ACFE CFE - Financial Transactions and Fraud Schemes (Certified Fraud Examiner - Financial Transactions and Fraud Schemes) Practice Test 77

Question 760

The case file describes the following: A stolen card number is used for online orders without the actual cardholder or physical card. Which classification best explains the events?

  1. Fraudulent merchant QR redirect
  2. Peer-to-peer payment impostor
  3. Card-not-present shopping fraud
  4. Chip-card shimming

Explanation

Correct Answer

C:

Card-not-present shopping fraud fits the facts because remote payment misuse exploits card credentials without requiring face-to-face card presentation; the distinguishing observation is that transactions have risky delivery changes and failed identity or device checks. To test this interpretation, a reviewer should correlate order devices, fulfillment addresses, authorization results and cardholder complaints.

Incorrect Answers

A:

Fraudulent merchant QR redirect would involve a different sequence from Card-not-present shopping fraud: payment redirection changes the destination encoded in a legitimate-looking payment prompt. Unlike the rejected Fraudulent merchant QR redirect label, the evidence concerns Card-not-present shopping fraud, since transactions have risky delivery changes and failed identity or device checks; reviewers should correlate order devices, fulfillment addresses, authorization results and cardholder complaints.

B:

Peer-to-peer payment impostor would involve a different sequence from Card-not-present shopping fraud: the victim may authorize the transfer under deception rather than lose funds through stolen credentials. Unlike the rejected Peer-to-peer payment impostor label, the evidence concerns Card-not-present shopping fraud, since transactions have risky delivery changes and failed identity or device checks; reviewers should correlate order devices, fulfillment addresses, authorization results and cardholder complaints.

D:

Chip-card shimming would involve a different sequence from Card-not-present shopping fraud: a shim targets information in the chip-card interface; chip transaction data alone does not necessarily permit cloning a valid chip. Unlike the rejected Chip-card shimming label, the evidence concerns Card-not-present shopping fraud, since transactions have risky delivery changes and failed identity or device checks; reviewers should correlate order devices, fulfillment addresses, authorization results and cardholder complaints.

Question 761

An analyst is selecting warning signs for remote desktop credential intrusion. Which recorded pattern should receive focused attention?

  1. Remote access occurs outside approved support windows from unusual source networks.
  2. Unapproved extension permissions include access to every page and outbound transfers.
  3. Many denied push prompts precede an approved login from an unfamiliar device.
  4. The decoded URLs use lookalike domains and precede credential-related alerts.

Explanation

Correct Answer

A:

This observation is a pertinent indicator of Remote desktop credential intrusion because valid-looking remote sessions can conceal misuse of stolen administrator access. The practical corroborating procedure is to compare remote session logs, privileged access records and transfer activity; the indicator by itself does not establish intent or error.

Incorrect Answers

B:

The proposed observation fits Malicious browser extension, where browser extensions can misuse broad page-access permissions without a classic email attachment, rather than the particular mechanism in Remote desktop credential intrusion. Unlike the clue for Malicious browser extension, the more directly related indicator for Remote desktop credential intrusion is this: Remote access occurs outside approved support windows from unusual source networks.

C:

The proposed observation fits MFA-push fatigue attack, where repeated prompts exploit human approval fatigue rather than cracking the second factor, rather than the particular mechanism in Remote desktop credential intrusion. Unlike the clue for MFA-push fatigue attack, the more directly related indicator for Remote desktop credential intrusion is this: Remote access occurs outside approved support windows from unusual source networks.

D:

The proposed observation fits QR-code phishing campaign, where qR phishing hides a malicious URL within an image instead of a visible hyperlink, rather than the particular mechanism in Remote desktop credential intrusion. Unlike the clue for QR-code phishing campaign, the more directly related indicator for Remote desktop credential intrusion is this: Remote access occurs outside approved support windows from unusual source networks.

Question 762

For a review of concealed preexisting condition, which evidence-based warning sign is the most specific?

