Fraud IQ Test

Test your anti-fraud IQ by answering practice questions covering material from the CFE Exam.

  • June
  • May
  • April
  • March
  • February
  • January


IQ #1 - During a U.S. criminal trial involving allegations of corruption, the prosecution introduces a diagram illustrating the organizational structure of a company allegedly involved in the corruption. The diagram is an example of:
  1. Direct evidence
  2. Real evidence
  3. Demonstrative evidence
  4. Documentary evidence
View Answer
There are three basic forms, as distinguished from types, of evidence: testimonial, real, and demonstrative. Testimonial evidence refers to the oral statements made by witnesses under oath. Real evidence refers to physical objects that played a part in the issues being litigated. Demonstrative evidence is a tangible item that illustrates some material proposition (e.g., a map, chart, or summary). Demonstrative evidence differs from real evidence in that demonstrative evidence was not part of the underlying event; it was created specifically for the trial. Its purpose is to provide a visual aid for the fact finder. Nonetheless, demonstrative evidence is evidence and can be considered by the fact finder in reaching a verdict. Correct Answer: (C)

IQ #2 - Baron is currently being prosecuted for financial statement fraud for allegedly intentionally over-reporting earnings. Although Baron did over-report income, he did not do so on purpose. Under these facts, which of the following defenses, if any, would likely benefit Baron as a defense?
  1. Mistake
  2. Ignorance
  3. Duress
  4. None of the above
View Answer
A defense is an assertion by a defendant in a criminal or civil suit that seeks to explain away guilt or civil liability for damages. The facts indicate that Baron lacked the intent to over-report earnings, and that his doing so was a mistake. In some situations, mistake may be used as a defense.

Other common defenses in criminal cases include: alibi, consent, de minimis infraction (trivial), duress, entrapment, ignorance, mistake, insanity, necessity, protection of property, self-defense, public duty, legal impossibility, and protection of others. Also pertinent in the matter of defense are questions involving statutes of limitations, proper venue, and proper jurisdiction.
Correct Answer: (A)

IQ #3 - White is an expert testifying in a complicated securities fraud case in the United States. In preparing her report, White relied to a large extent on Publication A, a market analysis report that is commonly used by experts in her field. The judge has declared that Publication A cannot be admitted into evidence in the trial at hand. This means any testimony White has that is based on Publication A is also excluded.
  1. True
  2. False
View Answer
Rule 703 of the U.S. Federal Rules of Evidence says that an expert may testify based on facts that are disclosed at or before the hearing in which the expert testifies. The facts need not themselves be admissible in evidence as long as they are of a type reasonably relied upon by experts in a particular field. This rule allows an expert to employ data usually used by experts in the field, though the data itself may not be admissible. For example, an expert may rely on a table of interest rates taken from a Department of Commerce publication even if the table is not admissible. Similarly, an accountant serving as an expert witness may rely on private sources in forming an opinion if such sources normally are relied upon by accountants. Correct Answer: (B)


IQ #1 - Anna works as a cashier in an antiques store. Since the merchandise lacks barcodes, she has to enter the prices manually. One customer purchased a piece of furniture that cost $250 and paid in cash. Anna recorded the sale at $200 and pocketed the $50 bill. What type of fraud did Anna commit?
  1. An unrecorded sales (skimming) scheme
  2. An understated sales (skimming) scheme
  3. A cash larceny scheme
  4. Lapping of receivables
View Answer
Understated sales schemes are commonly undertaken by employees who work at the cash register. In a typical scheme, an employee enters a sales total that is lower than the amount actually paid by the customer. The employee skims the difference between the actual purchase price of the item and the sales figure recorded on the register. In this case, the item was sold for $250, but Anna rang up the sale of a $200 item and skimmed the excess $50.
Rather than reduce the price of an item, an employee might record the sale of fewer items. If 100 units are sold, for instance, an employee might only record the sale of 50 units and skim the excess receipts. Correct Answer: (B)

