Your FREE Certified Fraud Examiner (CFE) Practice Test 2026 – 770+ Q&A

Correct answer: Three broad branches

Three broad branches is correct: the ACFE Fraud Tree sorts all occupational fraud into corruption, asset misappropriation, and fraudulent statements, and each branch then splits into specific schemes. Two basic categories is wrong because the two-way split of cash versus noncash schemes sits one level lower, inside asset misappropriation. Four major divisions is wrong because it borrows the four-element fraud diamond, which explains why fraud happens rather than how the tree classifies it. Five main components is wrong because the tree has no fourth or fifth top-level branch; only the schemes beneath the three branches are that numerous.

Correct answer: Corruption, asset misappropriation, and fraudulent statements

Corruption, asset misappropriation, and fraudulent statements is correct: these are the three branches of the ACFE Fraud Tree, the third being financial statement fraud. Pressure, perceived opportunity, and personal rationalization is wrong because those are the legs of the fraud triangle, which explains why people commit fraud, not how schemes are classified. Embezzlement, fraudulent disbursements, and inventory larceny is wrong because all three are forms of asset misappropriation, so the list covers a single branch. Bribery, fraudulent disbursements, and financial misstatement is wrong because bribery and fraudulent disbursements are sub-schemes beneath corruption and asset misappropriation, not branches in their own right.

Correct answer: Asset misappropriation

Asset misappropriation is correct: in the ACFE Report to the Nations it is by far the most frequent branch of occupational fraud, yet it has the lowest median loss of the three. Financial statement fraud is wrong because it is the rarest branch and carries the largest median loss. Illegal gratuity schemes is wrong because gratuities belong to the corruption branch, which is less frequent than asset misappropriation and has a higher median loss. Inventory larceny schemes is wrong because inventory theft is a narrow noncash scheme inside asset misappropriation, not one of the three branches the Fraud Tree compares.

Correct answer: Financial statement fraud

Financial statement fraud is correct: it is the least frequent branch in the ACFE Report to the Nations yet produces the highest median loss, because it manipulates reported figures rather than taking discrete assets. Asset misappropriation is wrong because it is the most frequent branch and has the smallest median loss. Procurement kickback fraud is wrong because kickbacks are bribery, part of the corruption branch, which falls between the other two branches on both frequency and median loss. Shell vendor invoice fraud is wrong because shell company billing is a sub-scheme of asset misappropriation, not a branch, and its median loss is far below that of financial statement fraud.

Correct answer: Cash and noncash property

Cash and noncash property is correct: the Fraud Tree first splits asset misappropriation into schemes against cash and schemes against inventory and all other noncash assets. Inflow and outflow thefts is wrong because the receipts-versus-disbursements division sits inside the cash branch, one level lower. Booked and unbooked theft is wrong because the on-book versus off-book contrast separates cash larceny from skimming, again inside the cash branch. Check and currency thefts is wrong because cash schemes take both checks and currency, so the medium of payment is not how the branch is divided.

Correct answer: Receipt skimming

Receipt skimming is correct: the clerk took the payment before it was ever entered in the books, which makes the theft off-book. Register larceny is wrong because cash larceny takes money that has already been recorded, so it leaves an on-book shortage. Check tampering is wrong because check and payment tampering involves the organization's own checks or payments, not a customer's incoming payment. Fictitious voids is wrong because a false void is a register disbursement that removes recorded cash by canceling a completed sale.

Correct answer: Skimming steals unrecorded receipts; larceny steals recorded funds

Skimming steals unrecorded receipts; larceny steals recorded funds is correct: timing relative to recording is the defining line, since skimming is off-book and cash larceny is on-book. Skimming steals modest increments; larceny steals substantial sums is wrong because either scheme can involve any amount. Skimming steals customer currency; larceny steals corporate checks is wrong because both schemes can take currency or customer checks, and taking the company's own checks is check tampering. Skimming steals vendor payments; larceny steals client remittances is wrong because skimming targets incoming receipts, while outgoing vendor payments belong to fraudulent disbursement schemes.

Correct answer: Theft of entered cash receipts

Theft of entered cash receipts is correct: cash larceny is an on-book scheme in which money that the accounting records already show is taken. Theft of unrecorded cash sales is wrong because stealing receipts before they are recorded is skimming. Theft of unused company checks is wrong because taking blank checks to complete later is check tampering, a forged maker scheme. Theft of falsely refunded cash is wrong because that is a register disbursement scheme, in which a false refund entry is used to justify the cash removed.

Correct answer: Billing through a shell organization

Billing through a shell organization is correct: the employee invented a vendor she controls and had the company pay its invoices, the classic shell-company billing scheme. Overbilling through a genuine vendor is wrong because a non-accomplice vendor scheme uses a real supplier's invoices, whereas this vendor is fictitious. Kickbacks through a colluding vendor is wrong because a kickback requires a real vendor paying the employee to steer business, and no real vendor exists here. Purchasing through a concealed stake is wrong because a conflict of interest involves an undisclosed stake in a real business that supplies goods or services, not invoices from an entity that does nothing.

Correct answer: Fraudulent disbursements

Fraudulent disbursements is correct: billing, payroll, and check tampering schemes all make the organization pay out money through its normal disbursement channels for a fraudulent purpose. Noncash misappropriation is wrong because these schemes take cash, not inventory or other noncash assets. Concealed check schemes is wrong because a concealed check is one variant inside check tampering, so it is narrower than the category that also holds billing and payroll schemes. Cash larceny schemes is wrong because cash larceny steals receipts already recorded on the books rather than causing the organization to issue a payment, so it falls under theft of cash receipts.

Correct answer: Passthrough vendor schemes

Passthrough vendor schemes is correct: in a passthrough (pass-through) scheme an employee sets up a shell entity that buys goods and resells them to the employer at an inflated price, which the ACFE classes as a billing scheme. Phantom employee schemes is wrong because phantom or ghost employees are a payroll scheme. Forged endorsement schemes is wrong because forging the endorsement on an intercepted company check is check and payment tampering. Overstated expense schemes is wrong because inflating a business expense claim is expense reimbursement fraud, not a billing scheme.

Correct answer: Payment tampering

Payment tampering is correct: the clerk physically altered the payee on one of the organization's own checks, which is check and payment tampering (an altered payee scheme). Duplicate billing is wrong because a billing scheme submits invoices for the organization to pay rather than altering a check it has already issued. Email compromise is wrong because business email compromise uses spoofed or hijacked email to redirect a payment, not a hand-altered paper check. Expense padding is wrong because inflating an expense claim is expense reimbursement fraud, which involves no intercepted check.

Correct answer: Payment tampering

Payment tampering is correct: forged maker, forged endorsement, altered payee, and concealed check schemes are the variants of check and payment tampering, all of which manipulate the organization's own checks or payments. Personal purchases is wrong because buying personal items with company funds is a billing scheme. Receivable lapping is wrong because lapping conceals skimmed customer payments by applying later receipts to earlier accounts. Payroll diversions is wrong because redirecting wages names a payroll scheme, a category that does not contain forged maker, forged endorsement, altered payee, or concealed check schemes.

Correct answer: Ghost employee scheme

Ghost employee scheme is correct: a nonexistent person was put on the payroll so the supervisor could collect the paychecks. Falsified wage scheme is wrong because falsified wages involve a real employee claiming more hours or a higher rate than earned. Commission pay scheme is wrong because commission schemes inflate a real salesperson's sales or rate. Identity theft scheme is wrong because identity theft uses a real person's identifying information, while this worker does not exist and the supervisor simply invented a payee.

Correct answer: A rostered payee who performs zero labor

A rostered payee who performs zero labor is correct: a ghost employee is a name on the payroll, invented or a former worker kept active, who does no work while the fraudster collects the pay. A worker who claims unworked extra hours is wrong because that real employee commits a falsified hours scheme. A seller who fakes recorded sales totals is wrong because that is a commission scheme. A shell vendor who bills fictitious work is wrong because a fictitious vendor is a billing scheme, paid through invoices rather than payroll.

Correct answer: Mischaracterized expenses

Mischaracterized expenses is correct: a real personal dinner was presented as a business meal, which is a mischaracterized expense scheme. Overstated expense claims is wrong because an overstated expense scheme inflates the amount of a genuine business expense, and this receipt was not inflated. Fictitious travel expense is wrong because a fictitious expense scheme claims a cost that never occurred, while this dinner did occur. Multiple reimbursements is wrong because a multiple reimbursement scheme claims the same expense more than once, and this receipt was submitted once.

Correct answer: Expense reimbursement schemes

Expense reimbursement schemes is correct: mischaracterized, overstated, fictitious, and multiple-reimbursement schemes are the four ACFE types of expense reimbursement fraud, in which employees file false claims for business expenses. Concealed expense schemes is wrong because concealing liabilities and expenses is a financial statement fraud in which the company omits or understates its own costs to inflate reported earnings. Capitalized expense schemes is wrong because recording ordinary costs as assets is also a financial statement fraud method, not a false claim filed by an employee. Register disbursement schemes is wrong because the register disbursement types are false refunds and false voids.

Correct answer: Register disbursement

Register disbursement is correct: a fictitious refund entered at the register is a register disbursement scheme, in which the false refund records cash going out of the till. Cash register skimming is wrong because skimming takes cash from a sale that is never recorded, while here the books show a refund. Inventory theft scheme is wrong because no merchandise was taken; the theft was of cash. Cash register larceny is wrong because cash larceny steals cash that was already recorded and at most uses a later void or refund to hide the shortage, whereas here the fictitious refund is itself the transaction that takes the cash out of the register.

Correct answer: False refunds and false voids

False refunds and false voids is correct: register disbursement schemes take two forms, false refunds, which record a fictitious or overstated return, and false voids, which cancel a completed sale, and both justify removing cash from the register. False hours and false salaries is wrong because falsified hours and salary schemes are payroll fraud. False sales and false shipments is wrong because faking a sale to ship merchandise to an accomplice is a noncash inventory scheme. False invoices and false checks is wrong because those belong to billing and check tampering schemes, which pay money out through accounts payable rather than through the register.

