CFE-Fraud-Schemes-and-Financial-Crimes ACFE Certified Fraud Examiner -Fraud Schemes and Financial Crimes Free Practice Exam Questions (2026 Updated)

The correct answer is B. A request to send payment to a country different from where the third party conducts business is a significant red flag in corruption and bribery schemes. Such payment instructions can indicate attempts to conceal beneficial ownership, route funds through offshore accounts, disguise improper commissions, or make corrupt payments difficult to trace. Option A is not necessarily suspicious because many legitimate vendors use one business address and phone number. Option C can reflect legitimate competitive strength if the vendor truly provides superior services. Option D is also not inherently suspicious because lower prices may result from efficiency or market strategy. Fraud examiners should treat unusual third-party payment destinations as high-risk indicators requiring enhanced due diligence and documentation review.

================

Detailed Explanation:

Rationale for Correct Answer: Materiality is most often associated with fraudulent financial statements because fraudsters may argue that misstatements are “immaterial.” However, deliberate misstatements of any size can be fraudulent. Materiality thus plays a critical role in assessing fraudulent statement cases .

Analysis of Incorrect Options:

B. Misappropriations – Involve theft, but materiality is less central than in reporting fraud.

C. Civil lawsuit – A possible outcome, not the core accounting issue.

D. Quality control – Not related to materiality in fraud.

Key Concept: Materiality in Financial Statement Fraud — even small misstatements may be fraudulent.

The correct answer is D. Carl committed electronic payment tampering because he used stolen online banking credentials to create an unauthorized recurring electronic payment. Electronic payment tampering involves manipulating electronic disbursement systems, online banking portals, ACH transactions, wire transfers, or related payment credentials to divert funds. Although Carl uses a disguised bank account, the central misconduct is the unauthorized creation of an electronic payment, not a traditional billing scheme. A diverted revenue scheme concerns incoming receipts rather than outgoing payments. A ghost payee scheme can involve fictitious recipients, but here the best classification is electronic payment tampering because the fraud is executed through the company’s online banking system. The ACFE materials classify electronic payment tampering under fraudulent disbursement schemes.

================

Rationale for Correct Answer: Fraud investigations can be highly costly to organizations. The process often involves external forensic examiners, legal proceedings, employee time, and disruption of operations. While necessary, investigations represent a significant resource commitment in terms of both time and financial cost.

Key Concept: Fraud Investigation Costs — deterrence vs. response strategies.

The correct answer is C. Trade-based money laundering uses international trade transactions to disguise or move illicit value. A common method is misinvoicing, where colluding importers and exporters overstate or understate the price, quantity, or quality of goods. When goods are invoiced above market value, value can be transferred from the importer to the exporter under the appearance of a legitimate commercial payment. Option A involves laundering through virtual or digital assets, not trade-based laundering. Option B describes use of a front business, particularly a cash-intensive business, to mix illegal proceeds with legitimate revenue. Option D describes structuring or smurfing through small transfers. The international invoice manipulation in option C is the strongest example of trade-based money laundering.

================

The correct answer is A. The facts indicate a possible nonconforming goods scheme, in which a vendor provides goods that fail to meet contract specifications while charging as though compliant goods were supplied. The most effective detection measure before customer complaints would have been an inspection of the glass upon receipt, including its packaging, appearance, description, and conformity with the contract. This control helps identify substitutions, inferior materials, counterfeit goods, or products of lower quality than promised. Option B is indirect and less reliable than inspecting the goods. Option C relates to change order abuse rather than quality substitution. Option D focuses on the vendor’s internal cost data and would not directly confirm whether the delivered glass met CTR’s contract specifications.

Card-not-present fraud occurs when payment card information is used without the physical card being presented, commonly in online transactions. Comparing IP addresses for internet orders with those used in previous orders by the same customer is the most effective detection measure listed because it helps identify unusual access patterns. If an order is placed from an unfamiliar or suspicious IP address inconsistent with the customer’s historical activity, it can indicate unauthorized use of stolen card data. Small orders from new accounts might be suspicious but are less reliable alone. Declining rush shipping is not a typical fraud indicator, and purchasing several unique items is not necessarily suspicious. The ACFE materials identify payment card fraud and card-not-present transactions as key payment fraud risks.

================

Detailed Explanation:

Rationale for Correct Answer: Expenses appear on the income statement , not the balance sheet. The balance sheet includes assets, liabilities, and owners’ equity, representing the accounting equation.

Analysis of Incorrect Options:

A, B, D – All appear on the balance sheet.

Key Concept: Distinction between financial statements: balance sheet vs. income statement.

The correct answer is A. Financial statement disclosures are required when information is necessary for users to understand the entity’s financial position and risks. Potential losses from ongoing litigation generally must be disclosed when the likelihood of loss is reasonably possible, even if the amount is not yet certain. Option B is incorrect because significant subsequent events after the reporting period might require disclosure. Option C is incorrect because changes in accounting principles must generally be disclosed to preserve comparability and transparency. Option D is too narrow because related-party transactions require disclosure when material or relevant, not only when they financially harm stakeholders. The ACFE financial statement fraud materials identify improper disclosures, concealed liabilities, subsequent events, and related-party transactions as important fraud risk areas.

Detailed Explanation:

Rationale for Correct Answer: For fraud to exist, several legal elements must be established. These include: (1) a material false statement made by the perpetrator, (2) knowledge of the falsity of that statement (scienter or intent to deceive), and (3) reliance on the false statement by the victim, resulting in harm or damages. The Fraud Examiners Manual (2020 International Edition) explains that all elements must be present for a fraud case to be sustained. Thus, the correct answer is D. All of the above .

