption beneficiaries; safeguard: Apply enhanced customer due diligence where cash volumes contradict business economics.
  2. Diagnostic: Trace travel logistics, border declarations and linked currency seizures; safeguard: Apply lawful currency-declaration controls and risk-based physical inspection.
  3. Diagnostic: Use chain analytics with exchange records and verified wallet attribution; safeguard: Apply lawful currency-declaration controls and risk-based physical inspection.
  4. Diagnostic: Trace travel logistics, border declarations and linked currency seizures; safeguard: Monitor aggregated stored-value activity and apply appropriate identification limits.

Explanation

Correct Answer

B:

The test addresses Bulk currency courier by targeting this observation: Travel or shipment patterns and declared funds conflict with observed currency movements. The accompanying safeguard—apply lawful currency-declaration controls and risk-based physical inspection—counters the same opportunity, so both checking and prevention concern one cause.

Incorrect Answers

A:

The evidence test relates to Stored-value card conversion, whereas the proposed safeguard protects against Cash-intensive front business; neither directly resolves Bulk currency courier. Unlike the Stored-value card conversion test and Cash-intensive front business safeguard, the investigation of Bulk currency courier requires reviewers to trace travel logistics, border declarations and linked currency seizures, followed by assessment of the matching control point.

C:

The proposed safeguard is relevant to Bulk currency courier, but the diagnostic tests Virtual-asset layering rather than the identified anomaly. That test is aimed at records involving blockchain flows show rapid hops among intermediary addresses before exchange cash-out; the specified case instead calls for reviewers to trace travel logistics, border declarations and linked currency seizures.

D:

The diagnostic correctly examines Bulk currency courier by having reviewers trace travel logistics, border declarations and linked currency seizures, but the safeguard is for Stored-value card conversion. That prevention step responds to a different mechanism: Stored-value instruments can move purchasing power while distancing it from original cash.

Question 492

A reviewer wants to distinguish shell-company invoice billing from adjacent risk patterns. Which observation is the most diagnostic indicator?

  1. Recent bank-account changes precede transfers while invoices remain otherwise valid.
  2. Vendor registration details overlap with employee contact and payment information.
  3. Purchase prices exceed direct market quotes while a hidden related party sits in the chain.
  4. Payments to related beneficiaries lack independent authorization or economic support.

Explanation

Correct Answer

B:

This observation is a pertinent indicator of Shell-company invoice billing because a nonoperating entity receives organizational money against false billing support. The practical corroborating procedure is to match vendor masters to employee details and verify actual service completion; the indicator by itself does not establish intent or error.

Incorrect Answers

A:

The proposed observation fits ACH beneficiary substitution, where the fraud redirects a genuine disbursement through altered settlement coordinates, rather than the particular mechanism in Shell-company invoice billing. Unlike the clue for ACH beneficiary substitution, the more directly related indicator for Shell-company invoice billing is this: Vendor registration details overlap with employee contact and payment information.

C:

The proposed observation fits Pass-through purchasing scheme, where the transaction may deliver real goods yet divert value through an unnecessary marked-up middleman, rather than the particular mechanism in Shell-company invoice billing. Unlike the clue for Pass-through purchasing scheme, the more directly related indicator for Shell-company invoice billing is this: Vendor registration details overlap with employee contact and payment information.

D:

The proposed observation fits Authorized-maker self-payment, where authority to sign does not confer permission to take company funds for personal use, rather than the particular mechanism in Shell-company invoice billing. Unlike the clue for Authorized-maker self-payment, the more directly related indicator for Shell-company invoice billing is this: Vendor registration details overlap with employee contact and payment information.

Question 493

Two separate review files raise different issues. File A: A company receives customer payments and pays routine suppliers while preparing its cash-flow statement. File B: A manufacturer pays cash to acquire production machinery rather than consumable supplies. Which pairing accurately classifies both files?

  1. File A: Investing cash-flow classification; File B: Operating cash-flow classification.
  2. File A: Operating cash-flow classification; File B: Inventory cost recognition.
  3. File A: Operating cash-flow classification; File B: Investing cash-flow classification.
  4. File A: Financing cash-flow classification; File B: Investing cash-flow classification.