Correct answer: Financial statement fraud

Financial statement fraud is correct: recognizing revenue before it is earned overstates reported earnings, a timing-difference method of financial statement fraud. Asset misappropriation is wrong because nothing is stolen; the figures are distorted. Commercial bribery scheme is wrong because no bribe is paid to influence a business decision. Receivables skimming is wrong because it steals customer payments on sales that are already recorded and hides the shortage with lapping or write-offs; it does not book revenue early to inflate earnings.

Correct answer: Recording fictitious revenue

Recording fictitious revenue is correct: booking sales that never occurred inflates reported earnings, one of the most common financial statement fraud methods. Lapping customer remittances is wrong because lapping conceals skimmed receivables, an asset misappropriation scheme. Accepting supplier kickbacks is wrong because kickbacks are bribery, part of the corruption branch. Overstating mileage expenses is wrong because padding an employee's own claim is expense reimbursement fraud, a theft of company cash rather than a misstatement of the organization's results.

Correct answer: Bribery, illegal gratuities, economic extortion, and conflicts of interest

Bribery, illegal gratuities, economic extortion, and conflicts of interest is correct: these four schemes make up the corruption branch, all involving the wrongful use of influence in a business transaction. Larceny, nonexistent employees, misuse of supplies, and fictitious refunds is wrong because those are asset misappropriation schemes. Overvaluation, fictitious sales, early income, and concealment of payables is wrong because those are financial statement fraud methods. Business email compromise, ransomware, sextortion, and theft of identities is wrong because those are cyber and identity crimes, usually committed by outsiders, that fall outside the occupational Fraud Tree.

Correct answer: Commercial bribery

Commercial bribery is correct: the agent took a secret payment from the supplier in return for steering contracts, the classic kickback form of bribery. Illegal gratuities is wrong because a gratuity rewards a decision after it is made, with no prior agreement to influence it. Economic extortion is wrong because there the employee demands payment under threat, while here the supplier offered it to buy influence. Ownership conflict is wrong because a conflict of interest turns on the agent's own hidden stake in the supplier, which the stem does not describe.

Correct answer: Bribery buys a future decision; a gratuity rewards a completed one

Bribery buys a future decision; a gratuity rewards a completed one is correct: a bribe is given to influence a decision, while an illegal gratuity is given after the decision as a reward, without a prior agreement to influence it. Bribery targets a public official; a gratuity tips a private buyer is wrong because both offenses can involve public officials or private-sector employees. Bribery involves a cash payment; a gratuity offers a noncash favor is wrong because either can be paid with anything of value. Bribery needs a hidden payment; a gratuity allows a disclosed gift is wrong because secrecy is not the dividing line: either payment may be concealed or open, and what separates them is whether it comes before the decision to influence it or after the decision as a reward.

Correct answer: Conflict of interest dealings

Conflict of interest dealings is correct: an employee who hides an economic interest in a vendor and then approves business that benefits it has a conflict of interest, and those approvals are dealings tainted by the undisclosed stake. Economic extortion of vendors is wrong because economic extortion means demanding payment from a vendor under threat, not holding a hidden stake in it. Bribery of procurement agents is wrong because bribery requires a payment from an outside party to influence the decision, and none is described. Receipt of illegal gratuities is wrong because an illegal gratuity is a reward given after a decision, and no such reward is described.

Correct answer: A hidden personal stake that colors business judgments

A hidden personal stake that colors business judgments is correct: a conflict of interest turns on an undisclosed economic or personal interest that affects how the employee does the job. A secret vendor payment that purchases contract awards is wrong because that describes bribery. A grateful vendor gift that rewards finished contracts is wrong because that describes an illegal gratuity. A coercive employee demand that extracts supplier cash is wrong because that describes economic extortion.

Correct answer: Fresh deposits from newer contributors

Fresh deposits from newer contributors is correct: a Ponzi scheme has no real earnings, so it pays earlier investors with money taken in from later ones. Profits from genuine business ventures is wrong because the absence of any real profit is what makes the scheme a fraud. Portfolio inflows from options spreads is wrong because such a trading strategy is the cover story operators tell, not the actual source of the payouts. Advance charges from hopeful borrowers is wrong because collecting upfront fees for a loan or prize that never arrives is advance-fee fraud, a different scheme.

Correct answer: Withdrawals outrun new deposit inflows

Withdrawals outrun new deposit inflows is correct: the scheme can pay old investors only while new money keeps arriving, so it fails once fresh deposits slow or redemption requests surge. Market downturns erase claimed profits is wrong because the claimed profits never existed, so a market fall cannot remove them. Rate increases inflate margin expenses is wrong because the operator is not actually trading on borrowed money. Downstream product sales slump sharply is wrong because a Ponzi scheme sells no real product; falling product sales describe the failure of a legitimate business, not of a Ponzi scheme.

Correct answer: Pay flows mainly from recruiting extra members

Pay flows mainly from recruiting extra members is correct: in a pyramid scheme participants earn by enrolling others, whose fees move up the structure. Pay flows mainly from one controlling promoter is wrong because a single central operator paying everyone is the mark of a Ponzi scheme. Pay flows mainly from selling genuine products is wrong because real retail sales describe a lawful direct-selling business. Pay flows mainly from promised trading returns is wrong because promised investment returns are the Ponzi pitch, not the pyramid's recruitment model.

Correct answer: Pyramid promotion

Pyramid promotion is correct: when pay depends mainly on recruiting new members rather than on selling a genuine product, the operation is an illegal pyramid scheme. Ponzi arrangement is wrong because a Ponzi scheme pays investors from a central operator's pool of new deposits, not through recruitment levels. Advance-fee fraud is wrong because that scheme collects an upfront payment for a promised benefit that never comes. Direct-sales plan is wrong because a lawful direct-selling plan pays mainly for genuine product sales to real customers.

Correct answer: Impersonates a trusted contact to demand a wire

Impersonates a trusted contact to demand a wire is correct: in business email compromise the fraudster poses by email as an executive or a known vendor, using a spoofed or hijacked account, to trick an employee into sending funds or changing payment details. Encrypts a company database to extract a ransom is wrong because that is a ransomware attack, which locks data rather than impersonating anyone. Intercepts a mailed check to substitute a payee is wrong because altering a paper check is check tampering, which involves no email deception. Rewards a complicit buyer to approve a purchase is wrong because paying an insider for a favorable decision is bribery.

Correct answer: Business email compromise

Business email compromise is correct: an email that impersonates the CEO and urgently orders a wire to a new account is the classic CEO-fraud form of business email compromise. Sweepstakes email swindle is wrong because that is an advance-fee scheme asking the victim to pay a fee to claim a prize. Ransomware email campaign is wrong because ransomware encrypts the victim's data and demands payment to release it, without impersonating an executive. Romance investment racket is wrong because it builds a false personal relationship to lure the victim into a sham investment.

Correct answer: Using stolen private information to impersonate victims

Using stolen private information to impersonate victims is correct: identity theft is the unauthorized use of another person's identifying information, such as a Social Security number or account credentials, to commit fraud. Creating fictitious vendor accounts to receive payments is wrong because an invented vendor is a shell-company billing scheme and uses no real person's identity. Copying proprietary trade secrets to assist competitors is wrong because that is theft of intellectual property, not of personal identifying information. Altering intercepted company checks to reroute payments is wrong because that is check tampering.

Correct answer: Identity theft

Identity theft is correct: opening new credit accounts with a victim's Social Security number and date of birth is the defining act of identity theft. Phishing attack is wrong because phishing is one way such details are stolen, not the use of them to open accounts. Account seizure is wrong because an account takeover hijacks an account the victim already has, while these accounts were newly opened. Pretexting scam is wrong because pretexting obtains information under false pretenses; the conduct described is using that information to open accounts.

Correct answer: Cyberfraud offenses

Cyberfraud offenses is correct: phishing is a technology-enabled deception used to steal credentials and data, and the schemes section treats it under cyberfraud alongside malware and business email compromise. Corporate espionage is wrong because espionage targets trade secrets and competitive information rather than login credentials. Sweepstakes schemes is wrong because a sweepstakes scam tricks the victim into paying a fee to claim a prize that never arrives, which is advance-fee consumer fraud, not credential theft. Website defacements is wrong because a defacement alters a site's content to embarrass its owner or spread a message, and it harvests no credentials.

Correct answer: Crediting a later customer's payment to mask earlier theft

Crediting a later customer's payment to mask earlier theft is correct: lapping hides stolen receivables by applying each new payment to the account whose payment was stolen before, so the shortage keeps rolling forward. Writing off a customer's skimmed balance to doubtful debts is wrong because that is a separate concealment method, the false write-off. Recording a customer's skimmed check to fake sales returns is wrong because that is concealment through false credits, discounts, or returns. Cycling a company's checks to inflate available bank funds is wrong because that is check kiting, which exploits the float between bank accounts.

Correct answer: Receivables skimming scheme

Receivables skimming scheme is correct: the incoming customer payment was stolen before it was recorded, and writing the account off as a bad debt is a standard way to conceal skimmed receivables. Cash-deposit larceny scheme is wrong because cash larceny from the deposit takes receipts after they have been recorded, while this payment never entered the books. Endorsement tampering scheme is wrong because forged endorsement schemes are check tampering, which involves the organization's own outgoing checks, not a customer's incoming check. Register disbursement scheme is wrong because register disbursements use false refunds or voids at the point of sale.

Correct answer: Improper revenue recognition

Improper revenue recognition is correct: channel stuffing books sales before they are truly earned, overstating revenue on the financial statements, so it is financial statement fraud through improper revenue recognition. Inventory larceny schemes is wrong because the product is shipped to real distributors and recorded as sales, not stolen. Distributor kickback schemes is wrong because no distributor pays an employee to influence a business decision. Understated sales skimming is wrong because skimming understates sales to hide stolen cash, the opposite of inflating them.