  1. Identical invoices and loss photos recur in separate carriers' claim files.
  2. Claimed work restrictions conflict with verified employment or functional evidence.
  3. Earlier medical records contradict answers on the application.
  4. Policyholders have receipts while insurer records show lapse or nonpayment.

Explanation

Correct Answer

C:

This observation is a pertinent indicator of Concealed preexisting condition because material misrepresentation at policy inception differs from fabricating a later insured loss. The practical corroborating procedure is to compare authorized medical evidence with disclosed underwriting history; the indicator by itself does not establish intent or error.

Incorrect Answers

A:

The proposed observation fits Duplicate casualty claims, where multiple recoveries for one loss can exceed the legitimate indemnifiable damage, rather than the particular mechanism in Concealed preexisting condition. Unlike the clue for Duplicate casualty claims, the more directly related indicator for Concealed preexisting condition is this: Earlier medical records contradict answers on the application.

B:

The proposed observation fits Workers compensation malingering, where misstated disability status can sustain benefits inconsistent with actual capacity, rather than the particular mechanism in Concealed preexisting condition. Unlike the clue for Workers compensation malingering, the more directly related indicator for Concealed preexisting condition is this: Earlier medical records contradict answers on the application.

D:

The proposed observation fits Insurance premium diversion, where the intermediary misappropriates premium cash without necessarily creating a false claim, rather than the particular mechanism in Concealed preexisting condition. Unlike the clue for Insurance premium diversion, the more directly related indicator for Concealed preexisting condition is this: Earlier medical records contradict answers on the application.

Question 763

The review team observes the following: The employee's private benefits track the contractor's paid invoice volume. It seeks one targeted detection step and one preventive measure that address the same underlying vulnerability. Which pairing is best?

  1. Diagnostic: Compare certification dates with quality results and inspector-vendor relationships; safeguard: Enforce independent sourcing approvals and disclose vendor-benefit relationships.
  2. Diagnostic: Map beneficial owners and family relationships against employee procurement influence; safeguard: Screen intermediaries and beneficial owners for decision-maker connections.
  3. Diagnostic: Cross-check procurement decisions, vendor performance and unexplained employee benefits; safeguard: Enforce independent sourcing approvals and disclose vendor-benefit relationships.
  4. Diagnostic: Cross-check procurement decisions, vendor performance and unexplained employee benefits; safeguard: Require timely conflict disclosure and recusal from related decisions.

Explanation

Correct Answer

C:

The test addresses Supplier kickback for selection by targeting this observation: The employee's private benefits track the contractor's paid invoice volume. The accompanying safeguard—enforce independent sourcing approvals and disclose vendor-benefit relationships—counters the same opportunity, so both checking and prevention concern one cause.

Incorrect Answers

A:

The proposed safeguard is relevant to Supplier kickback for selection, but the diagnostic tests Bribe to overlook inspections rather than the identified anomaly. That test is aimed at records involving inspection sign-offs conflict with independent engineering tests and financial transfers; the specified case instead calls for reviewers to cross-check procurement decisions, vendor performance and unexplained employee benefits.

B:

The evidence test relates to Undisclosed supplier ownership, whereas the proposed safeguard protects against Vendor-funded political favor; neither directly resolves Supplier kickback for selection. Unlike the Undisclosed supplier ownership test and Vendor-funded political favor safeguard, the investigation of Supplier kickback for selection requires reviewers to cross-check procurement decisions, vendor performance and unexplained employee benefits, followed by assessment of the matching control point.

D:

The diagnostic correctly examines Supplier kickback for selection by having reviewers cross-check procurement decisions, vendor performance and unexplained employee benefits, but the safeguard is for Undisclosed supplier ownership. That prevention step responds to a different mechanism: A personal interest compromises objectivity even before a direct bribe is proven.

Question 764

Reviewers flag a possible credential-stuffing identity abuse issue. Their preliminary finding is: High-volume authentication attempts show common automation signatures and reused credentials. Which test would best confirm or refute the concern?

