ACFE CFE - Financial Transactions and Fraud Schemes (Certified Fraud Examiner - Financial Transactions and Fraud Schemes) Practice Test 74

Question 730

An examination of sham offshore tax shelter begins with this observation: Contracts and economic substance contradict the claimed jurisdictional profit location. Which follow-up procedure gives the most direct evidence?

  1. Verify claimed costs against real supplier transactions and business purpose.
  2. Trace beneficial control, functions and genuine commercial substance.
  3. Compare historical filing information with authentication and refund destination records.
  4. Confirm statutory eligibility, election documentation and consistent filings.
  5. Reconcile independent sales evidence with filed taxable income.

Explanation

Correct Answer

B:

For the Sham offshore tax shelter concern, the procedure tests source evidence behind this observation: Contracts and economic substance contradict the claimed jurisdictional profit location. This matters because a paper structure intended to conceal taxable facts differs from lawful tax structuring with genuine substance; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Fabricated deductible business cost, in which a fictitious expense reduces reported taxable income without a genuine economic cost; because the present question instead concerns Sham offshore tax shelter, reviewers should trace beneficial control, functions and genuine commercial substance rather than apply a check designed for Fabricated deductible business cost.

C:

This comparison primarily addresses Stolen-identity tax return, in which refund fraud uses another person's tax identity rather than understating the criminal's own income; because the present question instead concerns Sham offshore tax shelter, reviewers should trace beneficial control, functions and genuine commercial substance rather than apply a check designed for Stolen-identity tax return.

D:

This comparison primarily addresses Lawful tax planning distinction, in which tax avoidance or planning can lawfully reduce tax; evasion involves unlawful deception or concealment; because the present question instead concerns Sham offshore tax shelter, reviewers should trace beneficial control, functions and genuine commercial substance rather than apply a check designed for Lawful tax planning distinction.

E:

This comparison primarily addresses Unreported cash taxable income, in which knowingly concealing taxable receipts can constitute tax evasion rather than lawful tax planning; because the present question instead concerns Sham offshore tax shelter, reviewers should trace beneficial control, functions and genuine commercial substance rather than apply a check designed for Unreported cash taxable income.

Question 731

Two separate review files raise different issues. File A: An applicant deliberately omits a material medical history fact when applying for coverage and that omission affects underwriting. File B: A claimant seeks reimbursement for the same damaged property from multiple policies without disclosing prior settlements. Which pairing accurately classifies both files?

  1. File A: Fictitious beneficiary change; File B: Duplicate casualty claims.
  2. File A: Duplicate casualty claims; File B: Concealed preexisting condition.
  3. File A: Concealed preexisting condition; File B: Duplicate casualty claims.
  4. File A: Concealed preexisting condition; File B: Workers compensation malingering.
  5. File A: Workers compensation malingering; File B: Concealed preexisting condition.

Explanation

Correct Answer

C:

File A is Concealed preexisting condition because material misrepresentation at policy inception differs from fabricating a later insured loss, while File B is Duplicate casualty claims because multiple recoveries for one loss can exceed the legitimate indemnifiable damage. The evidence chains differ: for File A, reviewers should compare authorized medical evidence with disclosed underwriting history; for File B, they should cross-match claim dates, asset identifiers and prior paid settlements where lawful.

Incorrect Answers

A:

File A is misidentified as Fictitious beneficiary change instead of Concealed preexisting condition. With the proposed pairing Fictitious beneficiary change / Duplicate casualty claims, the distinction is substantive: File A shows that earlier medical records contradict answers on the application, whereas File B shows that identical invoices and loss photos recur in separate carriers' claim files. For these Concealed preexisting condition and Duplicate casualty claims files, choosing the pair Fictitious beneficiary change / Duplicate casualty claims would misdirect the review away from at least one of these mechanisms.

B:

File A is misidentified as Duplicate casualty claims instead of Concealed preexisting condition; File B is misidentified as Concealed preexisting condition instead of Duplicate casualty claims. With the proposed pairing Duplicate casualty claims / Concealed preexisting condition, the distinction is substantive: File A shows that earlier medical records contradict answers on the application, whereas File B shows that identical invoices and loss photos recur in separate carriers' claim files. For these Concealed preexisting condition and Duplicate casualty claims files, choosing the pair Duplicate casualty claims / Concealed preexisting condition would misdirect the review away from at least one of these mechanisms.