Correct answer: Personal purchases billing

Personal purchases billing is correct: charging personal items to the company card and coding them as supplies makes the organization pay for the employee's purchases, the personal purchases form of billing scheme. Mischaracterized expenses is wrong because an expense reimbursement scheme requires the employee to pay first and then claim reimbursement, whereas here the company paid the card directly. Personal inventory misuse is wrong because noncash misuse takes or uses an existing company asset, while these electronics were newly bought for the employee. Inflating personal mileage is wrong because padding mileage is an overstated expense reimbursement claim, and this employee filed no claim at all.

Correct answer: Commonest category, lowest median loss

Commonest category, lowest median loss is correct: in the ACFE Report to the Nations asset misappropriation is by far the most frequent branch of occupational fraud, yet it has the lowest median loss of the three. Rarest category, costliest median loss is wrong because that profile describes financial statement fraud. Dominant category, biggest median loss is wrong because the most frequent branch is not the most costly one. Unusual category, smallest median loss is wrong because asset misappropriation is the most common branch, not an uncommon one.

Correct answer: Shell-company scheme

Shell-company scheme is correct because the fraudster set up a look-alike vendor whose only purpose is to receive payment on false invoices, which is shell-company billing. Non-accomplice scheme is wrong because a non-accomplice vendor scheme bills through a real supplier that is unaware of the fraud, but this supplier is not real. Personal purchases is wrong because in a personal purchases scheme the organization pays for goods that the fraudster keeps, whereas this sham vendor supplies nothing and exists only to collect payment. Pay-and-return scheme is wrong because it means deliberately overpaying a real vendor and intercepting the refund, not billing through a sham vendor.

Correct answer: A buyer issues a threat to a vendor demanding personal payoffs

A buyer issues a threat to a vendor demanding personal payoffs is correct because economic extortion occurs when an employee demands payment by threatening adverse business action, so the employee initiates and coerces the payment. A vendor offers a payment to a buyer seeking contract approval is bribery, because the payment is volunteered beforehand to influence a pending decision. A vendor sends a gift to a buyer rewarding completed purchases is an illegal gratuity, given after the decision with no threat involved. A buyer steers a contract to a vendor hiding spousal ownership is a conflict of interest, an undisclosed personal stake rather than a coerced payment.

Correct answer: Copies the treasurer's signature on a blank company check

Copies the treasurer's signature on a blank company check is correct because in a forged maker scheme a fraudster without signing authority forges the signature of an authorized maker on the organization's own check. Signs the payee's endorsement on a diverted company check describes a forged endorsement scheme, where the forgery is on the back of a check already issued to someone else. Overwrites the payee's details on a printed company check describes an altered payee scheme, which changes the payee line rather than faking the maker's signature. Procures the signer's assent on a concealed company check describes a concealed check scheme, where a genuine signer signs a fraudulent check without noticing it, so no signature is forged.

Correct answer: Multiple reimbursement requests

Multiple reimbursement requests is correct because submitting the same airfare receipt on two separate reports seeks payment more than once for a single genuine expense, the multiple reimbursements scheme. Overstated reimbursement claims is wrong because the airfare amount was not inflated; the same true amount was simply claimed twice. Fictitious reimbursement claims describes fictitious expenses, which are invented outright, whereas this flight actually occurred. Mischaracterized expense items describes passing off a personal cost as a business one, and nothing about the nature of this expense was misstated.

Correct answer: Overstated expense submissions

Overstated expense submissions is correct because the salesperson altered a genuine hotel receipt so the claimed amount exceeds what was actually paid, the defining feature of an overstated expense scheme. Multiple expense reimbursements describes the multiple reimbursements scheme, claiming one expense more than once, but this receipt was submitted once at an inflated figure. Fictitious reimbursement claims describes fictitious expenses, where no expense occurred at all, yet the hotel stay was real. Mischaracterized expense items describes mischaracterized expenses, presenting a personal cost as a business cost, whereas the business nature of this stay was not misstated.

Correct answer: An employee buys real goods through a hidden firm and invoices inflated prices

An employee buys real goods through a hidden firm and invoices inflated prices is correct because in a pass-through scheme the employee's undisclosed company buys genuine merchandise and resells it to the employer at a markup, pocketing the difference. An employee bills fake orders through a shell vendor and collects full payment is ordinary shell-company billing, in which nothing is ever delivered, whereas a pass-through scheme delivers real goods. An employee charges home items through a company card and claims work purposes is a personal purchases scheme, with no intermediary reselling anything. An employee okays padded bills through a favored vendor and takes cash rebates is a kickback scheme, in which an outside vendor pays the employee rather than the employee owning the middleman.

Correct answer: Financial statement fraud

Financial statement fraud is correct because deliberately understating liabilities and expenses misstates the statements to inflate reported net income, the concealed liabilities and expenses method of financial statement fraud. Expense reimbursement fraud is wrong because it is an asset misappropriation scheme in which an employee is paid on false expense claims; it takes funds rather than misstating reported earnings. Commercial bribery scheme belongs to the corruption branch, where something of value is paid to influence a business decision. Register disbursement fraud is asset misappropriation through false refunds or voids at a cash register, not a misstatement of financial results.

Correct answer: Bribery

Bribery is correct because it is a corruption scheme, offering or accepting something of value to influence a business decision, so it sits outside the asset misappropriation branch. Forged maker is wrong because forging an authorized signer's name on a company check is check tampering, a fraudulent disbursement within asset misappropriation. Shell vendor is wrong because billing the organization through a fictitious supplier is a billing scheme, which is also a fraudulent disbursement, even though an outside entity is involved. Skimming is wrong because taking cash before it is recorded is a theft of cash receipts in the same branch.

Correct answer: Inventory theft

Inventory theft is correct because the employee stole physical merchandise, which places the scheme in the noncash (inventory and all other assets) branch of asset misappropriation as larceny of inventory. Cash larceny is the theft of cash after it has been recorded, whereas goods, not cash, were taken here. Property misuse is the other noncash subtype, the unauthorized personal use of company assets that stay with the company, not the outright theft and sale of them. Sales skimming takes cash from customer sales before they are recorded, but this employee took the company's goods, not its sales receipts.

Correct answer: Unrecorded sales skimming

Unrecorded sales skimming is correct because the bartender pocketed payment for drinks that were never entered, so the cash was taken off-book before it reached the records. Underringing actual sales describes understated-sales skimming, in which a sale is entered at a lower amount, but these drinks were not rung up at all. Stealing registered sales describes cash larceny, the theft of receipts already recorded in the register. Refunding completed sales describes a false refund register disbursement, which removes cash by recording a fictitious refund after a sale has been entered.

Correct answer: Cash larceny scheme

Cash larceny scheme is correct because the money was taken after the sales had been recorded, so the register's recorded total no longer agrees with the cash on hand, the signature of on-book theft. Cash sales skimming is wrong because skimming takes payments before they are rung up, so the register total would still match the drawer. Cash refund scheme describes a false refund register disbursement, which records a fictitious refund to account for the missing money, so the totals would reconcile. Voided sales scheme describes a false void register disbursement, which likewise reduces the recorded total so that no shortage appears.

Correct answer: A vendor with rented mailbox, unlisted phone, and invoices skirting approval limits

A vendor with rented mailbox, unlisted phone, and invoices skirting approval limits is correct because a shell vendor typically has no physical premises or listed telephone and bills in amounts kept just below review thresholds. A vendor with inflated prices, captive buyer, and orders bypassing competitive bids points to kickbacks or bid rigging with a real supplier. A vendor with duplicate payments, odd credits, and refunds reaching clerks directly points to a pay-and-return scheme run through a genuine vendor. A vendor with consumer goods, home deliveries, and orders lacking business purposes points to a personal purchases scheme, not a fictitious supplier.

Correct answer: Two payroll profiles sharing one bank account number

Two payroll profiles sharing one bank account number is correct because a ghost employee's pay is usually routed into the fraudster's own account, so the fictitious worker and a real one end up with the same deposit details. Timecard hours well exceeding lobby badge swipe logs signals falsified hours claimed by a real worker. Rep commission totals far outpacing booked net sales signals a commission scheme. New pay rates exceeding approved salary grade limits signals falsified wage rates for a genuine worker, not a fictitious one.

Correct answer: Concealed check scheme

Concealed check scheme is correct here because deleting the transaction hides the fraudulent check from the accounting records, concealing that it was issued and cashed. Forged check signature describes a forged maker scheme, but the intercepted check had already been properly signed. Counterfeit check fraud is wrong because it means producing fake checks that imitate the company's own, whereas this was a genuine company check that had been properly issued. Authorized maker scheme requires an employee with signing authority to write the check, and an accounts payable clerk who intercepts a check is not acting as its maker.

Correct answer: Fictitious revenues

Fictitious revenues is correct because booking sales to customers who do not exist records revenue for sales that never occurred, the fictitious revenues method of financial statement fraud. Fictitious vendors belong to shell-company billing, an asset misappropriation scheme that pays a sham supplier rather than inflating reported sales. Fictitious employees belong to ghost employee payroll schemes, which also pay out money rather than inflating revenue. Improper disclosures is the financial statement fraud method of omitting or misstating required information, such as related-party transactions, not recording sales that never happened.

Correct answer: Improper asset valuation

Improper asset valuation is correct because it completes the five categories, covering overstated inventory, receivables, and other assets. Improper revenue cutoffs fall under timing differences, a category the stem already lists. Improper affiliate deals are undisclosed related-party transactions, part of improper disclosures, which is also already listed. Corrupt kickback schemes belong to the corruption branch of the Fraud Tree, not to financial statement fraud.