Explanation

Correct Answer

C:

File A is Operating cash-flow classification because operating cash flows concern core activities and need not equal accrual net income, while File B is Investing cash-flow classification because buying plant equipment is generally an investing cash outflow, not a routine operating payment. The evidence chains differ: for File A, reviewers should reconcile customer receipts and trade-vendor payments to operating cash-flow lines; for File B, they should trace fixed-asset additions and bank settlements to the investing section of the cash-flow statement.

Incorrect Answers

A:

File A is misidentified as Investing cash-flow classification instead of Operating cash-flow classification; File B is misidentified as Operating cash-flow classification instead of Investing cash-flow classification. With the proposed pairing Investing cash-flow classification / Operating cash-flow classification, the distinction is substantive: File A shows that the underlying cash movements arise from the ordinary revenue-producing operations, whereas File B shows that the outflow bought a long-lived productive asset. For these Operating cash-flow classification and Investing cash-flow classification files, choosing the pair Investing cash-flow classification / Operating cash-flow classification would misdirect the review away from at least one of these mechanisms.

B:

File B is misidentified as Inventory cost recognition instead of Investing cash-flow classification. With the proposed pairing Operating cash-flow classification / Inventory cost recognition, the distinction is substantive: File A shows that the underlying cash movements arise from the ordinary revenue-producing operations, whereas File B shows that the outflow bought a long-lived productive asset. For these Operating cash-flow classification and Investing cash-flow classification files, choosing the pair Operating cash-flow classification / Inventory cost recognition would misdirect the review away from at least one of these mechanisms.

D:

File A is misidentified as Financing cash-flow classification instead of Operating cash-flow classification. With the proposed pairing Financing cash-flow classification / Investing cash-flow classification, the distinction is substantive: File A shows that the underlying cash movements arise from the ordinary revenue-producing operations, whereas File B shows that the outflow bought a long-lived productive asset. For these Operating cash-flow classification and Investing cash-flow classification files, choosing the pair Financing cash-flow classification / Investing cash-flow classification would misdirect the review away from at least one of these mechanisms.

Question 494

The review team observes the following: The cash was received while most contracted performance obligations remained outstanding. It seeks one targeted detection step and one preventive measure that address the same underlying vulnerability. Which pairing is best?

  1. Diagnostic: Reconcile policy coverage dates and the prepaid-insurance amortization schedule; safeguard: Require a cutoff review of completed work not yet billed.
  2. Diagnostic: Trace receipt dates and service periods to deferred-revenue rollforwards; safeguard: Capitalize the unexpired coverage and expense it systematically over the protection period.
  3. Diagnostic: Inspect post-close invoices and receiving evidence for prior-period services; safeguard: Recognize unearned consideration as a liability until the related service is earned.
  4. Diagnostic: Trace receipt dates and service periods to deferred-revenue rollforwards; safeguard: Recognize unearned consideration as a liability until the related service is earned.

Explanation

Correct Answer

D:

The test addresses Deferred customer revenue by targeting this observation: The cash was received while most contracted performance obligations remained outstanding. The accompanying safeguard—recognize unearned consideration as a liability until the related service is earned—counters the same opportunity, so both checking and prevention concern one cause.

Incorrect Answers

A:

The evidence test relates to Prepaid insurance expense, whereas the proposed safeguard protects against Accrued service revenue; neither directly resolves Deferred customer revenue. Unlike the Prepaid insurance expense test and Accrued service revenue safeguard, the investigation of Deferred customer revenue requires reviewers to trace receipt dates and service periods to deferred-revenue rollforwards, followed by assessment of the matching control point.

B:

The diagnostic correctly examines Deferred customer revenue by having reviewers trace receipt dates and service periods to deferred-revenue rollforwards, but the safeguard is for Prepaid insurance expense. That prevention step responds to a different mechanism: An advance payment creates an asset for future economic benefit rather than immediate expense for all periods.