IQ #2 -Julia, a fraud examiner, is performing tests to look for potential asset misappropriation schemes at her company. One of her routine tests is to compare the payroll records to the human resources files. What type of fraud scheme is she most likely looking for when performing this test?
  1. A ghost employee scheme
  2. A check tampering scheme
  3. A falsified hours and wages scheme
  4. A fraudulent commissions scheme
View Answer
Comparing personnel records maintained by the human resources department to payroll data can be useful in detecting ghost employee schemes. The term ghost employee refers to someone on the payroll who does not actually work for the victim company. Through the falsification of personnel or payroll records, a fraudster causes paychecks to be generated to a non-employee, or ghost. For example, comparing employee names, addresses, government-issued identifications, and bank account numbers can determine if there are any unexpected duplicates or discrepancies that would indicate a ghost on the payroll. Correct Answer: (A)

IQ #3 - To help detect cash larceny, the person responsible for collecting incoming cash should also prepare the bank deposits.
  1. True
  2. False
View Answer
The primary means of preventing cash fraud is separation of duties. Whenever one individual has control over the entire accounting transaction (e.g., authorization, recording, and custody), the opportunity is present for cash fraud. Each of the following duties/responsibilities should be separated:
  • Cash receipts
  • Bank deposits
  • Bank reconciliation
  • Cash disbursements
If one person has the authority to collect the cash, deposit the receipts, record that collection, and disburse company funds, the risk is high that fraud can occur. Correct Answer: (B)


IQ #1 - Black, a fraud examiner, is conducting textual analytics on emails sent to and from specific employees that his client has identified as fraud suspects. He is using the Fraud Triangle to come up with a list of fraud keywords to use in his search. Which of the following words found in email text might indicate a fraudster is rationalizing his actions?
  1. Quota
  2. Write off
  3. Override
  4. Deserve
View Answer
In conducting a textual analytics examination, the fraud examiner should come up with a list of fraud keywords that are likely to point to suspicious activity. This list will depend on the industry, the suspected fraud schemes or types of fraud risk present, and the data set the fraud examiner has available. In other words, if he is running a search through journal entry details, he will likely search for different fraud keywords than if he were running a search of emails.

The factors identified in the Fraud Triangle are helpful when coming up with a fraud keyword list. One of these factors is rationalization; consequently, the fraud examiner should consider how someone in the entity might be able to rationalize committing fraud. Because most fraudsters do not have a criminal background, justifying their actions is a key part of committing fraud. Some keywords that might indicate a fraudster is rationalizing his actions include reasonable, deserve, and temporary.

Other keywords can be used to identify the other factors indicated by the fraud triangle. For example, write off and override would indicate opportunity to commit fraud, while quota suggests pressure to commit fraud.
Correct Answer: (D)

IQ #2 - In interview situations, it is sometimes recommended that the interviewer shake hands with the respondent. What is the purpose of this?
  1. To establish the interview purpose
  2. To break down psychological barriers
  3. Social courtesy
  4. Professional courtesy
View Answer
In some cultures, it is recommended to make physical contact with the person being interviewed by shaking hands. Making physical contact helps break down psychological barriers to communication. The interviewer should not invade the respondent's personal space; however, as this might make the person uncomfortable. The interviewer uses body language to create the impression of trust during the interview by gesturing openly with the arms, clasping hands together, and leaning forward in a manner to indicate interest. Rapport can be established through verbal techniques by using soft words, agreeing with the respondent, and avoiding negative terms.

Correct Answer: (B)

IQ #3 - Forensic analysis should not be performed directly on suspect devices because doing so can alter or damage digital evidence.
  1. True
  2. False
View Answer
Once a computer system is seized and before any analysis occurs, it should be imaged for analysis. Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence. Imaging the data from suspect devices allows a fraud examiner to view and analyze a computer's contents without altering the original data in any way.