Correct answer: Official bribery

Official bribery is correct because the officer accepted cash in exchange for an official act, leaking sealed bid amounts, which is a payment given to influence a decision still in progress. Illegal gratuity is wrong because a gratuity rewards a decision already made, without any agreement to influence it beforehand. Economic extortion is wrong because it requires the officer to demand payment by threatening harm, and here the bidder simply paid. Purchasing schemes are conflicts of interest in which the buyer has an undisclosed stake in a vendor, not a payment taken from a bidder.

Correct answer: Conflict of interest

Conflict of interest is correct because the manager steers business to a company her spouse secretly owns without disclosing the relationship, an undisclosed personal interest that influences her decisions. Extortion of vendors is wrong because no payment was demanded under threat. Bribery of employees is wrong because no outside party paid the manager to influence the award. Illegal gratuities are gifts given after a decision as a reward, and no gift changed hands here.

Correct answer: Ponzi repayment scheme

Ponzi repayment scheme is correct because a central promoter pays the promised returns to earlier investors out of later investors' deposits, with no genuine profit-generating activity. Pyramid recruit scheme is wrong because pyramid participants are paid mainly for recruiting new members, not by a promoter who manages their money. Advance-fee grant scam is wrong because victims pay an upfront fee for a promised grant or windfall that never arrives, rather than receiving returns from others' deposits. Prime-bank note scheme sells nonexistent high-yield bank instruments, and the stem describes no such instrument; its hallmark is the fictitious instrument rather than paying old investors with new deposits.

Correct answer: Unusually steady returns ignoring broad market downturns

Unusually steady returns ignoring broad market downturns is correct because genuine investments rise and fall with the market, so suspiciously consistent, above-market returns suggest the payouts are being funded by new deposits. Recruitment bonuses dominating overall member pay totals is the hallmark of a pyramid scheme. Large promised windfalls requiring upfront transfer fees is the hallmark of advance-fee fraud. Unsolicited promoter blasts touting thinly traded shares is the hallmark of a pump-and-dump manipulation, not a Ponzi scheme.

Correct answer: Pyramid sign-up scheme

Pyramid sign-up scheme is correct because members pay to join and earn mainly from recruiting new fee-paying members, with little or no real product sold, the defining trait of a pyramid. Ponzi repayment scheme is wrong because a Ponzi operator pays investors purported returns out of later investors' money, not recruitment bonuses. Advance-fee prize scam is wrong because the victim pays an upfront fee to release a promised prize that never arrives, with no recruiting structure. Prime-bank note scheme is wrong because it sells fictitious high-yield bank instruments rather than memberships.

Correct answer: Vendor impersonation scheme

Vendor impersonation scheme is correct because the fraudster took over a real supplier's email and impersonated that supplier to redirect its payments, the vendor-impersonation form of business email compromise. Shell-company billing scheme is wrong because no fictitious vendor is created; the buyer believes it is paying its genuine supplier. Electronic payment tampering is wrong because it is an insider altering or misdirecting the organization's own electronic payments, whereas here an outsider deceived the buyer into changing the bank details. Duplicate payment scheme describes a pay-and-return scheme, in which an insider deliberately pays a vendor twice and pockets the refund.

Correct answer: Cyberfraud attacks

Cyberfraud attacks is correct because ransomware is technology-enabled extortion carried out through malicious software, which falls under cyberfraud alongside phishing and business email compromise. Economic extortion is wrong because in the Fraud Tree it is a corruption scheme in which an employee demands payment from a vendor under threat of adverse business decisions, not an outside attack on data. Trade-secret theft is wrong because it involves stealing confidential information, whereas ransomware locks the data and demands payment for its release. Identity theft is wrong because it misuses a person's identifying information, and no such information is being exploited here.

Correct answer: Identity theft

Identity theft is correct because recovering discarded bank statements is a way of gathering a person's identifying and account information, which is then misused to commit fraud in that person's name. Corporate spying also uses trash searches, but it targets a business's confidential information, not an individual's bank statements. Advance-fee scam is wrong because it relies on persuading a victim to pay an upfront fee, not on stolen personal records. Check forgery is a check tampering scheme in which an insider forges the organization's own checks, not the misuse of a private person's account details.

Correct answer: Tax identity theft

Tax identity theft is correct because the fraudster used another person's name and Social Security number without authorization to file a return and claim that person's refund. Income tax evasion is wrong because it is a taxpayer underreporting his or her own tax liability, not filing in someone else's name. Tax shelter scheme is wrong because an abusive shelter uses sham transactions to reduce the promoter's or the clients' own taxes. Paid preparer scam is wrong because it is a tax return preparer cheating the clients who hired him or her, for example by inflating their deductions, whereas this return was filed in a victim's name without that person's knowledge or consent.

Correct answer: Receipts skimming

Receipts skimming is correct because skimming removes incoming funds before they are recorded, so the stolen money never enters the accounting system and the scheme is off-book. Payment tampering is wrong because check and payment tampering manipulates disbursements that are recorded in the books. Register refunds describes false refund register disbursements, which create a recorded refund entry to cover the theft, making them on-book. Deposit larceny is a form of cash larceny, the theft of funds after they have already been recorded.

Correct answer: Voiding registered sales

Voiding registered sales is correct because the employee entered a false void against a genuine completed sale to justify removing its cash, which is a false void register disbursement. Refunding finished sales describes the false refund variant, in which a fictitious customer return is recorded, but no refund was processed here. Taking recorded receipts describes cash larceny, the theft of recorded cash with no offsetting entry, whereas this employee covered the theft with a void. Skimming unentered sales describes skimming, which takes payments that were never recorded, but this sale had already been rung up.

Correct answer: Billing fakes payable invoices; check tampering hijacks company instruments

Billing fakes payable invoices; check tampering hijacks company instruments is correct because a billing scheme uses false or inflated invoices to make the organization issue a payment itself, while check tampering means the fraudster directly prepares, forges, or alters the organization's own checks. Billing doctors signed drafts; check tampering inflates supplier statements reverses the two definitions. Billing demands vendor collusion; check tampering shuns outside accomplices is wrong because billing schemes often use shell companies or unwitting real vendors with no collusion at all. Billing bypasses financial records; check tampering remains entirely posted is wrong because both are fraudulent disbursements that pass through the books.

Correct answer: Ghost employee scheme

Ghost employee scheme is correct because putting a terminated coworker back on the active payroll and rerouting the pay creates a ghost employee, using a former employee as the fictitious worker. Falsified hours scheme is wrong because it inflates the hours of a genuine worker who is still employed. Overstated employee salary describes a falsified wages scheme, which raises the pay rate of a real, active employee rather than paying someone who no longer works there. Employee commission scheme is wrong because a commission scheme inflates a salesperson's sales or commission rate.

Correct answer: Fictitious expense submissions

Fictitious expense submissions is correct because the employee claimed reimbursement for a conference she never attended and supported it with a fabricated receipt, so the entire expense was invented. Overstated reimbursement claims describes overstated expenses, which exaggerate the amount of a cost that really occurred. Multiple expense reimbursements describes multiple reimbursements, which claim one genuine expense more than once. Mischaracterized expense items describes mischaracterized expenses, which present a real personal cost as a business cost rather than inventing a cost that never happened.

Correct answer: Overstating inventory by skipping obsolete stock markdowns

Overstating inventory by skipping obsolete stock markdowns is correct because failing to write down goods that can no longer be sold at cost inflates the reported value of an asset, the essence of improper asset valuation. Overstating revenue by booking nonexistent customer orders is the fictitious revenues method. Overstating earnings by recognizing unearned revenue early is the timing differences method, which shifts real revenue into the wrong period. Understating liabilities by omitting active lawsuit losses is the concealed liabilities and expenses method, which hides obligations rather than inflating an asset.

Correct answer: Something of value paid afterward to reward an official act

Something of value paid afterward to reward an official act is correct because an illegal gratuity is given after a decision has been made, as a reward, with no agreement beforehand to influence it. Something of value tendered upfront to sway an official act is a bribe, offered before the decision in order to influence it. Something of value exacted forcibly to stop an official act is economic extortion, a payment demanded under threat of an adverse decision. Something of value held discreetly to steer an official act describes a conflict of interest, an undisclosed financial stake that biases the decision maker.

Correct answer: A stockroom clerk removes laptops quietly and resells units privately

A stockroom clerk removes laptops quietly and resells units privately is correct because the clerk steals physical inventory, a noncash asset, which is inventory larceny. A retail clerk sells laptops unrecorded and pockets customer payments is skimming, because what is stolen is the cash from an unrecorded sale. A returns clerk refunds laptops fictitiously and pockets drawer money is a false refund register disbursement, a cash scheme. A procurement clerk bills phantom laptops and collects shell payments is a shell-company billing scheme, which takes the organization's cash through invoices for goods never delivered.

Correct answer: Forged endorsement scheme

Forged endorsement scheme is correct because the fraudster intercepted a check made out to someone else and signed the payee's name on the back to negotiate it. Altered payee-name scheme is wrong because the payee line was not changed; the original payee's endorsement was faked instead. Authorized maker scheme is wrong because it requires an employee with signing authority to write a fraudulent check, whereas this check had already been issued to a legitimate payee. Concealed check scheme involves slipping a fraudulent check past an authorized signer for signature, not intercepting a check already issued.

Correct answer: It typically involves manipulating large reported figures, producing the highest median loss

It typically involves manipulating large reported figures, producing the highest median loss is correct because financial statement fraud misstates material amounts in the statements, so each case causes the largest median loss even though it is the least common branch. It typically involves embezzling major corporate deposits, producing the highest median loss is wrong because taking the organization's funds is asset misappropriation, not a misstatement of the financial statements. It typically involves bribing senior government officials, producing the highest median loss is wrong because bribery belongs to the corruption branch. It typically involves hacking enterprise payment networks, producing the highest median loss is wrong because such intrusions are cyberfraud, whereas financial statement fraud is usually committed by insiders who control the accounting records.