C:

The proposed safeguard is relevant to Deferred customer revenue, but the diagnostic tests Accrued supplier expense rather than the identified anomaly. That test is aimed at records involving service reports show a completed obligation absent from the year-end payables ledger; the specified case instead calls for reviewers to trace receipt dates and service periods to deferred-revenue rollforwards.

Question 495

An exception review involving pre-filing fraudulent asset transfer identifies the following: Sale value and related-party timing are inconsistent with an arm's-length transfer. Which evidence comparison most directly evaluates the facts?

  1. Compare disclosed assets with bank transfers, ownership and foreign records.
  2. Confirm claim validity using contracts, bank traces and accounting history.
  3. Trace asset conveyance documents, fair value and beneficial ownership.
  4. Trace inventory purchases, resale proceeds and pre-filing management communications.

Explanation

Correct Answer

C:

For the Pre-filing fraudulent asset transfer concern, the procedure tests source evidence behind this observation: Sale value and related-party timing are inconsistent with an arm's-length transfer. This matters because transfers intended to put assets beyond creditors may be challengeable under applicable insolvency law; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Concealed offshore insolvency asset, in which concealment deprives the estate and creditors of property that should be disclosed; because the present question instead concerns Pre-filing fraudulent asset transfer, reviewers should trace asset conveyance documents, fair value and beneficial ownership rather than apply a check designed for Concealed offshore insolvency asset.

B:

This comparison primarily addresses Fictitious creditor claim, in which a manufactured liability can dilute legitimate creditors' recoveries; because the present question instead concerns Pre-filing fraudulent asset transfer, reviewers should trace asset conveyance documents, fair value and beneficial ownership rather than apply a check designed for Fictitious creditor claim.

D:

This comparison primarily addresses Bankruptcy bust-out credit buying, in which a planned bust-out extracts value from vendors through deliberate nonpayment and asset diversion; because the present question instead concerns Pre-filing fraudulent asset transfer, reviewers should trace asset conveyance documents, fair value and beneficial ownership rather than apply a check designed for Bankruptcy bust-out credit buying.

Question 496

The review team observes the following: Device telemetry shows implausible proximity or timing between card and reader interactions. It seeks one targeted detection step and one preventive measure that address the same underlying vulnerability. Which pairing is best?

  1. Diagnostic: Match cleared bank images with original check issuance and beneficiary details; safeguard: Apply applicable contactless transaction protections and device anomaly monitoring.
  2. Diagnostic: Analyze terminal traces and transaction authentication logs for relay characteristics; safeguard: Use positive pay and securely protect account and check-stock details.
  3. Diagnostic: Compare cleared checks against controlled issuance files and bank exceptions; safeguard: Validate direct-debit authorizations and monitor abnormal return rates.
  4. Diagnostic: Match debit mandates with customer consents and originating entity identifiers; safeguard: Use secure delivery and payee-positive-pay checks where available.
  5. Diagnostic: Analyze terminal traces and transaction authentication logs for relay characteristics; safeguard: Apply applicable contactless transaction protections and device anomaly monitoring.

Explanation

Correct Answer

E:

The test addresses Contactless payment relay by targeting this observation: Device telemetry shows implausible proximity or timing between card and reader interactions. The accompanying safeguard—apply applicable contactless transaction protections and device anomaly monitoring—counters the same opportunity, so both checking and prevention concern one cause.

Incorrect Answers

A:

The proposed safeguard is relevant to Contactless payment relay, but the diagnostic tests Check-washing alteration rather than the identified anomaly. That test is aimed at records involving cleared images show altered writing inconsistent with the drawer's retained check copy; the specified case instead calls for reviewers to analyze terminal traces and transaction authentication logs for relay characteristics.

B:

The diagnostic correctly examines Contactless payment relay by having reviewers analyze terminal traces and transaction authentication logs for relay characteristics, but the safeguard is for Counterfeit check creation. That prevention step responds to a different mechanism: Counterfeit checks are fabricated payment instruments rather than alterations of legitimate originals.

