CFE-Investigation ACFE Certified Fraud Examiner (CFE) - Investigation Free Practice Exam Questions (2026 Updated)

After alibis are diffused, suspects may become quiet, withdrawn, or even cry. This often indicates they are considering confession. At this point, the interviewer should present an alternative question, forcing a choice between two answers that both imply guilt, thus leading toward a benchmark admission.

When preparing for interviews, fraud examiners should avoid scripting detailed questions. Instead, they prepare notes of key points to cover.

From the Fraud Examiners Manual:

“Whenever possible, do not prepare a list of predetermined questions to ask the subject. The interview should flow freely. The interviewer might, however, want to develop a list of key points to cover during the interview”.

Therefore, the best preparation method is to note key points instead of detailed questions.

Social media content is dynamic—posts can be edited, deleted, or moved—so fraud examiners must preserve relevant information promptly and in a manner that supports authenticity and admissibility. CFE investigative guidance emphasizes that documentary (including digital) evidence carries limited value in legal proceedings unless it can be shown to be authentic and in substantially the same condition as when collected. Simply saving a link (Option A) is weak because the underlying content can change, and a link does not preserve what was actually observed. Requesting a copy from the platform (Option B) is often impractical as a routine step and may require legal process; it also does not replace contemporaneous preservation by the examiner. A “forensic shutdown” (Option C) is not an appropriate method for preserving web-based social media content because the key evidence exists on external servers, not solely on the examiner’s machine. Proper practice is to download/capture and preserve what was observed while documenting the collection steps and maintaining a defensible chain of custody so authenticity can be established if needed in court.

The Fraud Examiners Manual notes that predictive modeling and data analysis allow fraud examiners to detect fraud by using historical data to forecast future trends and anomalies. This matches option B.

The Fraud Examiners Manual lists specific queries for accounts payable analysis, including:

“Review recurring monthly expenses and compare to posted/paid invoices.”.

While comparing book vs. tax depreciation applies to asset management (not A/P), and identifying paycheck anomalies applies to payroll (not A/P), the most effective A/P-specific test is the recurring expense comparison. Hence, C is correct.

The 2014 International Fraud Examiners Manual states:

“The information contained on a wire transfer generally will include the following items:

• The amount of the transfer

• The date of the transfer

• The name of the sender or originator

• The routing number of the originating bank or financial institution.”

Therefore, the correct answer is C.

The CFE Prep – Investigations notes:

“Court records are best obtained from the jurisdiction in which they were filed… The most accurate records are maintained by the court of original jurisdiction, not global or aggregated databases.”

Thus, the best place for Sam is the local court of jurisdiction, not a global database.

The 2014 Fraud Examiners Manual and CFE Prep list common concealment methods:

“Some common techniques for hiding assets include transferring assets into foreign trusts, overpaying taxes, prepaying on a home mortgage, obtaining a life insurance policy, and transferring assets into someone else’s name.”

Thus, the correct answer is D.

The Fraud Examiners Manual explains that rather than drafting an exhaustive list of questions, the interviewer should:

“formulate a brief outline of key points to discuss during the interview”.

This helps organize thoughts while allowing flexibility.

The Fraud Examiners Manual states:

“Duplicate testing is used to identify transactions with duplicate values in specified fields … fields such as cheque numbers, invoice numbers, and government identification numbers … searching for duplicates within these fields can help the fraud examiner find anomalies that merit further examination”.

This directly addresses Tony’s need to ensure no two invoices have the same number.

“The locations of the subject’s residences and businesses (e.g., through analysing the payments of utility bills)… The cities and countries in which the subject conducts business (e.g., through analysing the payments for carrier services to deliver packages)”【6:2014 International Fraud Examiners Manual.pdf†L57-L77】.

They do not directly prove skimming or show market values of real estate.

The 2014 International Fraud Examiners Manual and CFE Prep - Investigations explicitly state:

“Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. … when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.”

Thus, the correct answer is C.

 “As a general rule, questioning should proceed from the general to the specific; it is best to seek general information before details. A variation… is to begin with known information and work towards unknown areas”【9:2014 International Fraud Examiners Manual.pdf†L39-L51】.

 Random order is not recommended and breaks the logical flow.

Admission-seeking interviews are designed:

“to obtain a legal admission of wrongdoing… also to distinguish innocent individuals from culpable ones and to secure a signed written statement”.

The primary purpose is obtaining a valid confession.

Best practices for admission-seeking interviews emphasize building rapport, presenting a morally acceptable reason, and maintaining empathy to encourage a confession. The manual states examiners should “present a morally acceptable reason for the suspect’s behavior” and avoid creating hostility . Minimizing empathy is counterproductive and not recommended.

The Fraud Examiners Manual explains:

“Textual analytics is a method of using software to extract usable information from unstructured text data… it can categorise data to reveal patterns, sentiments, and relationships indicative of fraud”.

This is the key reason fraud examiners analyze textual/unstructured data.

Fraud examiners must not opine on guilt, innocence, intent, or disposition. Reports should focus on facts and expert conclusions within their field. The Manual stresses:

“The fraud examiner should refrain from expressing opinions as to the guilt or innocence of any person or entity. Such conclusions are reserved for the trier of fact” (Fraud Examiners Manual, Reporting section).

Options A, B, and D relate to accounting and internal control assessments, which fall within an accounting expert’s scope. Only C is improper because it speculates about the suspect’s character or intent, which is outside the CFE’s role.

Explanation with Extracts = The 2014 Fraud Examiners Manual states:

“The EU Data Protection Directive … regulates the processing, using, and transferring of personal data within the European Union, and it places limits on transmitting personal data to non-EU countries”.

Therefore, a U.S.-based examiner handling HR data of an EU employee must comply with EU GDPR requirements.

The 2014 Fraud Examiners Manual and CFE Prep explain:

“Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.”

Thus, the correct answer is A.