Correct answer: Lack of segregation of duties

Lack of segregation of duties is correct because one employee both received and recorded customer payments, which let the employee take cash and conceal the shortage through lapping without any independent check. Lack of validation of payroll is the weakness that lets ghost employees or inflated pay go unnoticed, not one that affects customer receipts. Lack of audits of inventories enables theft of goods, whereas this scheme involved cash receipts. Lack of scrutiny of suppliers enables shell-company and fictitious-vendor billing, not the theft and lapping of customer payments.

Correct answer: A vendor pays a buyer who approves overpriced purchases

A vendor pays a buyer who approves overpriced purchases is correct because in a kickback scheme the vendor initiates the arrangement and secretly pays an insider, who in return approves inflated or unnecessary purchases, so both share in the overbilling. A buyer coerces a vendor who remits protection payments is economic extortion, in which the employee initiates by demanding payment under threat. A vendor rewards a buyer who already approved contracts is an illegal gratuity, given after the decision with no inflated transaction. A buyer registers a vendor who bills phantom deliveries is shell-company billing, which the employee runs alone with no outside vendor paying anyone.

Correct answer: The pocketed difference escaped the general ledgers

The pocketed difference escaped the general ledgers is correct because in understated-sales skimming the stolen portion of the sale is never recorded, so it never enters the books, which is what makes the scheme off-book. The pocketed difference eluded the internal auditor is wrong because whether anyone notices the theft says nothing about whether it was recorded. The pocketed difference balanced the refund journal describes concealment through a false refund entry, which is an on-book register disbursement. The pocketed difference followed the reversed sales describes a false void, which is likewise an on-book scheme.

Correct answer: Cash larceny scheme

Cash larceny scheme is correct because cash larceny is the theft of cash after it has been recorded in the register or the accounting system, the on-book counterpart to skimming. Cash skimming scheme is wrong because skimming takes cash before it is recorded. Cash receipt lapping is a method of concealing skimmed receivables by applying later customer payments to earlier accounts. Shell company scheme is a billing scheme that pays a fictitious vendor through false invoices, not a theft of cash already on hand.

Correct answer: Larceny scheme

Larceny scheme is correct because the custodian took currency from a petty cash fund that was already recorded as an asset, which is cash larceny, and the falsified receipts merely hide the shortage. Skimming scheme is wrong because skimming takes funds before they are ever recorded. Refund scheme describes a false refund register disbursement, which records a fictitious customer return at a cash register, not a withdrawal from petty cash. Check tampering is wrong because no company check was forged, altered, or diverted.

Correct answer: New vendor master records matched against corporate filings and street addresses

New vendor master records matched against corporate filings and street addresses is the most useful trail because a shell company exists only on paper, so checking each newly added vendor against business registration records and a physical location exposes a payee with no real operations. Posted purchase order lines matched against goods receipts and supplier invoices is the three-way match, which confirms that ordered goods arrived but does not test whether the vendor itself exists, and shell vendors often bill for services or have the receipt approved by the fraudster. Current payroll register entries matched against personnel files and start dates is the test for ghost employees, not for fictitious vendors. Paid check payee names matched against disbursement journals and signature cards looks for altered payees and forged signatures in check tampering, while a shell company is paid by a properly signed check recorded to the very vendor named on it.

Correct answer: Nonaccomplice vendor invoicing for unshipped goods

Nonaccomplice vendor invoicing for unshipped goods is correct because the company is billed for, and pays for, goods it never received, the false-invoicing variant of a billing scheme for goods not received. Accomplice vendor invoicing for overinflated goods describes a kickback arrangement in which a colluding vendor overbills and shares the excess, and the scenario shows neither collusion nor inflated prices. Phantom corporation invoicing for overpriced goods describes a pass-through scheme, in which the employee's own shell company buys real goods and resells them to the employer at a markup, so the goods do arrive. Established vendor invoicing for nonbusiness goods describes a personal purchases scheme, in which the company pays for items the employee keeps, whereas here nothing was delivered at all.

Correct answer: Paying ghost employees

Paying ghost employees is correct because reconciling the payroll register to the human resources list of active employees exposes anyone being paid who is not a legitimate current employee, the signature of a ghost employee scheme. Padding staff overtime is a falsified hours scheme carried out through real employees who appear on both lists, so the reconciliation would match. Boosting sales bonuses is a commission scheme on genuine staff, found by comparing commissions with recorded sales. Altering base salaries is a falsified salary scheme on real employee records, found by comparing pay rates with approved personnel actions rather than by a headcount match.

Correct answer: Falsified wage records

Falsified wage records is correct because a real employee's reported hours were overstated so that excess pay was issued, which is a falsified hours and salary scheme even when that employee is a willing accomplice. Ghost employee payroll is wrong because a ghost is someone on the payroll who does not actually work for the company, while this employee is genuine and works. Payroll kickback deals is wrong because a kickback is a corruption payment from a vendor or other party in return for a favorable decision; splitting the inflated pay between two conspirators does not change the source of the money, which is falsified hours. Sales commission fraud is wrong because no sales commissions are involved; the pay was inflated through the hours reported.

Correct answer: Mischaracterized travel costs

Mischaracterized travel costs is correct because the vacation was a real expense that was personal, and it was presented as client entertainment to obtain reimbursement. Overstated conference charges is wrong because an overstated expense is a genuine business cost reported at a higher amount, while here the nature of the expense, not its amount, was falsely described. Fictitious hotel reservations is wrong because a fictitious expense never occurred at all, and this vacation did take place. Multiple hotel reimbursements is wrong because the multiple reimbursements scheme submits one expense more than once, and nothing indicates a repeated claim.

Correct answer: Overstated restaurant charges

Overstated restaurant charges is correct because the meal was a real expense whose receipt was altered to show more than was actually paid, so the reimbursement exceeds the true cost. Mischaracterized family meals is wrong because a mischaracterized expense presents a personal cost as a business one, while the problem here is the inflated amount. Fictitious business luncheons is wrong because a fictitious expense never happened, and this meal was actually bought. Multiple lunch reimbursements is wrong because the multiple reimbursements scheme claims the same expense more than once, which did not occur.

Correct answer: Register disbursement scheme

Register disbursement scheme is correct because false refunds and false voids are the two register disbursement methods, so grouping point-of-sale voids and refunds by cashier reveals the employee whose exception volume is out of line. Expense reimbursement scheme is wrong because those schemes run through employee expense reports, not register transactions. Unrecorded collection scheme is a skimming method in which cash is taken before any entry is made, so it leaves no void or refund to analyze. Unauthorized discount scheme is wrong because a discount is a separate point-of-sale exception that does not appear in a review of voids and refunds.

Correct answer: Fictitious refund entries

Fictitious refund entries is correct because the cashier recorded refunds for returns that never occurred and sent the value to a gift card she controlled, which is a false refund register disbursement scheme. Bogus voided transactions is wrong because a false void reverses a completed sale after the customer has left, and here refunds, not voided sales, were processed. Counterfeit refund checks is check tampering, which requires a company check to be forged or altered, and no check was issued. Customer refund kickbacks is wrong because it requires a customer who receives the refund and shares it with the cashier, whereas this cashier sent the value to a card she controlled herself.

Correct answer: Improper timing differences

Improper timing differences is correct because the revenue is real but is recognized in the current period instead of the later period in which it is earned, shifting results from one period to another. Booking fictitious revenues is wrong because fictitious revenue schemes record sales that never occurred, while these sales exist and are simply recognized too early. Inflating receivable values is an improper asset valuation method, such as failing to write down uncollectible accounts, and does not concern the period in which revenue is recorded. Concealing accrued expenses belongs to concealed liabilities and expenses, which understates costs rather than accelerating revenue.

Correct answer: Concealed liabilities and improper disclosures

Concealed liabilities and improper disclosures is correct because leaving a material pending lawsuit out of the footnotes hides a contingent liability that readers of the statements need, misstating the company's true financial position. Fictitious revenues and nonexistent purchasers describes recording sales that never happened, whereas this company hid a real obligation rather than inventing income. Falsified valuation and overstated inventories describes improper asset valuation, which inflates recorded assets rather than withholding information about a liability. Accelerated revenues and premature recognition describes timing differences, which move real revenue into an earlier period and have nothing to do with an undisclosed lawsuit.

Correct answer: Economic extortion

Economic extortion is correct because the inspector demanded payment by threatening to withhold an approval the applicant was entitled to, so the payment is coerced rather than offered. Commercial bribery is wrong because bribery is a payment offered voluntarily to influence a decision, and nothing here was offered before the inspector made his demand. Illegal gratuities is wrong because a gratuity is a reward given after a decision has been made, without any demand or prior agreement. Financial conflict is wrong because a conflict of interest arises from an official's hidden financial interest in the matter, not from a demand for payment.

Correct answer: A buyer awards a contract to a firm that secretly made him a partner

A buyer awards a contract to a firm that secretly made him a partner is correct because the buyer's undisclosed ownership interest in the winning firm, not a payment from outside, drives the decision, which is what defines a conflict of interest. A buyer awards a contract to a firm that previously paid him a bribe is bribery, a payment given to influence the decision before it is made. A buyer awards a contract to a firm that afterward mailed him a gift is an illegal gratuity, a reward given after the decision without any prior agreement. A buyer awards a contract to a firm that fearfully paid him a payoff is economic extortion, because the firm paid under threat of losing the business.

Correct answer: Returns are paid from new investor capital rather than investment gains

Returns are paid from new investor capital rather than investment gains is correct because a Ponzi scheme has no genuine earnings and uses deposits from newer investors to pay so-called returns to earlier ones, which a legitimate fund never does. Returns are paid from recruit membership fees rather than product sales describes a pyramid scheme, in which participants profit by recruiting others rather than from an investment pool run by a central operator. Returns are paid from leveraged option bets rather than stock dividends describes a legitimate, if risky, strategy that produces real gains and real losses. Returns are paid from unrealized price markups rather than cash profits describes aggressive valuation, which can overstate performance but does not by itself fund payouts with other investors' money.