C:

The evidence test relates to Counterfeit check creation, whereas the proposed safeguard protects against Unauthorized ACH debit; neither directly resolves Contactless payment relay. Unlike the Counterfeit check creation test and Unauthorized ACH debit safeguard, the investigation of Contactless payment relay requires reviewers to analyze terminal traces and transaction authentication logs for relay characteristics, followed by assessment of the matching control point.

D:

The evidence test relates to Unauthorized ACH debit, whereas the proposed safeguard protects against Check-washing alteration; neither directly resolves Contactless payment relay. Unlike the Unauthorized ACH debit test and Check-washing alteration safeguard, the investigation of Contactless payment relay requires reviewers to analyze terminal traces and transaction authentication logs for relay characteristics, followed by assessment of the matching control point.

Question 497

The monitoring team needs an observable indicator of unreceived goods billing. Which signal aligns most closely with the risk?

  1. Employee master records have no HR file or manager confirmation but receive pay.
  2. Invoice quantities exceed independent goods-received records.
  3. Payments recur despite missing work products, timesheets or meeting records.
  4. Same-day orders to one vendor add up to a larger unapproved purchase.

Explanation

Correct Answer

B:

This observation is a pertinent indicator of Unreceived goods billing because the payer is charged for goods that were never delivered or accepted. The practical corroborating procedure is to perform three-way matching among order, receipt and invoice quantities; the indicator by itself does not establish intent or error.

Incorrect Answers

A:

The proposed observation fits Ghost payroll employee, where a fabricated employee record turns ordinary payroll into an unauthorized disbursement, rather than the particular mechanism in Unreceived goods billing. Unlike the clue for Ghost payroll employee, the more directly related indicator for Unreceived goods billing is this: Invoice quantities exceed independent goods-received records.

C:

The proposed observation fits Phantom consulting fees, where fabricated intangible services can be billed without the physical receiving evidence used for goods, rather than the particular mechanism in Unreceived goods billing. Unlike the clue for Phantom consulting fees, the more directly related indicator for Unreceived goods billing is this: Invoice quantities exceed independent goods-received records.

D:

The proposed observation fits Split procurement invoices, where splitting evades approval controls that would apply to the whole purchase, rather than the particular mechanism in Unreceived goods billing. Unlike the clue for Split procurement invoices, the more directly related indicator for Unreceived goods billing is this: Invoice quantities exceed independent goods-received records.

Question 498

An analyst is selecting warning signs for privileged bulk data export. Which recorded pattern should receive focused attention?

  1. Research source logs show only publicly accessible, lawfully obtained material.
  2. Suspicious sign-ins follow a spoofed message and precede drawing downloads.
  3. Privileged queries and large exports lack authorized change tickets.
  4. Third-party login activity reaches repositories outside contracted support scope.

Explanation

Correct Answer

C:

This observation is a pertinent indicator of Privileged bulk data export because excess technical privilege can permit insider misappropriation of valuable information. The practical corroborating procedure is to join database audit trails with approved work orders and outbound data transfers; the indicator by itself does not establish intent or error.

Incorrect Answers

A:

The proposed observation fits Lawful public competitive intelligence, where competitive intelligence based on public information differs from unauthorized acquisition of trade secrets, rather than the particular mechanism in Privileged bulk data export. Unlike the clue for Lawful public competitive intelligence, the more directly related indicator for Privileged bulk data export is this: Privileged queries and large exports lack authorized change tickets.

B:

The proposed observation fits Spear-phishing product drawings, where deceptive credential collection enables unauthorized access to proprietary engineering data, rather than the particular mechanism in Privileged bulk data export. Unlike the clue for Spear-phishing product drawings, the more directly related indicator for Privileged bulk data export is this: Privileged queries and large exports lack authorized change tickets.

D:

The proposed observation fits Supplier-access data theft, where compromised or misused partner access can become a route for proprietary-data loss, rather than the particular mechanism in Privileged bulk data export. Unlike the clue for Supplier-access data theft, the more directly related indicator for Privileged bulk data export is this: Privileged queries and large exports lack authorized change tickets.

Question 499

The case file describes the following: A trader claims value-added-tax credits based on invoices from a nonexistent supplier. Which classification best explains the events?

