CFE-Fraud-Schemes-and-Financial-Crimes ACFE Certified Fraud Examiner -Fraud Schemes and Financial Crimes Free Practice Exam Questions (2026 Updated)

The correct answer is D. Users being denied access to files they normally use is a significant indicator of possible network intrusion. Such denial might result from unauthorized permission changes, malware, ransomware encryption, account compromise, or malicious alteration of access controls. In a professional fraud examination context, this condition should trigger immediate incident-response procedures, including review of system logs, firewall records, router logs, and affected files. Options A and C describe routine security and system maintenance activities. Option B is not inherently suspicious because the country has a legitimate client connection. The ACFE computer and internet fraud materials emphasize that compromised systems should be treated as suspect and reviewed for irregularities and abnormal activity.

================

Detailed Explanation:

Rationale for Correct Answer: A high percentage of coding outliers (e.g., using higher-paying diagnosis or procedure codes more often than peers) is a red flag of upcoding or fraudulent billing. This signals possible abuse of reimbursement systems.

Analysis of Incorrect Options:

A – Fewer claims would not suggest fraud.

C – Matching documentation is expected, not suspicious.

D – Low profits may indicate inefficiency, not fraud.

Key Concept: Health care fraud detection through data analytics and coding anomalies.

Detailed Explanation:

Rationale for Correct Answer: This is unbundling , where services that should be billed under a single comprehensive code are split into multiple components to inflate reimbursement.

Analysis of Incorrect Options:

A. Fictitious services – Charging for services not performed.

B. False diagnosis – Fabricating diagnoses to justify billing.

C. Upcoding – Billing for more expensive services than provided.

Key Concept: Health care billing fraud — unbundling .

Detailed Explanation:

Rationale for Correct Answer: A kickback scheme occurs when vendors make payments to employees of a purchasing organization in exchange for steering business their way. Here, Bob steered contracts to Oak Company and received a percentage of profits, a textbook kickback arrangement.

Analysis of Incorrect Options:

B. Illegal gratuity scheme – Involves rewards after a decision, without a prior agreement. Here, the agreement was prearranged.

C. Diversion scheme – Refers to diversion of assets, not procurement favoritism.

D. Economic extortion scheme – Involves coercion of the vendor; this was voluntary bribery.

Key Concept: Bribery and kickbacks as forms of corruption.

Detailed Explanation:

Rationale for Correct Answer: Bid tailoring occurs when procurement officials structure contract requirements to unfairly favor a particular vendor. A hallmark red flag is unusually narrow specifications , which restrict competition.

Analysis of Incorrect Options:

A. Clear submission information – Standard and appropriate, not a red flag.

C. Rebid contracts – Could indicate limited interest, but not tailoring.

D. Numerous bidders – Indicates competition, opposite of bid tailoring.

Key Concept: Procurement fraud — bid tailoring .

The correct answer is A. A forged filing scheme occurs when bankruptcy documents are filed using forged information, often through stolen identities or assumed identities. In such cases, a fraudster files for bankruptcy in another person’s name, which can damage the victim’s credit record and create serious legal and financial problems. The ACFE bankruptcy fraud materials specifically describe bankruptcy petitions filed with forged documents and stolen identities. Option B is more consistent with false billing or inventory-related fraud. Option C is closer to a planned bustout, where a debtor obtains goods on credit and then disposes of them before bankruptcy. Option D is related to money laundering or insurance fraud, not forged bankruptcy filing.

================

Shirley has most likely been victimized by a romance scheme. In romance, sweetheart, or friendship scams, the fraudster builds an emotional relationship with the victim, often through social networking or online communication, and then requests money under a sympathetic pretext. Simon befriends Shirley, creates expectations of a future meeting, claims financial hardship, receives $10,000, and then disappears. That pattern is typical of a romance scam. A grandparent scheme usually involves impersonating a grandchild or relative in distress. A bait-and-switch scheme involves advertising one product or service and substituting another. A vacation scheme would focus on fraudulent travel offers, not a fabricated romantic relationship used to obtain money. The ACFE material identifies romance and friendship sc hemes as consumer fraud schemes.

================

Detailed Explanation:

Rationale for Correct Answer: Disclosure is required whenever individuals in positions of trust are indicted or otherwise compromised. Transparency ensures stakeholders are aware of potential conflicts or risks.

Analysis of Incorrect Options:

A. Conflict of interest – A scheme, not the corrective measure.

B. Turnaround sale or flip – Specific scheme, irrelevant here.

D. Resource diversion – A fraud method, not a governance requirement.

Key Concept: Importance of Disclosure in preventing or responding to conflicts of interest.

Detailed Explanation:

Rationale for Correct Answer: Comparing register tape totals to the actual cash on hand is a classic reconciliation test used to detect employee theft . Discrepancies suggest cash has been skimmed or stolen after recording.

Analysis of Incorrect Options:

B. Recorded sales – Register tapes already show recorded sales; comparison is for theft detection.

C. Internal audits – A process, not the purpose of the comparison.

D. Occupational frauds – Too broad a term.

Key Concept: Cash Reconciliation as a control to detect employee theft.

Detailed Explanation:

Rationale for Correct Answer: This statement is False . Research in occupational fraud consistently shows that when employees believe there is a strong likelihood of being caught, they are less likely to engage in theft or deviant behavior. Deterrence theory emphasizes that perceived certainty of detection is one of the most effective controls against occupational fraud.

