ACFE CFE-Fraud-Schemes-and-Financial-Crimes Practice Exam Questions & Answers

Rationale for Correct Answer:

Address similarity reports are used to identify fraudulent disbursements by flagging payments sent to multiple vendors or payees at the same address. This helps detect fictitious payees or shell companies set up by fraudsters.

Analysis of Incorrect Options:

A . Duplicate payment lists -- Detects duplicate disbursements, not necessarily fictitious payees.

C . Exception reports -- Flag unusual transactions, but not specifically address similarities.

D . Electronic confirmations -- Used to verify balances or transactions, not detect fictitious vendors.

Key Concept: Detection of fraudulent disbursements.

Rationale for Correct Answer: Being prompted to install unfamiliar software is a red

Analysis of Incorrect Options:

A -- Standard security measure, not a red flag.

C -- Data from supplier countries is normal if consistent with business operations.

D -- Access denial to files outside a user's role is a normal access control, not an intrusion sign.

Key Concept: Cyberfraud detection -- identifying intrusion indicators.

The correct answer is A. A ghost employee scheme involves adding a fictitious or nonworking person to the payroll so the fraudster can collect wages or salary payments. Data analysis can help detect ghost employees by identifying duplicate, invalid, or suspicious employee information. Multiple employees using the same government or tax identification number is a strong red flag because legitimate employees should generally have unique identifying numbers. Payment tampering involves altering payments after they are initiated, while falsified hours and salary schemes usually involve overstated time worked or unauthorized pay-rate changes for real employees. Fraudulent commission schemes involve manipulating sales or commission records. The ACFE materials specifically identify duplicate government identification numbers as a test for ghost employee schemes.

Rationale for Correct Answer:

Comparing register tape totals to the actual cash on hand is a classic reconciliation test used to detect employee theft. Discrepancies suggest cash has been skimmed or stolen after recording.

Analysis of Incorrect Options:

B . Recorded sales -- Register tapes already show recorded sales; comparison is for theft detection.

C . Internal audits -- A process, not the purpose of the comparison.

D . Occupational frauds -- Too broad a term.

Key Concept:

Cash Reconciliation as a control to detect employee theft.

ACFE Fraud Examiners Manual (2020 International Edition), Cash Receipts --- Detection Methods for Skimming and Larceny.

The correct answer is D. Traditional identity theft involves using the real identifying information of another person to impersonate that individual. Here, the fraudster uses another person's actual name and picture to create a social media profile, meaning the fraudster is posing directly as a real person rather than creating a hybrid or fictitious identity. Synthetic identity theft combines real and fabricated information to create a new identity, which is not described here. Criminal identity theft involves using another person's identity in a law enforcement or criminal justice context. New account identity theft is not the best ACFE category for this question because the facts emphasize impersonation using real identity information. The ACFE materials distinguish traditional identity theft from synthetic and criminal identity theft.