ACFE CFE - Financial Transactions and Fraud Schemes (Certified Fraud Examiner - Financial Transactions and Fraud Schemes) Practice Test 95

Question 940

The case file describes the following: Two drivers arrange a low-speed collision and exaggerate injuries to obtain insurance payouts. Which classification best explains the events?

  1. Inflated auto repair estimate
  2. Intentional property fire claim
  3. Staged vehicle collision claim
  4. Fictitious beneficiary change

Explanation

Correct Answer

C:

Staged vehicle collision claim fits the facts because a staged loss creates the insured event rather than merely exaggerating a genuine accident; the distinguishing observation is that prior relationships and repeated accident participants conflict with an apparently spontaneous crash. To test this interpretation, a reviewer should compare crash records, medical claims and links among participants.

Incorrect Answers

A:

Inflated auto repair estimate would involve a different sequence from Staged vehicle collision claim: a real covered loss is enlarged through fictitious repair costs. Unlike the rejected Inflated auto repair estimate label, the evidence concerns Staged vehicle collision claim, since prior relationships and repeated accident participants conflict with an apparently spontaneous crash; reviewers should compare crash records, medical claims and links among participants.

B:

Intentional property fire claim would involve a different sequence from Staged vehicle collision claim: deliberate creation of a loss may defeat coverage and constitutes a different risk from accidental damage. Unlike the rejected Intentional property fire claim label, the evidence concerns Staged vehicle collision claim, since prior relationships and repeated accident participants conflict with an apparently spontaneous crash; reviewers should compare crash records, medical claims and links among participants.

D:

Fictitious beneficiary change would involve a different sequence from Staged vehicle collision claim: the scheme tampers with policy entitlement rather than misrepresenting the insured event. Unlike the rejected Fictitious beneficiary change label, the evidence concerns Staged vehicle collision claim, since prior relationships and repeated accident participants conflict with an apparently spontaneous crash; reviewers should compare crash records, medical claims and links among participants.

Question 941

The team is assessing a potential peer-to-peer payment impostor discrepancy. Initial observation: Payment recipients are new and contact details differ from the real relative's. Which verification step is most informative?

  1. Correlate order devices, fulfillment addresses, authorization results and cardholder complaints.
  2. Compare displayed QR destinations with merchant-controlled account records.
  3. Link card funding source, load time, device identity and redemption trail.
  4. Independently verify the claimed requester and review recipient-account history.

Explanation

Correct Answer

D:

For the Peer-to-peer payment impostor concern, the procedure tests source evidence behind this observation: Payment recipients are new and contact details differ from the real relative's. This matters because the victim may authorize the transfer under deception rather than lose funds through stolen credentials; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Card-not-present shopping fraud, in which remote payment misuse exploits card credentials without requiring face-to-face card presentation; because the present question instead concerns Peer-to-peer payment impostor, reviewers should independently verify the claimed requester and review recipient-account history rather than apply a check designed for Card-not-present shopping fraud.

B:

This comparison primarily addresses Fraudulent merchant QR redirect, in which payment redirection changes the destination encoded in a legitimate-looking payment prompt; because the present question instead concerns Peer-to-peer payment impostor, reviewers should independently verify the claimed requester and review recipient-account history rather than apply a check designed for Fraudulent merchant QR redirect.

C:

This comparison primarily addresses Prepaid card load-and-drain, in which prepaid value can be used to convert unauthorized payments into quickly transferable balances; because the present question instead concerns Peer-to-peer payment impostor, reviewers should independently verify the claimed requester and review recipient-account history rather than apply a check designed for Prepaid card load-and-drain.

Question 942

Reviewers flag a possible fabricated deductible business cost issue. Their preliminary finding is: Claimed deductions lack actual payments or received services. Which test would best confirm or refute the concern?

  1. Trace beneficial control, functions and genuine commercial substance.
  2. Verify claimed costs against real supplier transactions and business purpose.
  3. Compare historical filing information with authentication and refund destination records.
  4. Cross-match purchase invoices and tax registrations with supplier records.
  5. Reconcile independent sales evidence with filed taxable income.