Correct answer: The supply of new recruits is exhausted

The supply of new recruits is exhausted is correct because a pyramid pays each layer from the fees of the layer below it, so once new members can no longer be found, payouts stop and the structure collapses. The resale of member stock is saturated describes a symptom of inventory loading, but product sales are incidental in a pyramid, whose payouts depend on recruitment. The tolerance of state agencies is gone describes enforcement, which can end a scheme early but is not the reason the structure fails on its own. The capital of top promoters is drained is wrong because the promoters' own money never funds the payouts; every layer is paid from the fees of the recruits below it, so the structure fails when recruiting stops, not when the founders run short of funds.

Correct answer: Business email compromise

Business email compromise is correct because the fraudster impersonated a known vendor by email to get the employee to change the payment details, diverting the money to an account the fraudster controls. Email inheritance swindle is an advance-fee fraud, which asks the victim to pay fees up front to release a promised windfall, and no windfall was offered here. Email keylogger intrusion describes malware that records keystrokes to steal credentials, whereas this attack relied on a deceptive message, not on software installed on the employee's computer. Fictitious supplier bills describes shell-company billing, in which an insider creates a fictitious vendor and bills the company, whereas here the vendor was real and an outsider impersonated it.

Correct answer: Account takeover identity theft

Account takeover identity theft is correct because the criminal used stolen personal data to seize control of the victim's existing bank account and drain it. New account application schemes use a victim's identity to open new accounts, not to take over one that already exists. Business email compromise fraud impersonates an executive or vendor by email to trick an employee into sending money, and it does not involve seizing an individual's bank account. Dormant account insider larceny is theft by a bank employee from inactive accounts, while this criminal is an outsider using the victim's stolen data.

Correct answer: An employee uses the company van for a weekend delivery business

An employee uses the company van for a weekend delivery business is correct because the van is used for personal gain and then returned, which is misuse of a noncash asset rather than its theft. An employee sells the company laptops for a quick private profit is larceny of noncash assets, because the laptops are permanently taken. An employee removes the company lumber for a home garage project is also theft, since the materials are used up and never returned. An employee routes the company orders for a secret vendor payoff is a kickback, which is corruption rather than asset misappropriation.

Correct answer: Assigning the checks to a genuine supplier account

Assigning the checks to a genuine supplier account is correct because the controller disguised each self-payment as an ordinary payment to a real vendor, so the fraudulent checks blend into normal disbursements. Altering the returned checks to a substitute payee is wrong because nothing in the scenario says the returned checks were changed; the concealment described is in the books, not on the checks. Forcing the bank reconciliation to a bogus balance hides checks that were never recorded, whereas these checks were recorded. Charging the checks to a temporary suspense ledger would park them in a holding account awaiting classification, which is not what the controller did; he posted them to a real vendor.

Correct answer: Vendor billing scheme

Vendor billing scheme is correct because in a pay-and-return scheme an employee deliberately overpays or double-pays a real vendor's invoice and then intercepts the refund the vendor sends back, a billing-scheme tactic that needs no collusion from the vendor. Deposit kiting scheme is a bank fraud that exploits the float between accounts and does not involve vendor invoices. Supplier bribery ring describes corruption in which a vendor pays an employee for favorable treatment, whereas in pay-and-return the vendor is an innocent party. Sales skimming scheme removes incoming sales cash before it is recorded and has nothing to do with overpaying a supplier.

Correct answer: Improper revenue recognition

Improper revenue recognition is correct because booking sales to a related party that can return everything next quarter records revenue on transactions that lack economic substance, a financial statement fraud that inflates current results. Concealed ownership conflict is wrong because a conflict of interest turns on an employee's hidden interest in a transaction at the employer's expense, while the aim here is to misstate the company's reported revenue. Distributor rebate kickbacks are corruption payments to an employee in return for favorable treatment, and no payment to the manager is described. Distribution warehouse theft is theft of physical goods, whereas these goods were recorded as sold, not stolen.

Correct answer: Corruption is a primary branch and asset misappropriation is a parallel branch

Corruption is a primary branch and asset misappropriation is a parallel branch is correct because the Fraud Tree places corruption, asset misappropriation and financial statement fraud side by side as the three top-level categories of occupational fraud. Corruption is a secondary branch and asset misappropriation is a parent branch is wrong because corruption is not nested under asset misappropriation; bribery and conflicts of interest misuse influence rather than taking company assets. Corruption is a parent branch and asset misappropriation is a dependent branch is wrong for the mirror reason, since stealing cash or inventory requires no corrupt influence at all. Corruption is a state branch and asset misappropriation is a commercial branch is wrong because the Fraud Tree classifies schemes by how they are committed, not by sector, and corruption occurs inside private companies as well as government.

Correct answer: Residential mortgage fraud

Residential mortgage fraud is correct because inventing a homebuyer's income to qualify for a larger home loan is a material misrepresentation to the lender, a financial crime scheme. Mortgage elimination fraud is wrong because those schemes sell homeowners bogus legal theories for erasing an existing mortgage debt, usually for an upfront fee. Mortgage refinance swindle is wrong because no existing loan is being refinanced; this is a new purchase loan. Fictitious applicant fraud is wrong because the homebuyer is a real person; only the income figure was invented, not the borrower.

Correct answer: Fictitious revenue booking

Fictitious revenue booking is correct because sales to nonexistent customers were recorded to meet targets, the textbook fictitious revenue form of financial statement fraud. Revenue timing differences is wrong because a timing scheme records real sales in the wrong period, while these sales never happened at all. Inflating asset valuations is wrong because the overstated receivables are a by-product of the fake sales, not a separate valuation scheme such as failing to write down bad debts. Collected revenue skimming is wrong because skimming takes real cash before it is recorded, whereas here nothing was ever collected or taken.

Correct answer: A Ponzi relies on a central operator; a pyramid relies on a recruit network

A Ponzi relies on a central operator; a pyramid relies on a recruit network is correct because in a Ponzi scheme one promoter collects the money and pays earlier investors from later deposits, while in a pyramid participants earn by recruiting new members beneath them. A Ponzi relies on a recruitment chain; a pyramid relies on a single founder reverses the two structures. A Ponzi relies on a secret strategy; a pyramid relies on a retail warehouse is wrong because a Ponzi's claimed strategy does not exist, and a pyramid's products, if any, are incidental to recruiting. A Ponzi relies on a bank guarantee; a pyramid relies on a franchise license is wrong because no lender stands behind a Ponzi scheme, and a pyramid's payouts come from recruits rather than from any license.

Correct answer: Business email compromise

Business email compromise is correct because the fraudster registered a look-alike domain and posed as the CFO to get an employee to buy gift cards, the executive-impersonation form of business email compromise. Sweepstakes email swindle is an advance-fee scheme that tells victims they have won a prize and must pay a fee to collect it, which is not what happened here. Email keylogger infection is malware that secretly records keystrokes to steal passwords, while this attack relied on a deceptive request rather than on installed software. Commercial identity theft uses a business's identifying details, such as its tax or registration numbers, to obtain credit or goods from outside lenders and suppliers in the business's name, whereas this fraudster obtained no credit in the company's name and only mimicked its domain to deceive its own employee.

Correct answer: Identity theft crime

Identity theft crime is correct because synthetic identity fraud misuses personal identifying information, combining real data such as a genuine Social Security number with invented details, to build and exploit a false identity, which makes it a variant of identity theft. Identity data breach is wrong because a breach is the unauthorized exposure of stored records; it may supply the real details a criminal uses, but it is not the scheme itself. Fake identity papers is wrong because counterfeit documents are a tool some identity criminals use, not the category of scheme, and a synthetic identity is usually built through credit applications rather than forged papers. Bustout credit fraud is wrong because a bust-out is a way of cashing out credit lines, often after a synthetic identity has been built, rather than the scheme of which synthetic identity fraud is a variant.

Correct answer: Requiring a second employee to reconcile each register drawer

Requiring a second employee to reconcile each register drawer is correct because comparing recorded sales with the cash actually on hand, done by someone other than the cashier, exposes the shortages that on-book cash larceny leaves and that the cashier cannot hide. Requiring a senior supervisor to approve each register refund targets false refunds, a register disbursement scheme, not the outright theft of recorded cash. Requiring a customer receipt to accompany each register order helps prevent skimming of unrecorded sales but does nothing once a sale is recorded and the cash is then taken. Requiring a fidelity bond to safeguard each register position insures the company against losses after they occur; it does not reduce the opportunity to steal.

Correct answer: Stolen check tampering

Stolen check tampering is correct because intercepting incoming checks and converting them by forging the company's endorsement is a payment-tampering technique. Interbank check kiting is wrong because kiting moves money between bank accounts to exploit the float and does not involve stealing anyone's checks. Shell supplier billing is wrong because it bills the company through a fictitious vendor rather than stealing payments sent to the company. Counterfeit check ring is wrong because it manufactures fake checks drawn on real accounts, while these were genuine customer checks that were stolen and converted.

Correct answer: Identical receipts on two separate expense reports

Identical receipts on two separate expense reports is correct because submitting the same expense more than once for repeated payment is the defining feature of a multiple reimbursements scheme. Altered amounts on routine monthly expense reports point to overstated expenses, where a real cost is inflated, not to a repeated claim. Untraceable vendors on recent trip expense reports point to fictitious expenses supported by invented receipts. Vacation weekends on client dinner expense reports point to mischaracterized expenses, where personal costs are passed off as business ones.

Correct answer: Shell company scheme

Shell company scheme is correct because the fraudster must add the fictitious vendor to the vendor master file, or alter an existing entry, before the company will pay the shell company's invoices. Altered payee scheme changes the payee on a company check after it is issued, a form of check tampering that needs no change to the vendor master file. Ghost employee fraud requires access to the payroll master file, the human resources counterpart, rather than the vendor master file. Cash receipts scheme, such as skimming or cash larceny, steals incoming cash before or after it is recorded and never touches the vendor master file.