Imaging refers to the process whereby a forensic image of a hard drive or other digital media is made and imaged to another hard disk drive or other media for forensic analysis. A forensic image (also called a forensic copy, mirror image, or ghost image) is an image or exact, sector by sector, copy of a hard drive or other digital media.
Correct Answer: (A)


IQ #1 - In most common law jurisdictions, for a document to be admitted into evidence, it must be properly __________; that is, the party offering the document must produce some evidence to show it is, in fact, what the party says it is.
  1. Marked
  2. Authenticated
  3. Validated
  4. Certified
View Answer
In common law systems using adversarial processes (such as the United States), exhibits—the tangible objects presented as evidence—are inadmissible unless they are relevant and established as authentic. Thus, to be admissible at trial, evidence, other than testimonial evidence, must be properly authenticated; that is, the party offering the item must produce some evidence (e.g., testimony from a person with firsthand knowledge) to show it is, in fact, what the party says it is and to show it is in the same condition as when it was seized. If an exhibit cannot be authenticated, the evidence will not be admitted even if it is plainly relevant. Correct Answer: (B)

IQ #2 - Maria, a successful restaurateur, has been informed of an unusually attractive investment opportunity by a recent acquaintance and decides to invest in it. Several months and a couple of underwhelming payments later, Maria grows frustrated with the diminishing disbursements and attempts to withdraw her money. After several weeks of delay, she realizes that the promoter seems to have vanished, along with her investment. Maria is the victim of which of the following fraudulent ploys?
  1. An illegal pyramid
  2. A fly and buy scheme
  3. A Ponzi scheme
  4. A dog and pony scam
View Answer
A Ponzi scheme is generally defined as an illegal business practice in which new investors’ money is used to make payments to earlier investors. The investment opportunity is typically presented with the promise of uncommonly high returns. While the scam is presented as a legitimate investment, there is little or no actual commerce involved. When an enterprise promotes an investment opportunity that invests little or none of the participants’ money and uses new investments to make dividend payments, the promoters are running a Ponzi scheme. Correct Answer: (C)

IQ #3 - A U.S. bankruptcy court appoints an examiner to investigate allegations that the debtor in the proceeding has committed fraud. Under the bankruptcy laws, this appointment gives the examiner the power to run the debtor’s business and submit a reorganization plan.
  1. True
  2. False
View Answer
In the context of bankruptcy proceedings in the United States, an examiner is a neutral party appointed by the bankruptcy court to investigate and report on relevant matters to Chapter 11 bankruptcy cases. An examiner is normally appointed in a bankruptcy proceeding to investigate certain allegations of fraud and misconduct on the part of the debtor (or principals of the debtor). Typically, a bankruptcy examiner is appointed when creditors, the Office of the UST, or other interested parties file a motion for the appointment of a trustee or an examiner in which allegations of fraud or misconduct are made. A bankruptcy judge will hold a hearing on the motion, and during the hearing, he will hear the evidence submitted by all filing parties (creditors, et al.), as well as the debtor’s response to the allegations. After hearing the evidence, the judge has the option to either appoint a trustee or an examiner, or leave the debtor in possession of the business—a decision that hinges on what is best for the interested parties. If an examiner is appointed, his sole responsibility is to “investigate and report” the results of the investigation to the court and other parties in interest as quickly as possible. Examiners have the power to subpoena records and depose witnesses. They do not have the power to run businesses, make business decisions, or propose plans of reorganization (generally speaking). Courts may expand the examiner’s powers to perform certain duties of trustees or debtors-in-possession. Correct Answer: (B)


IQ #1 - In a/an _____________ scheme, the company that initially conned a consumer contacts that consumer and offers to help retrieve the lost money. However, the investigation requires an upfront fee and the consumer is swindled again.
  1. Advance fee
  2. Retrieval
  3. Double-hustle
  4. Scavenger
View Answer
The scavenger or revenge scheme involves the company that initially conned the consumer. Using a different company’s name, the outfit contacts the consumer again and asks if he would like to help put the unethical company out of business and get his money back. Naturally, an upfront fee is required to finance the investigation. Correct Answer: (D)