D:

File B is misidentified as Workers compensation malingering instead of Duplicate casualty claims. With the proposed pairing Concealed preexisting condition / Workers compensation malingering, the distinction is substantive: File A shows that earlier medical records contradict answers on the application, whereas File B shows that identical invoices and loss photos recur in separate carriers' claim files. For these Concealed preexisting condition and Duplicate casualty claims files, choosing the pair Concealed preexisting condition / Workers compensation malingering would misdirect the review away from at least one of these mechanisms.

E:

File A is misidentified as Workers compensation malingering instead of Concealed preexisting condition; File B is misidentified as Concealed preexisting condition instead of Duplicate casualty claims. With the proposed pairing Workers compensation malingering / Concealed preexisting condition, the distinction is substantive: File A shows that earlier medical records contradict answers on the application, whereas File B shows that identical invoices and loss photos recur in separate carriers' claim files. For these Concealed preexisting condition and Duplicate casualty claims files, choosing the pair Workers compensation malingering / Concealed preexisting condition would misdirect the review away from at least one of these mechanisms.

Question 732

The review team observes the following: Identity attributes do not reliably resolve to one genuine person across independent sources. It seeks one targeted detection step and one preventive measure that address the same underlying vulnerability. Which pairing is best?

  1. Diagnostic: Compare date of birth and identity verification data with account origination records; safeguard: Verify taxpayer identity and flag anomalous refund destination changes.
  2. Diagnostic: Confirm applicant control through independent identity checks and device history; safeguard: Apply risk-based identity proofing and monitor inconsistent identities across applications.
  3. Diagnostic: Cross-validate identity attributes and account histories using reliable independent records; safeguard: Use age-aware verification and secure dependent identity records.
  4. Diagnostic: Cross-validate identity attributes and account histories using reliable independent records; safeguard: Apply risk-based identity proofing and monitor inconsistent identities across applications.

Explanation

Correct Answer

D:

The test addresses Synthetic identity borrowing by targeting this observation: Identity attributes do not reliably resolve to one genuine person across independent sources. The accompanying safeguard—apply risk-based identity proofing and monitor inconsistent identities across applications—counters the same opportunity, so both checking and prevention concern one cause.

Incorrect Answers

A:

The evidence test relates to Child identity misuse, whereas the proposed safeguard protects against Identity-based tax refund diversion; neither directly resolves Synthetic identity borrowing. Unlike the Child identity misuse test and Identity-based tax refund diversion safeguard, the investigation of Synthetic identity borrowing requires reviewers to cross-validate identity attributes and account histories using reliable independent records, followed by assessment of the matching control point.

B:

The proposed safeguard is relevant to Synthetic identity borrowing, but the diagnostic tests Stolen-personal-data loan rather than the identified anomaly. That test is aimed at records involving the real person denies the application despite matching submitted personal data; the specified case instead calls for reviewers to cross-validate identity attributes and account histories using reliable independent records.

C:

The diagnostic correctly examines Synthetic identity borrowing by having reviewers cross-validate identity attributes and account histories using reliable independent records, but the safeguard is for Child identity misuse. That prevention step responds to a different mechanism: Children's identifiers can be exploited because misuse may remain unnoticed for years.

Question 733

The team is assessing a potential inflated real estate appraisal discrepancy. Initial observation: Appraisal assumptions diverge from nearby verified comparable transactions. Which verification step is most informative?

  1. Trace down payments and property-control arrangements to the actual beneficiary.
  2. Review dormant-account transactions, access logs and beneficiary links.
  3. Check updated credit-bureau information and simultaneous application patterns.
  4. Independently review valuation methods, comparable sales and appraiser relationships.

Explanation

Correct Answer

D:

For the Inflated real estate appraisal concern, the procedure tests source evidence behind this observation: Appraisal assumptions diverge from nearby verified comparable transactions. This matters because artificial collateral values lead lenders to advance more credit than the asset justifies; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Mortgage straw-buyer scheme, in which a nominal applicant conceals the real party controlling the property and borrowing transaction; because the present question instead concerns Inflated real estate appraisal, reviewers should independently review valuation methods, comparable sales and appraiser relationships rather than apply a check designed for Mortgage straw-buyer scheme.

B:

This comparison primarily addresses Insider customer-account embezzlement, in which an insider exploits entrusted bank access to misappropriate depositor funds; because the present question instead concerns Inflated real estate appraisal, reviewers should independently review valuation methods, comparable sales and appraiser relationships rather than apply a check designed for Insider customer-account embezzlement.