Explanation

Correct Answer

B:

For the Fabricated deductible business cost concern, the procedure tests source evidence behind this observation: Claimed deductions lack actual payments or received services. This matters because a fictitious expense reduces reported taxable income without a genuine economic cost; independent corroboration is necessary before accepting any conclusion.

Incorrect Answers

A:

This comparison primarily addresses Sham offshore tax shelter, in which a paper structure intended to conceal taxable facts differs from lawful tax structuring with genuine substance; because the present question instead concerns Fabricated deductible business cost, reviewers should verify claimed costs against real supplier transactions and business purpose rather than apply a check designed for Sham offshore tax shelter.

C:

This comparison primarily addresses Stolen-identity tax return, in which refund fraud uses another person's tax identity rather than understating the criminal's own income; because the present question instead concerns Fabricated deductible business cost, reviewers should verify claimed costs against real supplier transactions and business purpose rather than apply a check designed for Stolen-identity tax return.

D:

This comparison primarily addresses False consumption-tax input credit, in which false input credits reduce remitted VAT or generate improper refunds; because the present question instead concerns Fabricated deductible business cost, reviewers should verify claimed costs against real supplier transactions and business purpose rather than apply a check designed for False consumption-tax input credit.

E:

This comparison primarily addresses Unreported cash taxable income, in which knowingly concealing taxable receipts can constitute tax evasion rather than lawful tax planning; because the present question instead concerns Fabricated deductible business cost, reviewers should verify claimed costs against real supplier transactions and business purpose rather than apply a check designed for Unreported cash taxable income.

Question 943

A reviewer wants to distinguish unbundled procedure billing from adjacent risk patterns. Which observation is the most diagnostic indicator?

  1. Claim lines repeatedly contain component codes that belong to a bundled service.
  2. Repeated medical-necessity forms use boilerplate unsupported by examinations.
  3. Clinical notes support lower-intensity care than the codes billed.
  4. Appointment, access and patient-confirmation records show no encounter.

Explanation

Correct Answer

A:

This observation is a pertinent indicator of Unbundled procedure billing because splitting a bundled service into extra claim lines can produce unjustified reimbursement. The practical corroborating procedure is to review code combinations against current payer bundling rules and medical records; the indicator by itself does not establish intent or error.

Incorrect Answers

B:

The proposed observation fits False medical necessity certification, where claims fraud can arise from false eligibility or necessity rather than nonexistent delivery, rather than the particular mechanism in Unbundled procedure billing. Unlike the clue for False medical necessity certification, the more directly related indicator for Unbundled procedure billing is this: Claim lines repeatedly contain component codes that belong to a bundled service.

C:

The proposed observation fits Medical service upcoding, where upcoding inflates payment by assigning a code for a more expensive service than was delivered, rather than the particular mechanism in Unbundled procedure billing. Unlike the clue for Medical service upcoding, the more directly related indicator for Unbundled procedure billing is this: Claim lines repeatedly contain component codes that belong to a bundled service.

D:

The proposed observation fits Phantom patient encounters, where billing nonexistent visits extracts payment for services not rendered, rather than the particular mechanism in Unbundled procedure billing. Unlike the clue for Phantom patient encounters, the more directly related indicator for Unbundled procedure billing is this: Claim lines repeatedly contain component codes that belong to a bundled service.

Question 944

A reviewer wants to distinguish premature revenue recognition from adjacent risk patterns. Which observation is the most diagnostic indicator?

  1. Invoices cluster at period end while acceptance milestones remain open.
  2. Reseller inventory and returns rise sharply while reported sales surge.
  3. Large new receivables lack customer confirmations or shipping support.
  4. Ownership records show links between management and an important counterparty.

Explanation

Correct Answer

A:

This observation is a pertinent indicator of Premature revenue recognition because a real contract does not justify recognizing revenue before relevant recognition criteria are satisfied. The practical corroborating procedure is to compare recognized revenue with signed acceptance and fulfillment milestones; the indicator by itself does not establish intent or error.