IQ #2 - Frank has recently opened several checking accounts, all with different banks. Frank’s plan is to take advantage of each bank’s delayed posting by continually swapping checks from one account to another to create the false impression that there is money available in each account. Frank’s ploy is known as which of the following?
  1. Check washing
  2. Check kiting
  3. Check ring
  4. Check skimming
View Answer
In a check kiting scheme, multiple bank accounts are opened and money is “deposited” from account to account; however, the money never exists. Floating makes check kiting possible. Floating is the additional value of funds generated in the process of collection and arises because the current holder of funds has been given credit for the funds before the check clears the financial institution upon which it is drawn. Businesses are most susceptible to check kiting if they have employees who are authorized to write checks or make deposits in more than one bank account. Today, check kiting is more difficult because technology allows for a much shorter float period. Correct Answer: (B)

IQ #3 - In double-entry accounting, every transaction in the accounting records will have both a debit and a credit side, and these sides will always be equal.
  1. True
  2. False
View Answer
True. Entries to the left side of an account are debits, and entries to the right side of an account are credits. Debits increase asset and expense accounts, while credits decrease them. Conversely, credits increase liability, owners’ equity, and revenue accounts; debits decrease them. Every transaction recorded in the accounting records will have both a debit and a credit, thus the term double-entry accounting. The debit side of an entry will always equal the credit side so that the accounting equation remains in balance. Correct Answer: (A)


IQ #1 - Bailey, a Certified Fraud Examiner in an adversarial system, is being cross-examined in court on his expert opinion relating to a fraud matter. Darwin, a defense attorney, asks Bailey a question that is phrased in an overly and unnecessarily complex manner. Which of the following is the best way for Bailey to respond?
  1. Avoid answering the question by talking about something else.
  2. Ask the judge for a recess.
  3. Request that the question be rephrased.
  4. Object to the question phrasing.
View Answer
Generally, witnesses should never give away or volunteer free information during cross-examination in adversarial proceedings. When providing an answer during cross-examination, it might be difficult to avoid getting trapped in various assumptions, what-if scenarios, and generalities presented by counsel. Opposing counsel might also pose overly complex questions in an attempt to convolute the witness's responses. If this occurs, the witness should retrench by asking for the question to be rephrased in smaller components. Correct Answer: (C)

IQ #2 - Following the Wall Street Crash of 1929, the U.S. Congress passed the ______________ to regulate the public offering of securities and to protect investors.
  1. Securities Act of 1933
  2. Securities Exchange Act of 1931
  3. Investment Fraud Prevention Act of 1933
  4. Truth in Lending Act of 1931
View Answer
Concern over the Wall Street Crash of 1929 and the manipulation of the securities markets precipitated the need for federal intervention. In 1933, the U.S. Congress enacted the Securities Act of 1933 to regulate the public offering of securities and to protect investors. Simply put, the 1933 Act regulates the issuance of the securities themselves, and the 1934 Act covers subsequent trading of securities through brokers and exchanges. Correct Answer: (A)

IQ #3 - White, a Certified Fraud Examiner, believes that Blue, a fraud suspect, is guilty of embezzlement. White shares his theory with his supervisor. Blue later turns out to be innocent. Blue can sue and probably recover from White on a theory of defamation.
  1. True
  2. False
View Answer
Defamation is an unprivileged publication of a false statement about a person that causes harm to that person's reputation. To recover for defamation, the plaintiff must prove all of the following elements:

*The defendant made an untrue statement of fact.
*The statement was communicated (published) to third parties.
*The statement was made on an unprivileged occasion.
*The statement damaged the subject's reputation.

For a statement to qualify as defamatory, the occasion in which the statement is made must be an unprivileged one. If the statement is made on a privileged occasion, then no liability can attach to the speaker. Basically, the law recognizes that there are some circumstances in which the need to share information is so important that people will be allowed to make mistakes from time to time without having to worry about being sued for defamation. Statements that are made in these circumstances are said to be privileged. Correct Answer: (B)