C:

This comparison primarily addresses Loan-stacking applications, in which hidden parallel borrowing makes the applicant's repayment capacity appear stronger than it is; because the present question instead concerns Inflated real estate appraisal, reviewers should independently review valuation methods, comparable sales and appraiser relationships rather than apply a check designed for Loan-stacking applications.

Question 734

An exception review involving bulk currency courier identifies the following: Travel or shipment patterns and declared funds conflict with observed currency movements. Which evidence comparison most directly evaluates the facts?

  1. Trace travel logistics, border declarations and linked currency seizures.
  2. Use chain analytics with exchange records and verified wallet attribution.
  3. Link funding methods, card serials and redemption beneficiaries.
  4. Compare reported cash sales with independent capacity, procurement and customer evidence.

Explanation

Correct Answer

A:

For the Bulk currency courier concern, the procedure tests source evidence behind this observation: Travel or shipment patterns and declared funds conflict with observed currency movements. This matters because physical transportation can shift criminal cash between jurisdictions outside routine bank wires; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

B:

This comparison primarily addresses Virtual-asset layering, in which multiple on-chain transfers can complicate attribution but do not automatically erase transaction history; because the present question instead concerns Bulk currency courier, reviewers should trace travel logistics, border declarations and linked currency seizures rather than apply a check designed for Virtual-asset layering.

C:

This comparison primarily addresses Stored-value card conversion, in which stored-value instruments can move purchasing power while distancing it from original cash; because the present question instead concerns Bulk currency courier, reviewers should trace travel logistics, border declarations and linked currency seizures rather than apply a check designed for Stored-value card conversion.

D:

This comparison primarily addresses Cash-intensive front business, in which fictitious sales provide a plausible bookkeeping story for introducing criminal cash; because the present question instead concerns Bulk currency courier, reviewers should trace travel logistics, border declarations and linked currency seizures rather than apply a check designed for Cash-intensive front business.

Question 735

The monitoring team needs an observable indicator of pharming through dns manipulation. Which signal aligns most closely with the risk?

  1. The payment request bypasses established authorizations and uses an unverified callback number.
  2. DNS answers point to unauthorized servers despite correct addresses typed by users.
  3. Large-scale file changes and ransom notes follow unusual endpoint execution.
  4. The login occurred on a lookalike domain immediately before suspicious account access.

Explanation

Correct Answer

B:

This observation is a pertinent indicator of Pharming through DNS manipulation because pharming diverts site resolution without requiring victims to click a deceptive message link. The practical corroborating procedure is to verify trusted DNS records and correlate resolution history with website certificates; the indicator by itself does not establish intent or error.

Incorrect Answers

A:

The proposed observation fits AI-voice executive impersonation, where synthetic voice impersonation can exploit executive authority cues without true authorization, rather than the particular mechanism in Pharming through DNS manipulation. Unlike the clue for AI-voice executive impersonation, the more directly related indicator for Pharming through DNS manipulation is this: DNS answers point to unauthorized servers despite correct addresses typed by users.

C:

The proposed observation fits Ransomware file encryption, where ransomware denies access through malicious encryption and extortion, not primarily by changing invoice beneficiaries, rather than the particular mechanism in Pharming through DNS manipulation. Unlike the clue for Ransomware file encryption, the more directly related indicator for Pharming through DNS manipulation is this: DNS answers point to unauthorized servers despite correct addresses typed by users.

D:

The proposed observation fits Spear-phishing credential capture, where targeted phishing collects credentials by masquerading as a trusted internal communication, rather than the particular mechanism in Pharming through DNS manipulation. Unlike the clue for Spear-phishing credential capture, the more directly related indicator for Pharming through DNS manipulation is this: DNS answers point to unauthorized servers despite correct addresses typed by users.

Question 736

For a review of unauthorized register cash payout, which evidence-based warning sign is the most specific?

  1. Paid-out entries have generic descriptions but no corresponding invoices.
  2. Refunded card identifiers recur across unrelated customer transactions.
  3. Refunds lack linked original sales or physical returned goods.
  4. Voids cluster under one cashier after high-cash transactions.

Explanation

Correct Answer

A:

This observation is a pertinent indicator of Unauthorized register cash payout because the register balance is reduced through a purported business disbursement rather than a sale. The practical corroborating procedure is to reconcile register paid-outs to approved source documents and purchases; the indicator by itself does not establish intent or error.