Incorrect Answers

B:

The proposed observation fits Channel-stuffing manipulation, where accelerated shipment can overstate current revenue when substantive return or acceptance terms contradict recognition, rather than the particular mechanism in Premature revenue recognition. Unlike the clue for Channel-stuffing manipulation, the more directly related indicator for Premature revenue recognition is this: Invoices cluster at period end while acceptance milestones remain open.

C:

The proposed observation fits Fictitious sales entries, where recording invented transactions inflates revenue and assets without an underlying exchange, rather than the particular mechanism in Premature revenue recognition. Unlike the clue for Fictitious sales entries, the more directly related indicator for Premature revenue recognition is this: Invoices cluster at period end while acceptance milestones remain open.

D:

The proposed observation fits Omitted related-party disclosure, where even when amounts are recorded, withholding material relationship information can mislead statement users, rather than the particular mechanism in Premature revenue recognition. Unlike the clue for Omitted related-party disclosure, the more directly related indicator for Premature revenue recognition is this: Invoices cluster at period end while acceptance milestones remain open.

Question 945

The available records suggest concealed preexisting condition: Earlier medical records contradict answers on the application. Which TWO actions together provide one direct check and one targeted preventive measure? Choose TWO.

  1. Review policy change history, consent evidence and beneficiary identities.
  2. Use clear underwriting questions and verify material inconsistencies lawfully.
  3. Claimed work restrictions conflict with verified employment or functional evidence.
  4. Compare authorized medical evidence with disclosed underwriting history.
  5. Use inter-insurer fraud sharing and duplicate-loss checks under privacy rules.

Explanation

Correct Answers

B:

This safeguard directly reduces Concealed preexisting condition exposure because material misrepresentation at policy inception differs from fabricating a later insured loss. The control should be monitored using records from this check: Compare authorized medical evidence with disclosed underwriting history.

D:

This procedure verifies the records implicated by Concealed preexisting condition; the observed anomaly is that earlier medical records contradict answers on the application. For the Concealed preexisting condition concern, it can distinguish errors and innocent explanations from possible misstatements or wrongdoing before reaching a conclusion.

Incorrect Answers

A:

This procedure tests Fictitious beneficiary change rather than the named Concealed preexisting condition concern. The Fictitious beneficiary change evidence is beneficiary forms fail signature or authentication checks and appear near claim filing, while the Concealed preexisting condition path requires reviewers to compare authorized medical evidence with disclosed underwriting history.

C:

The listed warning sign specifically concerns Workers compensation malingering, where misstated disability status can sustain benefits inconsistent with actual capacity, not the requested Concealed preexisting condition review. Unlike the Workers compensation malingering indicator, the relevant signal for Concealed preexisting condition is this: Earlier medical records contradict answers on the application.

E:

The chosen preventive action chiefly mitigates Duplicate casualty claims, where multiple recoveries for one loss can exceed the legitimate indemnifiable damage. For Concealed preexisting condition, unlike Duplicate casualty claims, the targeted safeguard is to use clear underwriting questions and verify material inconsistencies lawfully because the exposure occurs at a different point.

Question 946

Control designers are focusing on the mechanism behind ai-voice executive impersonation: Synthetic voice impersonation can exploit executive authority cues without true authorization. Which measure best limits that opportunity?

  1. Deploy phishing-resistant authentication and user reporting of suspicious domains.
  2. Train staff to verify links and protect approved workplace posters against substitution.
  3. Use phishing-resistant access controls and callback verification for payment changes.
  4. Require transaction approvals that cannot be waived by voice alone.

Explanation

Correct Answer

D:

The control directly addresses the failure point in AI-voice executive impersonation, since synthetic voice impersonation can exploit executive authority cues without true authorization. A subsequent independent review could authenticate the speaker through an independent known channel and inspect communication provenance to identify exceptions that bypassed the safeguard.

Incorrect Answers

A:

This safeguard is directed primarily at Spear-phishing credential capture rather than AI-voice executive impersonation, because targeted phishing collects credentials by masquerading as a trusted internal communication. Unlike the control for Spear-phishing credential capture, the more direct design for AI-voice executive impersonation is to require transaction approvals that cannot be waived by voice alone; a different safeguard cannot substitute for it.