  1. Correlate telecom SIM-change records with account recovery and transaction history.
  2. Inspect liveness testing results and compare trusted identity references.
  3. Compare reported URLs and capture artifacts with official government portals.
  4. Review failed-login patterns, device fingerprints and successful account access.

Explanation

Correct Answer

D:

For the Credential-stuffing identity abuse concern, the procedure tests source evidence behind this observation: High-volume authentication attempts show common automation signatures and reused credentials. This matters because reused passwords let attackers impersonate customers through online credential abuse; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses SIM-swap account takeover, in which control of a phone number can intercept recovery codes without ownership of the underlying account; because the present question instead concerns Credential-stuffing identity abuse, reviewers should review failed-login patterns, device fingerprints and successful account access rather than apply a check designed for SIM-swap account takeover.

B:

This comparison primarily addresses Deepfake onboarding deception, in which synthetic audiovisual media can defeat naive identity checks without involving a genuine person; because the present question instead concerns Credential-stuffing identity abuse, reviewers should review failed-login patterns, device fingerprints and successful account access rather than apply a check designed for Deepfake onboarding deception.

C:

This comparison primarily addresses Phishing identity-document collection, in which social engineering harvests data that can later support impersonation or account opening; because the present question instead concerns Credential-stuffing identity abuse, reviewers should review failed-login patterns, device fingerprints and successful account access rather than apply a check designed for Phishing identity-document collection.

Question 765

Two separate review files raise different issues. File A: A technician takes company-owned cameras home repeatedly without a loan agreement. File B: A storekeeper removes saleable goods from inventory and records unexplained shrinkage. Which pairing accurately classifies both files?

  1. File A: Unauthorized equipment personal use; File B: Fictitious outbound shipment.
  2. File A: False scrap classification; File B: Warehouse stock diversion.
  3. File A: Warehouse stock diversion; File B: Unauthorized equipment personal use.
  4. File A: Unauthorized equipment personal use; File B: Warehouse stock diversion.

Explanation

Correct Answer

D:

File A is Unauthorized equipment personal use because temporary unauthorized use is misuse of a noncash asset even where permanent theft is unproven, while File B is Warehouse stock diversion because the employee converts recorded merchandise to private use by exploiting physical access. The evidence chains differ: for File A, reviewers should compare asset-location audits and access logs with authorized lending records; for File B, they should reconcile cycle counts, stock movements and exception adjustments by custodian.

Incorrect Answers

A:

File B is misidentified as Fictitious outbound shipment instead of Warehouse stock diversion. With the proposed pairing Unauthorized equipment personal use / Fictitious outbound shipment, the distinction is substantive: File A shows that equipment checkout history shows extended absence without approved projects, whereas File B shows that repeated shortages affect items to which the custodian has exclusive access. For these Unauthorized equipment personal use and Warehouse stock diversion files, choosing the pair Unauthorized equipment personal use / Fictitious outbound shipment would misdirect the review away from at least one of these mechanisms.

B:

File A is misidentified as False scrap classification instead of Unauthorized equipment personal use. With the proposed pairing False scrap classification / Warehouse stock diversion, the distinction is substantive: File A shows that equipment checkout history shows extended absence without approved projects, whereas File B shows that repeated shortages affect items to which the custodian has exclusive access. For these Unauthorized equipment personal use and Warehouse stock diversion files, choosing the pair False scrap classification / Warehouse stock diversion would misdirect the review away from at least one of these mechanisms.

C:

File A is misidentified as Warehouse stock diversion instead of Unauthorized equipment personal use; File B is misidentified as Unauthorized equipment personal use instead of Warehouse stock diversion. With the proposed pairing Warehouse stock diversion / Unauthorized equipment personal use, the distinction is substantive: File A shows that equipment checkout history shows extended absence without approved projects, whereas File B shows that repeated shortages affect items to which the custodian has exclusive access. For these Unauthorized equipment personal use and Warehouse stock diversion files, choosing the pair Warehouse stock diversion / Unauthorized equipment personal use would misdirect the review away from at least one of these mechanisms.