Correct answer: Improper capitalization

Improper capitalization is correct because recording ordinary repair costs as long-term assets removes them from current expenses, overstating both earnings and assets, which is financial statement fraud. Asset misappropriations is wrong because nothing was stolen or misused; the assets on the books were inflated, not taken. Subcontractor kickbacks is wrong because a kickback is a corrupt payment from a vendor to an employee, and no such payment is described. Fictitious expenditures is wrong because the repair costs were real; the fraud lies in how they were classified, not in inventing them.

Correct answer: Outright bribery

Outright bribery is correct because bribery is offering or giving something of value to influence an official act or business decision before it is made. Illegal gratuity is wrong because a gratuity rewards a decision after it has been made, with no prior agreement to influence it. Extortion demand is wrong because economic extortion runs the other way: the employee or official demands the payment by threatening harm. Hidden conflicts is wrong because a conflict of interest is an undisclosed personal or financial interest in the outcome, not a payment from a third party.

Correct answer: Noncash larceny hidden by fake breakage records

Noncash larceny hidden by fake breakage records is correct because the manager stole physical inventory and concealed the theft by writing the goods off as damaged, a noncash asset misappropriation concealed by a false write-off. Fictitious sales hidden by fake invoice reports is a financial statement fraud that inflates revenue, whereas this manager removed goods from the books rather than adding sales. Unrecorded sales hidden by fake register claims describes skimming, in which cash from a sale is taken before it is recorded; here the company's goods, not its sales cash, were stolen. Improper valuation hidden by fake reserve slips is a financial statement fraud that misstates asset values to mislead readers of the statements, while this write-off existed only to hide a theft.

Correct answer: Ghost employee payments

Ghost employee payments is correct because the pay for fictitious employees is usually routed into an account the fraudster controls, so the same bank account number appears under more than one name on the payroll. Inflated employee hours is a falsified hours scheme that overpays a real employee into that employee's own account, so it creates no duplicate account numbers. Rigged employee bonuses is a commission scheme on genuine staff, found by comparing bonuses with recorded sales. Fictitious refund slips is a false refund register disbursement scheme carried out at the point of sale, not through direct deposit payroll.

Correct answer: Illegal gratuity

Illegal gratuity is correct because the vacation rewarded a decision that had already been made, with no agreement beforehand to influence it. Corporate bribes is wrong because bribery requires the benefit to be offered or agreed on in order to influence the decision before it is made. Vendor kickbacks is wrong because a kickback returns part of an inflated or overbilled payment under a prior arrangement, and no such arrangement existed. Extorted payoffs is wrong because economic extortion involves a demand backed by a threat, and the supplier gave the vacation voluntarily.

Correct answer: Ponzi scheme

Ponzi scheme is correct because affinity fraud exploits the trust inside a religious or ethnic community to sell a fraudulent investment, and an investment that pays early members with later members' money instead of real returns is a Ponzi scheme. Pyramid scheme is wrong because a pyramid pays participants mainly for recruiting others, while the fraud described here is pitched as an investment that promises returns. Matrix scheme is wrong because a matrix scheme sells a cheap product as the price of a place on a waiting list for a costlier one, a recruitment-driven pyramid variant rather than an investment that promises returns. Microcap fraud is wrong because it pumps up the price of a thinly traded small company's stock through spam and cold calls to strangers and then dumps the shares, whereas affinity fraud sells its investment through the trust of the fraudster's own community.

Correct answer: Deceptive text messages used to steal data or money

Deceptive text messages used to steal data or money is correct because smishing is phishing carried out by SMS text message. Deceptive spoofed calls used to steal data or money describes vishing, which uses voice calls. Deceptive email notices used to steal data or money describes ordinary phishing, which uses email. Business email requests used to steal data or money describes business email compromise, which impersonates a supplier or executive by email rather than by text message.

Correct answer: Identity theft and card fraud

Identity theft and card fraud is correct because skimmed card numbers and related data are used to make counterfeit cards and unauthorized purchases in the cardholder's name, which is identity theft and payment card fraud. Loyalty card and rebate fraud is wrong because it abuses a retailer's rewards program, which skimmed payment data does not unlock. Store card and warranty fraud is wrong because it exploits a merchant's own credit or return policies rather than a cardholder's account. Vendor invoice and wire fraud is a business email compromise tactic that impersonates a supplier to redirect payments and needs no card data at all.

Correct answer: An employee causes the company to issue a check to a fictitious vendor

An employee causes the company to issue a check to a fictitious vendor is correct because a fraudulent disbursement makes the company pay out money through its normal disbursement process for an illegitimate purpose, here a billing scheme. An employee causes the company to ship a pallet to a fictitious client is a noncash scheme, a fraudulent shipment of inventory rather than a payment of money. An employee causes the company to book a sale to a fictitious customer is fictitious revenue, a financial statement fraud that adds sales rather than paying anything out. An employee causes the company to steer a contract to a secret partner is a conflict of interest, a corruption scheme rather than a disbursement.

Correct answer: Misclassifying the payment in the general ledger

Misclassifying the payment in the general ledger is correct because recording a personal loan repayment as a consulting expense hides the fraudulent check among ordinary business expenses. Altering the vendor in the disbursement register would change the recorded payee, but the bookkeeper changed the account the payment was charged to, not the payee. Forcing the totals in the monthly reconciliation hides checks missing from the books, whereas this check was recorded. Voiding the voucher in the disbursement register would make the payment look canceled, while here it stayed on the books as an expense.

Correct answer: Invoices sized to evade dual-approval limits

Invoices sized to evade dual-approval limits is correct: amounts that land again and again just under the second-approver threshold show a billing scheme built around the approval control so no one else reviews the payments. Invoices inflated to fund off-book kickbacks is wrong because padding pushes amounts upward rather than holding them under a ceiling, and nothing in the pattern points to a payment back to an insider. Invoices double-paid to pocket refund checks describes a pay-and-return scheme, which surfaces as duplicate payments and vendor refunds, not as amounts clustered under a limit. Invoices re-billed to take middleman markups describes pass-through billing, which shows up as prices above market from an intermediary, not as invoice amounts tied to an approval threshold.

Correct answer: Newer customer receipts are applied to earlier accounts

Newer customer receipts are applied to earlier accounts is correct: in lapping, each new payment covers the account whose payment was skimmed before, so the shortage keeps moving and no single account stays past due long enough to draw attention. Stolen customer payments are booked to doubtful expense describes a write-off concealment, which closes the account permanently instead of rolling payments forward. Skimmed customer payments are booked to fake allowances describes concealment through false discounts or allowances, again a one-time adjustment rather than a rolling substitution of later receipts. Overdue balance notices are rerouted to clerk addresses keeps the customer from complaining, but it hides the shortage by intercepting mail, not by applying later receipts, so it is not how lapping works.

Correct answer: Fictitious refund scheme

Fictitious refund scheme is correct: in a false refund register disbursement the cashier records a refund for merchandise no one returned and keeps the cash, and every such refund is posted to sales returns and allowances, so an unexplained jump at one store is the classic red flag. False void disbursements are the other register disbursement scheme, but a false void reverses a completed sale as voided rather than posting a return. Cash skimming scheme is wrong because a cashier who skims at the register takes money from sales that are never rung up, so the theft leaves no recorded transaction behind, whereas a sudden returns spike confined to one store points to refunds recorded for merchandise no one brought back. Cash larceny scheme takes cash that has already been recorded, which produces a cash shortage rather than a rise in returns and allowances.

Correct answer: An employee okays padded vendor bills for a private payoff

An employee okays padded vendor bills for a private payoff is correct: the employee uses influence over a transaction so a supplier can overcharge, and is paid for it, which is a kickback and therefore corruption rather than direct theft of the employer's assets. An employee files sham vendor invoices for a shell company is a shell-company billing scheme, a form of asset misappropriation in which no outside party pays the employee. An employee edits vendor check payees for a secret deposit is check and payment tampering, also asset misappropriation. An employee files inflated meal claims for a bigger payout is expense reimbursement fraud, a third misappropriation scheme with no outside party buying the employee's influence.

Correct answer: Ponzi payout scheme

Ponzi payout scheme is correct: a central promoter takes money for a venture that does not exist and pays earlier backers their so-called profits out of newer investors' money, which is a Ponzi scheme. Pyramid sales fraud is wrong because a pyramid pays participants for recruiting new members, and the stem describes no recruiting by investors. Advance fee scheme describes victims paying up front to unlock a promised sum that never arrives, not an investment that pays fabricated returns. Penny stock scheme describes a pump-and-dump, in which promoters hype a thinly traded stock and sell into the rise rather than paying returns from new money.

Correct answer: Sole control over cash collections and ledger entries

Sole control over cash collections and ledger entries is correct: skimming needs the ability to take incoming money before it is recorded, and one person who both receives and records customer payments has exactly that opening. Sole control over supplier setup and payment approval is the opportunity for a billing scheme through a fictitious vendor, not for skimming incoming receipts. Sole control over check stock and bank reconciliation is the opportunity for check tampering, which targets outgoing company checks. Sole control over payroll setup and paycheck delivery is the opportunity for a ghost employee scheme, which also involves disbursements rather than unrecorded receipts.

Correct answer: Improper asset valuation

Improper asset valuation is correct: carrying receivables above their collectible value, for example by not reserving for bad accounts, overstates assets and makes the balance sheet look stronger, which is improper asset valuation financial statement fraud. Concealed expense scheme flatters results by leaving costs or obligations off the books, not by inflating receivables. Timing difference scheme moves revenue or expenses into the wrong period rather than overstating the value of an asset already on the books. Skimming of receivables is asset misappropriation that removes customer payments, which lowers the company's real assets instead of inflating their reported value.

