CFE-Fraud-Schemes-and-Financial-Crimes Exam Questions & Answers

Comprehensive and Detailed Explanation (Based on the ACFE Fraud Examiners Manual -- Financial Transactions and Fraud Schemes)

In the Identity Theft chapter of the Financial Transactions and Fraud Schemes section, the ACFE Manual explains that there are two primary methods of committing identity theft:

Traditional identity theft

Synthetic identity theft

These are listed under ''Methods of Committing Identity Theft'' (1.803), immediately followed by ''Types of Identity Theft Schemes'' (1.804) such as financial identity theft and criminal identity theft.

1. Why the correct answer is Traditional identity theft (Option B)

In traditional identity theft, the perpetrator uses the real, complete identity of another person---such as their name, government identification number, and birthdate---to impersonate that person for fraudulent purposes. This is exactly what is happening in the question:

The fraudster uses a real victim's name, government identification number, and birthdate to open a credit card account in the victim's name.

This matches the Manual's categorization where traditional identity theft involves misuse of actual personal identifying information (PII) belonging to a real individual, rather than fabricating an identity. The Manual then explains that this stolen identity is often used in financial schemes, such as obtaining credit cards, loans, or other financial benefits, which falls under financial identity theft as a type of identity theft scheme.

So, in ACFE terms, the method is traditional identity theft, and the scheme type is financial identity theft (using another person's identity to obtain credit or other financial benefits).

2. Why the other options are incorrect

Option A -- New account identity theft

''New account identity theft'' is a descriptive phrase sometimes used in practice to describe opening new credit accounts in another person's name, but the ACFE Manual's formal categorization focuses on:

Methods of committing identity theft:

Traditional identity theft

Synthetic identity theft

Types of identity theft schemes:

Financial identity theft

Criminal identity theft

Medical identity theft

Insurance identity theft

Tax identity theft

Employment identity theft

Business identity theft

''New account identity theft'' is not one of the defined method categories in the Manual; the described conduct is captured under traditional identity theft (method) and financial identity theft (scheme type). Therefore, this option does not align with the ACFE's terminology tested on the CFE exam.

Option C -- Synthetic identity theft

The Manual distinguishes synthetic identity theft as a different method. Under ''Methods of Committing Identity Theft'' (1.803), it explains that synthetic identity theft involves combining real elements of identity (for example, a genuine government identification number) with fabricated or unrelated information (such as a made-up name, date of birth, or address) to create a partly fictitious identity.

In the question, the fraudster is not creating a hybrid or composite identity. They are using all of the real victim's identifying information (name, government ID number, birthdate) and posing directly as that person. That is traditional, not synthetic.

Option D -- Criminal identity theft

Under ''Types of Identity Theft Schemes'' (1.804--1.805), the Manual describes criminal identity theft as a scheme where a fraudster gives someone else's identifying information to law enforcement or in criminal justice contexts, so that the victim's identity is attached to the criminal record or charges.

Typical examples include:

Giving another person's name and identification details when stopped or arrested

Causing warrants or criminal records to be issued in the victim's name

In the question scenario, the fraudster is not interacting with law enforcement or shifting criminal records to the victim. Instead, they are opening a credit card account, which is a financial use of the stolen identity. Therefore, it fits financial identity theft as a scheme type, but traditional identity theft as the method.

Rationale for Correct Answer:

Recognized schemes for stealing inventory include:

Larceny schemes (direct theft)

Asset requisition and transfer schemes (false requisitions to divert assets)

Purchasing and receiving schemes (over-ordering or falsifying deliveries).

''Sales & Equipment handling'' is not a defined fraud scheme, making D correct.

Analysis of Incorrect Options:

A . Larceny schemes -- Valid theft method.

B . Asset requisition and transfer -- Document manipulation method.

C . Purchasing and receiving schemes -- Valid misappropriation scheme.

Key Concept:

Inventory theft schemes under the Fraud Tree.

ACFE Fraud Examiners Manual (2020 International Edition), Inventory and Other Assets --- Theft Schemes.

Option D is correct because analytical review can reveal inventory theft when cost of goods sold changes disproportionately compared with sales. If inventory is stolen, the organization may experience higher inventory shrinkage or cost of goods sold without a corresponding increase in sales revenue. The ACFE material identifies analytical review, physical inventory counts, perpetual inventory records, and shipping-document review as methods for detecting inventory schemes. Option A is incorrect because analytical review can help identify unusual relationships or trends. Option B is weak because unchanged sales and unchanged cost of goods sold do not indicate a loss pattern. Option C is too absolute; changes in cost of goods sold must be evaluated in relation to sales, business conditions, and other explanations.

The correct answer is B. Register disbursement schemes usually involve false refunds or false voids that cause cash to be removed from the register while the records appear to justify the disbursement. An unusually high number of refunds on the register log is a red flag because it might indicate that employees are creating fictitious refund transactions to conceal cash theft. Option A is not suspicious by itself because no gaps in transaction numbers suggests record continuity. Option C is less suspicious because supervisory approval exists, although approvals should still be reviewed. Option D is generally a positive control because supporting documents should exist for voided transactions. The ACFE materials identify refund and void activity as key areas for detecting register disbursement schemes.

The correct answer is C. An unusually close or overly friendly relationship between an employee and a third-party contractor can be a red flag of corruption. Such relationships may indicate favoritism, undisclosed conflicts of interest, kickbacks, bid manipulation, or preferential treatment in procurement decisions. The behavior is not proof of wrongdoing, but it warrants further review when combined with unusual awards, pricing, sole-source justifications, weak documentation, or repeated business with the same vendor. Option A reflects proper restraint, not suspicious conduct. Option B suggests the employee is not benefiting from bribery-prone markets. Option D is generally positive because disclosure of conflicts allows the organization to evaluate and manage ethical risks. Red flags must be assessed in context with documents, transactions, and relationships.