Question 766

An analyst is selecting warning signs for alternative remittance settlement. Which recorded pattern should receive focused attention?

  1. Payments and settlement records do not resemble ordinary end-to-end bank transfers.
  2. Blockchain flows show rapid hops among intermediary addresses before exchange cash-out.
  3. Repeated card purchases and redemptions are connected across nominally unrelated buyers.
  4. Nominal directors cannot explain operations and ownership trails end in opaque nominees.

Explanation

Correct Answer

A:

This observation is a pertinent indicator of Alternative remittance settlement because value transfer can occur through broker-ledgers and net settlements, whether legitimate or abused. The practical corroborating procedure is to reconcile sender receipts, broker obligations and final beneficiary payouts; the indicator by itself does not establish intent or error.

Incorrect Answers

B:

The proposed observation fits Virtual-asset layering, where multiple on-chain transfers can complicate attribution but do not automatically erase transaction history, rather than the particular mechanism in Alternative remittance settlement. Unlike the clue for Virtual-asset layering, the more directly related indicator for Alternative remittance settlement is this: Payments and settlement records do not resemble ordinary end-to-end bank transfers.

C:

The proposed observation fits Stored-value card conversion, where stored-value instruments can move purchasing power while distancing it from original cash, rather than the particular mechanism in Alternative remittance settlement. Unlike the clue for Stored-value card conversion, the more directly related indicator for Alternative remittance settlement is this: Payments and settlement records do not resemble ordinary end-to-end bank transfers.

D:

The proposed observation fits Opaque beneficial-ownership layers, where legal-entity layers can conceal who controls funds and defeat superficial name-only screening, rather than the particular mechanism in Alternative remittance settlement. Unlike the clue for Opaque beneficial-ownership layers, the more directly related indicator for Alternative remittance settlement is this: Payments and settlement records do not resemble ordinary end-to-end bank transfers.

Question 767

The case file describes the following: A department head inserts discretionary bonuses for associates without the required senior approval. Which classification best explains the events?

  1. Duplicate expense reimbursement
  2. Terminated worker retained on payroll
  3. Fictitious travel reimbursement
  4. Unauthorized bonus disbursement

Explanation

Correct Answer

D:

Unauthorized bonus disbursement fits the facts because improper one-off payments exploit weak controls over discretionary compensation; the distinguishing observation is that bonus payouts lack approved evaluation and authorization records. To test this interpretation, a reviewer should compare exception payroll components with board-approved bonus rules and signatures.

Incorrect Answers

A:

Duplicate expense reimbursement would involve a different sequence from Unauthorized bonus disbursement: one real expense is reimbursed more than once, inflating the employee's recovery. Unlike the rejected Duplicate expense reimbursement label, the evidence concerns Unauthorized bonus disbursement, since bonus payouts lack approved evaluation and authorization records; reviewers should compare exception payroll components with board-approved bonus rules and signatures.

B:

Terminated worker retained on payroll would involve a different sequence from Unauthorized bonus disbursement: continuing pay to a departed employee produces a disbursement with no current employment basis. Unlike the rejected Terminated worker retained on payroll label, the evidence concerns Unauthorized bonus disbursement, since bonus payouts lack approved evaluation and authorization records; reviewers should compare exception payroll components with board-approved bonus rules and signatures.

C:

Fictitious travel reimbursement would involve a different sequence from Unauthorized bonus disbursement: the claimant seeks payment for an expense that was never incurred. Unlike the rejected Fictitious travel reimbursement label, the evidence concerns Unauthorized bonus disbursement, since bonus payouts lack approved evaluation and authorization records; reviewers should compare exception payroll components with board-approved bonus rules and signatures.

Question 768

Control designers are focusing on the mechanism behind concealed offshore insolvency asset: Concealment deprives the estate and creditors of property that should be disclosed. Which measure best limits that opportunity?