Analysis of Incorrect Options (Distractors):

A. A material false statement – A false statement alone is insufficient unless there is intent to deceive and victim reliance.

B. Knowledge that the statement was false when it was uttered – Intent is critical, but without the victim’s reliance and damages, fraud is incomplete.

C. Reliance on the false statement by the victim – Victim reliance is necessary, but without a knowingly false statement and intent, fraud cannot be proven.

Key Concept: The essential legal elements of fraud.

Detailed Explanation:

Rationale for Correct Answer: Fraudsters typically change the contact information (e.g., phone number, email) to prevent the true account holder from receiving alerts about suspicious activity. Leaving the contact information unchanged would risk detection. Thus, option B is NOT a common fraudster tactic.

Analysis of Incorrect Options:

A – True; fraudsters steal funds or make purchases.

C – True; known as “credential stuffing” or account chaining.

D – True; phishing is a primary way to obtain credentials.

Key Concept: Cyber-enabled fraud – account takeover schemes.

Detailed Explanation:

Rationale for Correct Answer: In double-entry accounting, a debit increases assets and expenses while decreasing liabilities and equity. Debits are entries on the left side of an account.

Analysis of Incorrect Options:

A. Journal Entries – General record of transactions, not the specific effect.

C. Credit – Opposite effect: increases liabilities/equity, decreases assets/expenses.

D. None of all – Incorrect because “debit” is the recognized effect.

Key Concept: Debit rules in double-entry accounting.

Guillermo’s conduct is best described as research misconduct because he fabricated data points to make his research appear more successful and to preserve grant funding. Research misconduct commonly includes fabrication, falsification, or plagiarism in proposing, performing, reviewing, or reporting research. The key fact is that Guillermo created data that did not exist and presented it as research support. Fraudulent concealment generally involves hiding material facts, not creating false research data. Fictitious claims fraud involves submitting false claims for payment, usually to a government or program, but the question focuses on the falsification of research results. Inducement fraud is broader and less precise. Because the false data directly affects the integrity of a funded study, research misconduct is the best answer.

================

Detailed Explanation:

Rationale for Correct Answer: Illegal pyramid schemes rely on continual recruitment of new members. Early participants are paid from the investments of later recruits, meaning later participants almost always lose money. This matches option B.

Analysis of Incorrect Options:

A – Not true; pyramid-shaped hierarchies exist in legitimate organizations.

C – The goal isn’t product sales but rather recruitment; products, if present, are often incidental.

D – Incorrect because B is true.

Key Concept: Ponzi and pyramid schemes – payment to early investors with later investors’ funds.

Detailed Explanation:

Rationale for Correct Answer: Management may overstate financial statements to (B) meet performance criteria, (C) trigger bonuses/compensation, or (D) show growth to enhance valuation for sale. However, when seeking to comply with debt covenants , management typically understates liabilities or expenses — not overstates performance. Thus, A is not aligned with overstatement motives.

Analysis of Incorrect Options:

B, C, D – All are recognized motives for overstating business performance.

A. Comply with debt covenants – More linked to manipulation of liabilities (often understatement), not overstatement of revenue.

Key Concept: Motives for overstatement in financial statement fraud.

Detailed Explanation:

Rationale for Correct Answer: Gross profit = Net sales – Cost of Goods Sold (COGS). This is the correct definition, as per standard accounting principles.

Analysis of Incorrect Options:

A. Gross revenue – Defined as total sales before deductions, not after.

B. Net profit – Net profit is after all expenses (operating, interest, taxes), not before.

D. Operating expenses – Appear after gross profit, not at the top.

Key Concept: Income statement structure and key definitions .

Detailed Explanation:

Rationale for Correct Answer: Skimming is the theft of incoming cash before it is recorded in the books . Since the payment is never recorded, no audit trail exists, making it an “off-book” scheme.

Analysis of Incorrect Options:

A – Incorrect; skimming can involve both sales and receivable payments.

C – Incorrect; skimming is off-book , not on-book.

D – Incorrect; skimming is typically harder to detect than larceny, since there is no record.

Key Concept: Skimming vs. larceny – off-book theft of cash receipts.

The correct answer is A. Creating answers to security questions using unique, nonpublic details helps prevent identity thieves from bypassing account protections. Many security-question answers, such as a mother’s maiden name, school name, pet name, or birthplace, can be discovered through social media, public records, or data breaches. Using answers that cannot be easily verified through public sources makes account recovery processes harder to exploit. Option B is weak because passwords and passphrases should not be reused across accounts at all. Option C is unsafe because email can be intercepted or misdirected, even when contacting reputable organizations. Option D is inadequate because moving files to the recycle bin does not securely erase data from a device before disposal.

================

The correct answer is D. Smishing is phishing conducted through SMS or text messages. Margarette sends a fraudulent text that appears to come from Arlo’s doctor’s office and includes a payment link to a fake portal she controls. The purpose is to trick Arlo into entering payment card information, which she then steals. Quishing uses QR codes to direct victims to fraudulent sites. Pharming redirects users from legitimate websites to fraudulent ones, often through technical manipulation of domain name resolution or device settings. Vishing uses voice calls or voicemail to obtain sensitive information. Because the fraudulent communication is a text message and the goal is to steal payment information, the scheme is smishing.