Incorrect Answers

B:

The proposed observation fits Manipulated return-to-gift-card, where a fabricated return transfers store value instead of extracting physical currency, rather than the particular mechanism in Unauthorized register cash payout. Unlike the clue for Manipulated return-to-gift-card, the more directly related indicator for Unauthorized register cash payout is this: Paid-out entries have generic descriptions but no corresponding invoices.

C:

The proposed observation fits Fictitious register refund, where the false disbursement is disguised as money returned to a customer, rather than the particular mechanism in Unauthorized register cash payout. Unlike the clue for Fictitious register refund, the more directly related indicator for Unauthorized register cash payout is this: Paid-out entries have generic descriptions but no corresponding invoices.

D:

The proposed observation fits Fraudulent sale void, where voiding erases or reverses a legitimate recorded sale while the customer payment was retained, rather than the particular mechanism in Unauthorized register cash payout. Unlike the clue for Fraudulent sale void, the more directly related indicator for Unauthorized register cash payout is this: Paid-out entries have generic descriptions but no corresponding invoices.

Question 737

The case file describes the following: An applicant invents a business and submits fabricated turnover records for emergency assistance. Which classification best explains the events?

  1. Ghost public-assistance beneficiaries
  2. Double-charged public grant costs
  3. False government grant deliverables
  4. Fictitious disaster relief business

Explanation

Correct Answer

D:

Fictitious disaster relief business fits the facts because crisis support can be abused through fictitious claimants and fabricated losses; the distinguishing observation is that business registration, tax and payroll records fail to support the claimed operation. To test this interpretation, a reviewer should verify existence and pre-disaster activity using independent authoritative records.

Incorrect Answers

A:

Ghost public-assistance beneficiaries would involve a different sequence from Fictitious disaster relief business: public funds continue flowing to people who should not receive benefits. Unlike the rejected Ghost public-assistance beneficiaries label, the evidence concerns Fictitious disaster relief business, since business registration, tax and payroll records fail to support the claimed operation; reviewers should verify existence and pre-disaster activity using independent authoritative records.

B:

Double-charged public grant costs would involve a different sequence from Fictitious disaster relief business: a real cost becomes fraudulent when recovered more than once from restricted funding sources. Unlike the rejected Double-charged public grant costs label, the evidence concerns Fictitious disaster relief business, since business registration, tax and payroll records fail to support the claimed operation; reviewers should verify existence and pre-disaster activity using independent authoritative records.

C:

False government grant deliverables would involve a different sequence from Fictitious disaster relief business: a grant recipient obtains public funds by falsely certifying eligible performance. Unlike the rejected False government grant deliverables label, the evidence concerns Fictitious disaster relief business, since business registration, tax and payroll records fail to support the claimed operation; reviewers should verify existence and pre-disaster activity using independent authoritative records.

Question 738

An examination of unrecorded accrued liabilities begins with this observation: Post-close payments relate to services delivered before the balance-sheet date. Which follow-up procedure gives the most direct evidence?

  1. Search subsequent disbursements for missing accruals and compare receiving logs with liabilities.
  2. Perform independent counts and test ownership and valuation of selected stock.
  3. Map beneficial ownership and compare transactions with related-party disclosure requirements.
  4. Inspect additions to capital accounts against invoice descriptions and capitalization policies.

Explanation

Correct Answer

A:

For the Unrecorded accrued liabilities concern, the procedure tests source evidence behind this observation: Post-close payments relate to services delivered before the balance-sheet date. This matters because omitting obligations understates liabilities and costs rather than creating new cash resources; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

B:

This comparison primarily addresses Inflated year-end inventory, in which overstated ending inventory usually understates cost of goods sold and inflates earnings; because the present question instead concerns Unrecorded accrued liabilities, reviewers should search subsequent disbursements for missing accruals and compare receiving logs with liabilities rather than apply a check designed for Inflated year-end inventory.

C:

This comparison primarily addresses Omitted related-party disclosure, in which even when amounts are recorded, withholding material relationship information can mislead statement users; because the present question instead concerns Unrecorded accrued liabilities, reviewers should search subsequent disbursements for missing accruals and compare receiving logs with liabilities rather than apply a check designed for Omitted related-party disclosure.

D:

This comparison primarily addresses Capitalized routine operating costs, in which moving a period expense into assets understates expenses and overstates profit and assets; because the present question instead concerns Unrecorded accrued liabilities, reviewers should search subsequent disbursements for missing accruals and compare receiving logs with liabilities rather than apply a check designed for Capitalized routine operating costs.