B:

This safeguard is directed primarily at QR-code phishing campaign rather than AI-voice executive impersonation, because qR phishing hides a malicious URL within an image instead of a visible hyperlink. Unlike the control for QR-code phishing campaign, the more direct design for AI-voice executive impersonation is to require transaction approvals that cannot be waived by voice alone; a different safeguard cannot substitute for it.

C:

This safeguard is directed primarily at Vendor-mailbox business email compromise rather than AI-voice executive impersonation, because bEC uses trusted business communications to redirect funds without necessarily altering the invoice amount. Unlike the control for Vendor-mailbox business email compromise, the more direct design for AI-voice executive impersonation is to require transaction approvals that cannot be waived by voice alone; a different safeguard cannot substitute for it.

Question 947

A finance team is reviewing the accuracy of accrued supplier expense. Relevant accounting principle: An incurred cost belongs to the period of the service even if payment and invoicing follow later. Which procedure best supports reliable treatment?

  1. Require a cutoff review of completed work not yet billed.
  2. Use an unbilled-liabilities accrual and review invoices received after close.
  3. Capitalize the unexpired coverage and expense it systematically over the protection period.
  4. Recognize unearned consideration as a liability until the related service is earned.

Explanation

Correct Answer

B:

The control directly addresses the failure point in Accrued supplier expense, since an incurred cost belongs to the period of the service even if payment and invoicing follow later. A subsequent independent review could inspect post-close invoices and receiving evidence for prior-period services to identify exceptions that bypassed the safeguard.

Incorrect Answers

A:

This safeguard is directed primarily at Accrued service revenue rather than Accrued supplier expense, because under accrual accounting, revenue relates to the period when the service was performed, not simply the invoice or cash date. Unlike the control for Accrued service revenue, the more direct design for Accrued supplier expense is to use an unbilled-liabilities accrual and review invoices received after close; a different safeguard cannot substitute for it.

C:

This safeguard is directed primarily at Prepaid insurance expense rather than Accrued supplier expense, because an advance payment creates an asset for future economic benefit rather than immediate expense for all periods. Unlike the control for Prepaid insurance expense, the more direct design for Accrued supplier expense is to use an unbilled-liabilities accrual and review invoices received after close; a different safeguard cannot substitute for it.

D:

This safeguard is directed primarily at Deferred customer revenue rather than Accrued supplier expense, because prepayment does not by itself make the entire receipt current-period income; the unperformed portion represents an obligation. Unlike the control for Deferred customer revenue, the more direct design for Accrued supplier expense is to use an unbilled-liabilities accrual and review invoices received after close; a different safeguard cannot substitute for it.

Question 948

A process owner is assessing safeguards for lavish hospitality influence. The mechanism is: Material personal entertainment can influence purchasing discretion even without cash transfer. Which control addresses it most directly?

  1. Use transparent service criteria and protected independent complaint channels.
  2. Require timely conflict disclosure and recusal from related decisions.
  3. Set hospitality limits and require advance independent approval for high-risk recipients.
  4. Apply third-party diligence to charitable contributions connected to public or procurement officials.

Explanation

Correct Answer

C:

The control directly addresses the failure point in Lavish hospitality influence, since material personal entertainment can influence purchasing discretion even without cash transfer. A subsequent independent review could compare gift registers, travel records and award dates for decision makers to identify exceptions that bypassed the safeguard.

Incorrect Answers

A:

This safeguard is directed primarily at Economic extortion demand rather than Lavish hospitality influence, because extortion relies on coercive leverage over a decision or entitlement rather than a voluntary gratuity. Unlike the control for Economic extortion demand, the more direct design for Lavish hospitality influence is to set hospitality limits and require advance independent approval for high-risk recipients; a different safeguard cannot substitute for it.

B:

This safeguard is directed primarily at Undisclosed supplier ownership rather than Lavish hospitality influence, because a personal interest compromises objectivity even before a direct bribe is proven. Unlike the control for Undisclosed supplier ownership, the more direct design for Lavish hospitality influence is to set hospitality limits and require advance independent approval for high-risk recipients; a different safeguard cannot substitute for it.