Key Concept: Deterrence through perceived detection .

The correct answer is D. Procurement fraud prevention requires ongoing vendor monitoring based on the organization’s highest-risk vendor schemes. Monitoring should focus on practical red flags, such as unusual pricing, duplicate vendors, related-party indicators, excessive change orders, suspicious payment patterns, or vendors lacking proper support. Option A violates segregation of duties because the person maintaining the vendor master file should not also approve invoice payments. Option B is weak because vendor background checks should occur before vendors are added to the master file, not after. Option C is incorrect because procurement monitoring should be ongoing and risk-based, not restricted to annual reviews. The ACFE material emphasizes vendor management, vendor master file controls, and monitoring based on relevant red flags.

================

The correct answer is D. In a bid manipulation scheme, a procuring employee improperly influences the bidding process to benefit a favored contractor. One common method is restricting or eliminating legitimate competitors so the preferred vendor has a greater chance of winning. Disqualifying bids that were submitted correctly is a direct manipulation of the competitive process because it removes valid bidders without a proper basis. Charging impermissible costs is more closely related to cost mischarging. Using low-quality materials relates to nonconforming goods or services. Opening the bidding process at the designated time is a proper procurement activity, not fraud. The ACFE material explains that bid manipulation occurs when a corrupt procurement employee affects contractor selection by restricting competition.

================

The correct answer is C. Change order abuse occurs after a contract has been awarded, when a contractor improperly increases the price, expands the work, or modifies contract terms through change orders. A corrupt contractor might submit a low bid to win the award and later recover profits through unnecessary or inflated change orders. This defeats the benefit of competitive bidding because the procuring entity no longer receives the price or terms that justified the original award. Option A is incorrect because the scheme usually increases, not decreases, the amount paid. Option B is too narrow because change order abuse can occur in competitive contracts. Option D is incorrect because the scheme often involves collusion between contractor and procurement personnel, not necessarily several contractors.

================

The correct answer is D. Supervisor authorization of overtime and verification of hours worked are strong preventive controls against payroll fraud, especially falsified hours and salary schemes. Payroll fraud frequently occurs when employees overstate hours, submit unauthorized overtime, manipulate time records, or receive pay for time not worked. Supervisory review creates accountability and provides an independent check before payroll is processed. Option A is improper because payroll preparation and bank reconciliation should be segregated. Option B is not recommended because direct deposit can reduce paycheck theft and distribution risks. Option C is weak because allowing coworkers to collect paychecks can create opportunities for misappropriation. The ACFE materials identify overtime authorization and payroll review as important payroll fraud controls.

================

The correct answer is C. An unusually close or overly friendly relationship between an employee and a third-party contractor can be a red flag of corruption. Such relationships may indicate favoritism, undisclosed conflicts of interest, kickbacks, bid manipulation, or preferential treatment in procurement decisions. The behavior is not proof of wrongdoing, but it warrants further review when combined with unusual awards, pricing, sole-source justifications, weak documentation, or repeated business with the same vendor. Option A reflects proper restraint, not suspicious conduct. Option B suggests the employee is not benefiting from bribery-prone markets. Option D is generally positive because disclosure of conflicts allows the organization to evaluate and manage ethical risks. Red flags must be assessed in context with documents, transactions, and relationships.

================

Detailed Explanation:

Rationale for Correct Answer: This statement is False . According to ACFE studies, asset misappropriation is the most common but least costly category of occupational fraud. Fraudulent statements are the least common but most costly, while corruption falls in the middle in both frequency and cost.

Key Concept: Fraud Tree Statistics — frequency and cost comparison of asset misappropriation, corruption, and financial statement fraud.

Detailed Explanation:

Rationale for Correct Answer: An underring occurs when an employee intentionally enters a lower sales amount into the register than what was collected from the customer. The difference is pocketed by the employee. This is a common register manipulation skimming scheme.

Analysis of Incorrect Options:

B. Recording a sale procedure – General process, not fraud.

C. Internal sales audits – Control activity, not the fraud scheme.

D. All of the above – Incorrect, since only “underring” is accurate.

Key Concept: Underring schemes in cash register fraud.

Detailed Explanation:

Rationale for Correct Answer: Misrepresenting income, employment, or creditworthiness on a mortgage application is a classic example of residential loan fraud . This type of fraud occurs when borrowers provide false information to qualify for loans they would not otherwise receive.

Analysis of Incorrect Options:

B. Credit data blocking – Refers to suppressing negative credit information with fraudulent disputes.

C. Double-pledging collateral – Involves using the same collateral for multiple loans.

D. Linked financing – Occurs when loans are structured with related transactions to disguise financial exposure.

Key Concept: Loan and mortgage fraud – misrepresentation of borrower information.

The required element is that the investment is in a common enterprise. The ACFE material explains that the investment-contract analysis parallels the Howey test, under which all required elements must exist: an investment of money or other assets, a common enterprise, an expectation of profit, and profits derived primarily from the efforts of others. Option A is incorrect because profits must come from the efforts of people other than the investor, not solely from the investor’s own management efforts. Option B is too narrow because the investment may involve money or another asset. Option C is incorrect because notarization is not an element of an investment contract. Therefore, the common-enterprise requirement makes option D correct.

================