Question 739

Two separate review files raise different issues. File A: A cashier enters a return that never occurred and takes cash from the register. File B: An employee voids valid completed purchases after customers leave and pockets the corresponding cash. Which pairing accurately classifies both files?

  1. File A: Fictitious register refund; File B: Fraudulent sale void.
  2. File A: Unauthorized register cash payout; File B: Fraudulent sale void.
  3. File A: Fraudulent sale void; File B: Fictitious register refund.
  4. File A: Fictitious register refund; File B: Duplicate expense reimbursement.

Explanation

Correct Answer

A:

File A is Fictitious register refund because the false disbursement is disguised as money returned to a customer, while File B is Fraudulent sale void because voiding erases or reverses a legitimate recorded sale while the customer payment was retained. The evidence chains differ: for File A, reviewers should test cash refunds against original receipts, customer details and inventory returns; for File B, they should match void timestamps with customer receipts and inventory movement.

Incorrect Answers

B:

File A is misidentified as Unauthorized register cash payout instead of Fictitious register refund. With the proposed pairing Unauthorized register cash payout / Fraudulent sale void, the distinction is substantive: File A shows that refunds lack linked original sales or physical returned goods, whereas File B shows that voids cluster under one cashier after high-cash transactions. For these Fictitious register refund and Fraudulent sale void files, choosing the pair Unauthorized register cash payout / Fraudulent sale void would misdirect the review away from at least one of these mechanisms.

C:

File A is misidentified as Fraudulent sale void instead of Fictitious register refund; File B is misidentified as Fictitious register refund instead of Fraudulent sale void. With the proposed pairing Fraudulent sale void / Fictitious register refund, the distinction is substantive: File A shows that refunds lack linked original sales or physical returned goods, whereas File B shows that voids cluster under one cashier after high-cash transactions. For these Fictitious register refund and Fraudulent sale void files, choosing the pair Fraudulent sale void / Fictitious register refund would misdirect the review away from at least one of these mechanisms.

D:

File B is misidentified as Duplicate expense reimbursement instead of Fraudulent sale void. With the proposed pairing Fictitious register refund / Duplicate expense reimbursement, the distinction is substantive: File A shows that refunds lack linked original sales or physical returned goods, whereas File B shows that voids cluster under one cashier after high-cash transactions. For these Fictitious register refund and Fraudulent sale void files, choosing the pair Fictitious register refund / Duplicate expense reimbursement would misdirect the review away from at least one of these mechanisms.

Question 740

Reviewers flag a possible unsuitable securities recommendation issue. Their preliminary finding is: Recommendation rationale conflicts with the client's recorded objectives and liquidity requirements. Which test would best confirm or refute the concern?

  1. Compare offering statements with board records, counsel assessments and known liabilities.
  2. Compare recommended product risk with the suitability and client-knowledge records.
  3. Trace public environmental claims to primary data, methodology and validation evidence.
  4. Analyze account turnover, costs, broker control and trading justifications.

Explanation

Correct Answer

B:

For the Unsuitable securities recommendation concern, the procedure tests source evidence behind this observation: Recommendation rationale conflicts with the client's recorded objectives and liquidity requirements. This matters because a sale can be improper because the recommendation does not match the customer's circumstances, not because the product itself is inherently unlawful; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Misleading offering prospectus, in which omission of decision-useful facts can mislead investors even where some published numbers are accurate; because the present question instead concerns Unsuitable securities recommendation, reviewers should compare recommended product risk with the suitability and client-knowledge records rather than apply a check designed for Misleading offering prospectus.

C:

This comparison primarily addresses False sustainability disclosures, in which nonfinancial representations can deceive securities investors when inaccurate or unsupported; because the present question instead concerns Unsuitable securities recommendation, reviewers should compare recommended product risk with the suitability and client-knowledge records rather than apply a check designed for False sustainability disclosures.

D:

This comparison primarily addresses Excessive-account churning, in which excessive trading for broker compensation can constitute churning when control and other relevant elements are present; because the present question instead concerns Unsuitable securities recommendation, reviewers should compare recommended product risk with the suitability and client-knowledge records rather than apply a check designed for Excessive-account churning.

Certified Fraud Examiner - Financial Transactions and Fraud Schemes (CFE - Financial Transactions and Fraud Schemes) Practice Tests