CFE Fraud Schemes: Following the Money and the Evidence

Fraud schemes can look entirely ordinary until someone compares the transaction with the business purpose it supposedly serves. An invoice may carry the correct approval signature yet describe work that never happened. A vendor may exist in the accounting system but be controlled by an employee. A financial statement may appear consistent year to year while revenue recognition hides an aggressive and unsupported judgment. Understanding fraud requires the examiner to connect incentives, opportunity, records, concealment and the consequences of a distorted transaction.

The historical CFE subject name “Financial Transactions and Fraud Schemes” still describes a meaningful body of professional knowledge, but it no longer identifies a separately scheduled section of the latest Certified Fraud Examiner exam. ACFE redesigned the CFE exam effective June 2, 2026. The current three-part structure includes Fraud Schemes and Financial Crimes, Fraud Investigations and Legal Issues, and Fraud Prevention and Deterrence. Candidates should map older fraud-schemes materials to the current three-section outline rather than assume the former four-part structure still governs their assessment.

Within ACFE certifications, the CFE designation tests whether professionals can understand fraud's mechanisms, examine evidence and prevent misconduct within legitimate authority. The examiner's role is to build an accurate account from facts, not to announce guilt merely because a pattern is unusual.

The anatomy of a fraud scheme

A fraud scheme depends on more than a suspicious payment. Someone must gain an advantage through deception or abuse, and there must be a way to initiate, approve, conceal or misrepresent the activity. A useful first question is: what normal organizational process was exploited? Procurement, expense reimbursement, payroll, cash receipts, sales reporting and financial close each create different opportunities because the people, records and control points differ.

Consider a purchasing manager who can create a vendor, approve invoices and confirm delivery of services. That concentration of responsibilities creates an opening for fictitious billing. But the presence of weak segregation of duties alone does not establish fraud; it indicates the system may permit an improper transaction to succeed undetected. The investigator still needs evidence about vendor ownership, actual services, approvals, payments and the manager's actions.

Fraud schemes often evolve after controls change. An organization may prevent employees from creating new vendors without approval, so a wrongdoer might instead manipulate an existing supplier account or submit fraudulent change-of-bank instructions. Examiners therefore need to understand the underlying economic transaction and the full payment path. A checklist of named schemes can be useful for orientation, but it should not replace analysis of how value left the organization and who benefited.

Asset misappropriation and the records it leaves

Asset misappropriation concerns the theft or misuse of an organization's resources. It can include cash theft, fraudulent disbursements, payroll manipulation, purchasing abuses, inventory misuse and expense-report fraud. These patterns generate different records. Payroll schemes may be visible through personnel lists, bank-account changes and timesheets. Procurement schemes may emerge from invoice duplication, unusual price changes, split approvals or links between vendors and employees.

Suppose monthly consulting invoices just below an approval threshold repeatedly go to the same small supplier. That pattern is worth testing, not a conclusion. Review whether the service was authorized, delivered and independently accepted. Compare contracts, work products, correspondence, expense coding, payment dates and employee relationships. A legitimate recurring service may naturally produce similar amounts; a fictitious vendor may produce invoices designed specifically to avoid additional scrutiny.

Data analysis can help prioritize the search. Duplicate invoice numbers, round-dollar payments, weekend postings, identical bank accounts across different vendor names or payments after termination dates might reveal process failures or schemes. Yet analysts must understand the business context. A duplicate number across unrelated suppliers may be unremarkable, while a single well-supported suspicious payment can matter greatly. Statistical anomalies are investigative leads, not substitutes for corroboration.

The same principle applies to inventory. Physical count discrepancies can arise from theft, poor receiving controls, damage, record timing or normal operational loss. An examiner should reconcile movement records, authorization, access logs and independent counts before characterizing the loss as fraud. The quality of the conclusion matters as much as the speed of detection.

Corruption and conflicts of interest

Corruption-related misconduct may involve bribery, kickbacks, bid manipulation, conflicts of interest or other abuses of entrusted position. These schemes are difficult because the visible transaction can appear legitimate. A supplier actually delivers goods, but an employee may have steered the contract in return for an undisclosed benefit. Standard payment controls may confirm receipt without detecting the hidden arrangement.

To assess such a case, map decision rights and relationships. Who designed the tender criteria? Who evaluated bids? Who could approve exceptions? Did a favored supplier receive repeated changes in contract terms? Are there unexplained links between decision-makers and counterparties? These questions help frame evidence gathering without presuming that every relationship or sole-source purchase is corrupt.

Professional conduct also requires recognizing what evidence cannot prove. A close personal relationship is a conflict-risk indicator, but it does not automatically prove a bribe. A contract won on unusual terms may deserve independent pricing review, but the existence of an exception does not establish intent. Interviews, records and commercial facts must be evaluated together.