  1. Review insider transactions and preserve assets for lawful creditor treatment.
  2. Require complete asset schedules and independent verification under applicable law.
  3. Apply consistent creditor-payment governance and seek jurisdiction-specific insolvency advice.
  4. Segregate custody and oversight of estate assets under the applicable insolvency framework.

Explanation

Correct Answer

B:

The control directly addresses the failure point in Concealed offshore insolvency asset, since concealment deprives the estate and creditors of property that should be disclosed. A subsequent independent review could compare disclosed assets with bank transfers, ownership and foreign records to identify exceptions that bypassed the safeguard.

Incorrect Answers

A:

This safeguard is directed primarily at Pre-filing fraudulent asset transfer rather than Concealed offshore insolvency asset, because transfers intended to put assets beyond creditors may be challengeable under applicable insolvency law. Unlike the control for Pre-filing fraudulent asset transfer, the more direct design for Concealed offshore insolvency asset is to require complete asset schedules and independent verification under applicable law; a different safeguard cannot substitute for it.

C:

This safeguard is directed primarily at Preferential creditor payment review rather than Concealed offshore insolvency asset, because preference rules can permit recovery of certain pre-filing payments without proving a fictitious invoice or ordinary theft. Unlike the control for Preferential creditor payment review, the more direct design for Concealed offshore insolvency asset is to require complete asset schedules and independent verification under applicable law; a different safeguard cannot substitute for it.

D:

This safeguard is directed primarily at Trustee and receiver accountability rather than Concealed offshore insolvency asset, because a trustee or receiver acts within a defined legal appointment to administer assets, not as an unrestricted owner. Unlike the control for Trustee and receiver accountability, the more direct design for Concealed offshore insolvency asset is to require complete asset schedules and independent verification under applicable law; a different safeguard cannot substitute for it.

Question 769

The case file describes the following: A charity's legitimately raised donations are secretly redirected toward a prohibited violent organization's activities. Which classification best explains the events?

  1. Opaque beneficial-ownership layers
  2. Money-mule transfers
  3. Terrorist-financing source distinction
  4. Suspicious-activity reporting decision
  5. Cash-deposit structuring

Explanation

Correct Answer

C:

Terrorist-financing source distinction fits the facts because terrorist financing can involve legitimately sourced money; destination and intended use are central concerns; the distinguishing observation is that disbursements reach concealed end users unrelated to the published charitable mission. To test this interpretation, a reviewer should trace source and destination of funds and the identity of ultimate recipients.

Incorrect Answers

A:

Opaque beneficial-ownership layers would involve a different sequence from Terrorist-financing source distinction: legal-entity layers can conceal who controls funds and defeat superficial name-only screening. Unlike the rejected Opaque beneficial-ownership layers label, the evidence concerns Terrorist-financing source distinction, since disbursements reach concealed end users unrelated to the published charitable mission; reviewers should trace source and destination of funds and the identity of ultimate recipients.

B:

Money-mule transfers would involve a different sequence from Terrorist-financing source distinction: money mules help move proceeds while separating the originator from subsequent recipients. Unlike the rejected Money-mule transfers label, the evidence concerns Terrorist-financing source distinction, since disbursements reach concealed end users unrelated to the published charitable mission; reviewers should trace source and destination of funds and the identity of ultimate recipients.

D:

Suspicious-activity reporting decision would involve a different sequence from Terrorist-financing source distinction: a SAR or STR is a suspicion-based regulatory tool; examiners need not prove criminal guilt before considering it. Unlike the rejected Suspicious-activity reporting decision label, the evidence concerns Terrorist-financing source distinction, since disbursements reach concealed end users unrelated to the published charitable mission; reviewers should trace source and destination of funds and the identity of ultimate recipients.