D:

This safeguard is directed primarily at Inflated charitable donation conduit rather than Lavish hospitality influence, because an apparent donation may disguise a benefit routed to someone able to influence business. Unlike the control for Inflated charitable donation conduit, the more direct design for Lavish hospitality influence is to set hospitality limits and require advance independent approval for high-risk recipients; a different safeguard cannot substitute for it.

Question 949

The case file describes the following: An attacker persuades a mobile operator to transfer a victim's number to a new SIM before resetting banking access. Which classification best explains the events?

  1. Deepfake onboarding deception
  2. SIM-swap account takeover
  3. Credential-stuffing identity abuse
  4. Child identity misuse

Explanation

Correct Answer

B:

SIM-swap account takeover fits the facts because control of a phone number can intercept recovery codes without ownership of the underlying account; the distinguishing observation is that phone-service interruption immediately precedes password resets and account logins. To test this interpretation, a reviewer should correlate telecom SIM-change records with account recovery and transaction history.

Incorrect Answers

A:

Deepfake onboarding deception would involve a different sequence from SIM-swap account takeover: synthetic audiovisual media can defeat naive identity checks without involving a genuine person. Unlike the rejected Deepfake onboarding deception label, the evidence concerns SIM-swap account takeover, since phone-service interruption immediately precedes password resets and account logins; reviewers should correlate telecom SIM-change records with account recovery and transaction history.

C:

Credential-stuffing identity abuse would involve a different sequence from SIM-swap account takeover: reused passwords let attackers impersonate customers through online credential abuse. Unlike the rejected Credential-stuffing identity abuse label, the evidence concerns SIM-swap account takeover, since phone-service interruption immediately precedes password resets and account logins; reviewers should correlate telecom SIM-change records with account recovery and transaction history.

D:

Child identity misuse would involve a different sequence from SIM-swap account takeover: children's identifiers can be exploited because misuse may remain unnoticed for years. Unlike the rejected Child identity misuse label, the evidence concerns SIM-swap account takeover, since phone-service interruption immediately precedes password resets and account logins; reviewers should correlate telecom SIM-change records with account recovery and transaction history.

Question 950

The case file describes the following: A retailer includes goods owned by suppliers and nonexistent units in its closing inventory figures. Which classification best explains the events?

  1. Inflated year-end inventory
  2. Fictitious sales entries
  3. Omitted related-party disclosure
  4. Unrecorded accrued liabilities

Explanation

Correct Answer

A:

Inflated year-end inventory fits the facts because overstated ending inventory usually understates cost of goods sold and inflates earnings; the distinguishing observation is that warehouse counts and ownership terms disagree with inventory listings. To test this interpretation, a reviewer should perform independent counts and test ownership and valuation of selected stock.

Incorrect Answers

B:

Fictitious sales entries would involve a different sequence from Inflated year-end inventory: recording invented transactions inflates revenue and assets without an underlying exchange. Unlike the rejected Fictitious sales entries label, the evidence concerns Inflated year-end inventory, since warehouse counts and ownership terms disagree with inventory listings; reviewers should perform independent counts and test ownership and valuation of selected stock.

C:

Omitted related-party disclosure would involve a different sequence from Inflated year-end inventory: even when amounts are recorded, withholding material relationship information can mislead statement users. Unlike the rejected Omitted related-party disclosure label, the evidence concerns Inflated year-end inventory, since warehouse counts and ownership terms disagree with inventory listings; reviewers should perform independent counts and test ownership and valuation of selected stock.

D:

Unrecorded accrued liabilities would involve a different sequence from Inflated year-end inventory: omitting obligations understates liabilities and costs rather than creating new cash resources. Unlike the rejected Unrecorded accrued liabilities label, the evidence concerns Inflated year-end inventory, since warehouse counts and ownership terms disagree with inventory listings; reviewers should perform independent counts and test ownership and valuation of selected stock.

Certified Fraud Examiner - Financial Transactions and Fraud Schemes (CFE - Financial Transactions and Fraud Schemes) Practice Tests