Different jurisdictions define corruption offenses and reporting duties differently. The fraud examiner should understand the general scheme and preserve evidence within their role, while legal conclusions about an offense or permissible investigative method require competent jurisdiction-specific analysis.

Financial statement manipulation requires accounting judgment

Fraudulent financial reporting can be harder to spot than a missing cash payment because the misstatement may sit inside a complex accounting estimate or transaction timing decision. Pressure to meet earnings expectations, weak review controls and management override can create opportunities to recognize revenue too early, understate liabilities, misclassify expenses or conceal related-party arrangements. The relevant question is not whether an outcome looks favorable, but whether it fairly follows applicable accounting rules and supporting evidence.

For example, a company may record substantial revenue just before period end under contracts with ambiguous acceptance conditions. An examiner should trace the contractual terms, delivery evidence, acceptance records, correspondence, subsequent returns and collection activity. The purpose is to determine whether recognition criteria were met and whether any differences reflect error, aggressive judgment or intentional deception. Management's written explanation is part of the evidence, not a substitute for testing it.

Ratios and trend analysis can reveal areas for closer work. Growth in receivables much faster than sales, margins inconsistent with known prices, unusual manual journal entries or shifts between periods can suggest questions. None is inherently fraudulent. High-growth businesses, acquisitions and seasonal markets can produce unusual trends for legitimate reasons. Candidates should explain both why an anomaly merits attention and what corroboration would be needed before escalation.

Financial crimes beyond an organization's own losses

Some fraud schemes intersect with laundering, identity misuse, cyber-enabled theft, deceptive investment activity and other broader financial crime. A company might suffer an authorized-push-payment scam, while the recipient accounts form part of a larger network used to move proceeds. Examiners should distinguish the initial deception from later movement and concealment of value. Different agencies and specialists may have responsibility for different aspects of the activity.

Mapping a payment trail requires identifying which records are original, where intermediaries enter and what can be learned from the available data. A bank ledger can show a payment but may not establish the economic purpose, beneficial owner or recipient's state of mind. Supporting contracts, email headers, access logs, beneficiary details and witness statements may be necessary. When a trail crosses legal jurisdictions or reaches records held by third parties, obtaining evidence must follow lawful processes.

Professionals must also preserve the distinction between a fraud allegation and a completed investigation. The existence of multiple suspicious transactions is not itself a legal finding. An accurate report describes identified facts, outstanding questions, the investigative methods used and the limits of available evidence.

From scheme recognition to a defensible investigation

The revised CFE framework joins investigations and legal issues into a current section. Recognizing a possible scheme is only the starting point for a CFE investigation: the examiner must preserve records, test rival explanations, trace transactions and distinguish an allegation from a finding. This remains useful historical subject matter, but the redesigned exam now combines investigations and legal issues into one section.

A practical workflow begins with a narrowly stated allegation and a map of what must be true for it to be supported. For a fictitious-invoice scheme, that might include a false supplier representation, an approving actor, a payment, evidence of nonperformance and a beneficiary relationship. The examiner then identifies the most reliable records for testing each proposition. If evidence contradicts the original hypothesis, the investigation must adjust rather than search only for confirmation.

The limits of lawful evidence collection matter at this stage. Retaining original records, documenting who handled them and avoiding unauthorized access make eventual findings more credible. Legal privilege, compulsory process and procedural rights can also constrain what the examiner may collect, disclose or conclude. The historical CFE law subject addresses these constraints, which now belong within the combined Fraud Investigations and Legal Issues section.

How to prepare for the 2026 CFE structure

Begin with ACFE's current official content outline, not an older four-section study table. Map fraud mechanisms into the new Fraud Schemes and Financial Crimes section and identify which concepts now belong to the integrated investigations-and-legal-issues area. A legacy practice bank may still help teach fraudulent disbursements or accounting misstatements, but its section labels and scheduling claims may no longer match the active exam.

For each fraud type, learn to answer four questions: What legitimate process was exploited? What is the alleged misrepresentation or abuse? What records would test it? Which alternative nonfraud explanations must be considered? These questions make preparation more useful than memorizing scheme names. After practice, classify errors: missed accounting concept, misunderstood incentive, overlooked control point, unsupported inference or wrong evidence source.

The strongest professional habit is to connect patterns without forcing conclusions. Frauds use ordinary business systems, so a competent examiner must understand those systems well enough to notice when a transaction's explanation fails. It is that combination of technical transaction knowledge, skepticism and evidentiary restraint—rather than the ability to recognize an alarming keyword—that makes preparation for this part of the CFE meaningful.