E:

Cash-deposit structuring would involve a different sequence from Terrorist-financing source distinction: structuring intentionally fragments transactions to evade detection or reporting; the exact threshold is jurisdiction-dependent. Unlike the rejected Cash-deposit structuring label, the evidence concerns Terrorist-financing source distinction, since disbursements reach concealed end users unrelated to the published charitable mission; reviewers should trace source and destination of funds and the identity of ultimate recipients.

Question 770

Two separate review files raise different issues. File A: A fraud network cultivates a victim over weeks, displays fictitious trading profits and then blocks withdrawals unless new fees are paid. File B: A victim is told that a prize has been won but must first pay a release or tax charge to an unknown account. Which pairing accurately classifies both files?

  1. File A: Pig-butchering investment scam; File B: Online romance investment grooming.
  2. File A: Advance-fee lottery fraud; File B: Pig-butchering investment scam.
  3. File A: Online romance investment grooming; File B: Pig-butchering investment scam.
  4. File A: Ponzi payout financing; File B: Advance-fee lottery fraud.
  5. File A: Pig-butchering investment scam; File B: Advance-fee lottery fraud.

Explanation

Correct Answer

E:

File A is Pig-butchering investment scam because long-form social engineering combines relationship grooming with fabricated investment performance, while File B is Advance-fee lottery fraud because the promise of future value is used to extract an immediate fee without a real award. The evidence chains differ: for File A, reviewers should verify platform licensing and wallet flows instead of trusting account screenshots; for File B, they should verify the awarding organization independently and follow payments to recipients.

Incorrect Answers

A:

File B is misidentified as Online romance investment grooming instead of Advance-fee lottery fraud. With the proposed pairing Pig-butchering investment scam / Online romance investment grooming, the distinction is substantive: File A shows that platform balances rise without verifiable custody and withdrawal attempts trigger extra demands, whereas File B shows that a surprise prize demand has no verifiable entry and requires upfront payment. For these Pig-butchering investment scam and Advance-fee lottery fraud files, choosing the pair Pig-butchering investment scam / Online romance investment grooming would misdirect the review away from at least one of these mechanisms.

B:

File A is misidentified as Advance-fee lottery fraud instead of Pig-butchering investment scam; File B is misidentified as Pig-butchering investment scam instead of Advance-fee lottery fraud. With the proposed pairing Advance-fee lottery fraud / Pig-butchering investment scam, the distinction is substantive: File A shows that platform balances rise without verifiable custody and withdrawal attempts trigger extra demands, whereas File B shows that a surprise prize demand has no verifiable entry and requires upfront payment. For these Pig-butchering investment scam and Advance-fee lottery fraud files, choosing the pair Advance-fee lottery fraud / Pig-butchering investment scam would misdirect the review away from at least one of these mechanisms.

C:

File A is misidentified as Online romance investment grooming instead of Pig-butchering investment scam; File B is misidentified as Pig-butchering investment scam instead of Advance-fee lottery fraud. With the proposed pairing Online romance investment grooming / Pig-butchering investment scam, the distinction is substantive: File A shows that platform balances rise without verifiable custody and withdrawal attempts trigger extra demands, whereas File B shows that a surprise prize demand has no verifiable entry and requires upfront payment. For these Pig-butchering investment scam and Advance-fee lottery fraud files, choosing the pair Online romance investment grooming / Pig-butchering investment scam would misdirect the review away from at least one of these mechanisms.

D:

File A is misidentified as Ponzi payout financing instead of Pig-butchering investment scam. With the proposed pairing Ponzi payout financing / Advance-fee lottery fraud, the distinction is substantive: File A shows that platform balances rise without verifiable custody and withdrawal attempts trigger extra demands, whereas File B shows that a surprise prize demand has no verifiable entry and requires upfront payment. For these Pig-butchering investment scam and Advance-fee lottery fraud files, choosing the pair Ponzi payout financing / Advance-fee lottery fraud would misdirect the review away from at least one of these mechanisms.

Certified Fraud Examiner - Financial Transactions and Fraud Schemes (CFE - Financial Transactions and Fraud Schemes) Practice Tests