  1. False consumption-tax input credit
  2. Sham offshore tax shelter
  3. Fabricated deductible business cost
  4. Stolen-identity tax return

Explanation

Correct Answer

A:

False consumption-tax input credit fits the facts because false input credits reduce remitted VAT or generate improper refunds; the distinguishing observation is that input-tax claims do not match validated purchases or supplier filings. To test this interpretation, a reviewer should cross-match purchase invoices and tax registrations with supplier records.

Incorrect Answers

B:

Sham offshore tax shelter would involve a different sequence from False consumption-tax input credit: a paper structure intended to conceal taxable facts differs from lawful tax structuring with genuine substance. Unlike the rejected Sham offshore tax shelter label, the evidence concerns False consumption-tax input credit, since input-tax claims do not match validated purchases or supplier filings; reviewers should cross-match purchase invoices and tax registrations with supplier records.

C:

Fabricated deductible business cost would involve a different sequence from False consumption-tax input credit: a fictitious expense reduces reported taxable income without a genuine economic cost. Unlike the rejected Fabricated deductible business cost label, the evidence concerns False consumption-tax input credit, since input-tax claims do not match validated purchases or supplier filings; reviewers should cross-match purchase invoices and tax registrations with supplier records.

D:

Stolen-identity tax return would involve a different sequence from False consumption-tax input credit: refund fraud uses another person's tax identity rather than understating the criminal's own income. Unlike the rejected Stolen-identity tax return label, the evidence concerns False consumption-tax input credit, since input-tax claims do not match validated purchases or supplier filings; reviewers should cross-match purchase invoices and tax registrations with supplier records.

Question 500

The case file describes the following: A distributor reports product sales and their direct acquisition costs but excludes payroll and office rent from its initial margin measure. Which classification best explains the events?

  1. Equity reconciliation
  2. Financing cash-flow classification
  3. Gross-profit calculation
  4. Accounting-framework selection
  5. Accrued service revenue

Explanation

Correct Answer

C:

Gross-profit calculation fits the facts because gross profit isolates direct goods margin rather than the final earnings after all operating and other costs; the distinguishing observation is that the margin calculation changes unexpectedly when cost of goods sold is misstated. To test this interpretation, a reviewer should match recorded sales and corresponding inventory costs before analyzing gross margin.

Incorrect Answers

A:

Equity reconciliation would involve a different sequence from Gross-profit calculation: equity is the residual interest in assets after deducting liabilities, not a bank balance or revenue figure. Unlike the rejected Equity reconciliation label, the evidence concerns Gross-profit calculation, since the margin calculation changes unexpectedly when cost of goods sold is misstated; reviewers should match recorded sales and corresponding inventory costs before analyzing gross margin.

B:

Financing cash-flow classification would involve a different sequence from Gross-profit calculation: financing activities describe changes in funding from lenders and owners; classifications of interest can vary by accounting framework. Unlike the rejected Financing cash-flow classification label, the evidence concerns Gross-profit calculation, since the margin calculation changes unexpectedly when cost of goods sold is misstated; reviewers should match recorded sales and corresponding inventory costs before analyzing gross margin.

D:

Accounting-framework selection would involve a different sequence from Gross-profit calculation: iFRS and national GAAP are accounting frameworks; their use depends on reporting requirements, not the invoice currency. Unlike the rejected Accounting-framework selection label, the evidence concerns Gross-profit calculation, since the margin calculation changes unexpectedly when cost of goods sold is misstated; reviewers should match recorded sales and corresponding inventory costs before analyzing gross margin.

E:

Accrued service revenue would involve a different sequence from Gross-profit calculation: under accrual accounting, revenue relates to the period when the service was performed, not simply the invoice or cash date. Unlike the rejected Accrued service revenue label, the evidence concerns Gross-profit calculation, since the margin calculation changes unexpectedly when cost of goods sold is misstated; reviewers should match recorded sales and corresponding inventory costs before analyzing gross margin.

Certified Fraud Examiner - Financial Transactions and Fraud Schemes (CFE - Financial Transactions and Fraud Schemes) Practice Tests