Correct answer: Billing through a complicit genuine vendor

Billing through a complicit genuine vendor is correct: a real outside vendor knowingly invoices inflated quantities and splits the overpayment with the insider, a billing scheme that depends on collusion with the vendor. Billing through a nonexistent shell vendor is a shell-company billing scheme, and the stem describes a real outside vendor rather than an entity the employee created. Billing through a middleman markup company is a pass-through scheme, in which the insider's company resells real goods at a markup, which is not what the stem describes. Billing through a duped established vendor is a pay-and-return scheme with a non-accomplice vendor, and here the vendor is a willing partner sharing the overpayment.

Correct answer: A worker gets hired using a cousin's taxpayer number

A worker gets hired using a cousin's taxpayer number is correct: using another real person's Social Security number to pass employment checks misuses that person's identifying information, which makes it identity theft used to commit employment fraud. A worker gets hired using a phony bachelor's diploma is credential fraud; the worker lies about qualifications but does not assume anyone else's identity. A worker records time using a teammate's access card is buddy punching, a timekeeping fraud by a worker already employed under his own name. A worker gets hired using a friend's bogus reference is a false reference, a misrepresentation of work history rather than theft of another person's identity.

Correct answer: Register cash larceny

Register cash larceny is correct: in cash larceny the money has already been entered, so its removal leaves the drawer short, and force-balancing (keying a false figure so the count appears to reconcile) is the concealment that hides that shortage. Sales skimming scheme takes sales that are never rung up, so there is no recorded figure for the drawer to fall short of. Fictitious refund scheme records a refund to justify the cash taken, so the drawer already balances and needs no forced entry. False void disbursements likewise record a voided sale that matches the cash removed.

Correct answer: A firm builds trade credit, then orders massively and disappears

A firm builds trade credit, then orders massively and disappears is correct: a bust-out is planned from the start, with the business paying promptly to earn suppliers' trust, running up the largest possible purchases on credit, and then abandoning the debts. A firm kites interbank checks, then withdraws balances and quits describes check kiting, which exploits the clearing float between bank accounts rather than suppliers' credit. A firm pledges receivables twice, then borrows double and stalls describes double-pledging collateral, a loan fraud against lenders. A firm inflates reported earnings, then borrows big and defaults describes obtaining a loan on falsified financial statements, again a lender fraud rather than a supplier bust-out.

Correct answer: Ghost employee scheme

Ghost employee scheme is correct: a ghost employee is on the payroll but never badges in or appears in time records, so matching payroll headcount against badge-access or timekeeping data exposes people who are paid without being there. Falsified overtime scheme is wrong because a real employee who inflates hours does badge in, so the headcount matches and only the hours differ. Sales commission scheme inflates sales credited to a real salesperson, which a headcount comparison cannot reveal. Overstated expense scheme is an expense reimbursement fraud by a real employee, outside the payroll headcount entirely.

Correct answer: Unreported conflict of interest

Unreported conflict of interest is correct: the employee has an undisclosed personal stake, through a family member's ownership, in a vendor he approves, which is the defining feature of a conflict of interest. Commercial bribery of purchasers requires an outside party to offer something of value to influence the decision, and nothing is offered here. Economic extortion of suppliers requires the employee to demand payment under threat of harm to the vendor's business, which the stem does not describe. Acceptance of illegal gratuities means taking a gift given after a decision to reward it, whereas this employee's interest is ownership, not a gift.

Correct answer: Advance fee sweepstakes scam

Advance fee sweepstakes scam is correct: the victim is told of a prize and must pay taxes and fees up front to collect a payout that never exists, which is the pattern of advance-fee fraud. Social media romance swindle is wrong because a romance scheme builds a fake relationship and then asks for money for an emergency, not a fee to release a prize. Bogus check overpayment scam sends the victim a counterfeit check and asks for part of it back, whereas this victim receives nothing before paying. Revenue agency impostor scam has the fraudster pose as a tax authority demanding back taxes, while here the taxes are a pretext attached to a fictitious winning.

Correct answer: Billing scheme enabled by poor role segregation

Billing scheme enabled by poor role segregation is correct: one employee who can both create vendors and approve their invoices can set up a fictitious vendor and pay it, so testing for that overlap targets billing fraud. Kickback scheme enabled by lax award monitoring concerns a real vendor paying an insider for contract awards, which an analysis of who creates vendors does not detect. Payment tampering enabled by poor vault custody concerns access to blank checks and outgoing payments rather than the vendor master file. Expense scheme enabled by poor receipt checking concerns employee reimbursement claims, which do not pass through vendor setup at all.

Correct answer: A forged maker fakes the signer's signature; an altered payee swaps the named recipient on a signed check

A forged maker fakes the signer's signature; an altered payee swaps the named recipient on a signed check is correct: a forged-maker scheme fabricates the authorized signature on the organization's own check, while an altered-payee scheme takes a check that was properly prepared and signed and changes who it is payable to. A forged maker edits the recipient field; an altered payee forges the drawer's autograph on a blank check reverses the two schemes: changing the named recipient is the altered-payee scheme, and faking the drawer's signature is the forged-maker scheme. A forged maker signs the holder's endorsement; an altered payee doubles the face amount on a cashed check confuses forged maker with forged endorsement and confuses altered payee with an altered amount. A forged maker abuses the firm's power; an altered payee forges the recipient endorsement on a lost check describes an authorized-maker scheme and then a forged-endorsement scheme, neither of which is the pair asked about.

Correct answer: Register skimming scheme

Register skimming scheme is correct: skimming takes the money before the sale is ever entered, so the books never expect it and a comparison of recorded cash to cash on hand shows no shortage. Cash larceny scheme takes money that was already entered, so its removal leaves a visible shortage unless it is separately concealed. Fictitious refund scheme removes cash that had been recorded and hides it with a fake refund entry, so the funds were recorded in the first place. Outgoing check tampering manipulates the company's own disbursement checks, which shows up in bank reconciliations, not as an unrecorded receipt.

Correct answer: Early revenue recognition

Early revenue recognition is correct: the customer's deposit is real, but the revenue has not yet been earned, so recording it now to meet a quarterly target is premature revenue recognition, a timing-difference financial statement fraud. Fictitious revenue scheme records sales that never occurred, while this deposit came from a real customer for a real future sale. Improper asset valuations inflate balance sheet items rather than pulling revenue into an earlier period. Round-trip revenue swaps are reciprocal sales between two companies with no economic substance, and no such exchange occurs here.

Correct answer: An employee borrows company laptops and brings them back

An employee borrows company laptops and brings them back is correct: misuse is the unauthorized personal use of company assets that are later returned, so the organization loses the use of the asset for a time but not the asset itself. An employee scraps company tablets and sells them online is theft, with the write-off used to conceal the permanent removal. An employee orders company parts and hoards them forever is theft through the requisition process, because the parts never come back. An employee orders company materials and ships them home is theft through purchasing, a permanent diversion rather than temporary use.

Correct answer: Fictitious sales scheme

Fictitious sales scheme is correct: recording orders that do not exist just before the period closes and reversing them once the reporting deadline passes is financial statement fraud through fictitious or prematurely recognized sales. Fictitious refund scheme is a register disbursement in which a cashier records a fake return to take cash, not a period-end sales entry. Fictitious expense scheme is an expense reimbursement fraud in which an employee claims costs never incurred. Improper asset valuations overstate balance sheet items rather than booking sales that are later reversed.

Correct answer: Skimming of receivables

Skimming of receivables is correct: the employee took a customer's payment before it was posted, which is receivables skimming, and the fake credit memo conceals it by writing the customer's balance down so no past-due account appears. Larceny of receivables is cash larceny, which takes payments after they have been recorded and would show up as a shortage rather than call for a credit to the customer's account. Lapping of receivables is a different concealment for the same skimming, applying later payments to earlier accounts, and the stem describes a credit memo instead. Company check tampering involves the organization's own outgoing checks, not an incoming customer payment.

Correct answer: A contractor pays an official for confidential rival bids

A contractor pays an official for confidential rival bids is correct: corruption is the misuse of influence in a business transaction, and paying a public official to leak competitors' bids buys that official's influence over the award. A contractor bills an agency for unperformed road repairs is a false claim against the government, a billing fraud with no official being paid off. A contractor swaps an import for specified domestic steel is product substitution, which cheats the agency on performance rather than corrupting the award. A contractor inflates an invoice for unused rental trucks is overbilling, another fraud against the procurement that involves no bribe to an official.

Correct answer: Hyping a microcap stock with phony claims, then exiting near the peak

Hyping a microcap stock with phony claims, then exiting near the peak is correct: in a pump and dump, promoters inflate a thinly traded stock's price with false or misleading promotion and sell their own shares at the inflated price, leaving later buyers with the losses. Bashing a thin stock with bogus smears, then covering near the bottom describes short-and-distort, the mirror image, which profits from driving a price down. Paying a few backers with fresh funds, then fleeing near the collapse describes a Ponzi scheme, which pays earlier investors with new money rather than manipulating a traded share price. Buying a target stock with leaked tips, then selling near the release describes insider trading on material nonpublic information, which needs no false promotion at all.

Correct answer: Third-party review of travel claims against itemized receipts

Third-party review of travel claims against itemized receipts is correct: having someone other than the claimant compare each expense report with original itemized receipts removes the opportunity to mischaracterize, overstate, invent or duplicate expenses. Three-way match of supplier invoices against delivery records is a strong control for billing schemes, but vendor invoices are not employee reimbursement claims. Positive-pay match of issued checks against bank presentments targets check tampering on outgoing company checks, not inflated expense claims. Annual sign-off of employee conduct against written standards works on attitude and rationalization rather than removing the opportunity to submit a false claim.

Correct answer: Shell-company vendor scheme

Shell-company vendor scheme is correct: an entity registered only to invoice the victim for goods or services it never provides is a shell company, and billing through it is the defining shell-company billing scheme. Pass-through vendor scheme is wrong because a pass-through entity buys real goods or services and resells them at a markup, so something is actually delivered. Non-accomplice vendor scheme describes pay-and-return, which runs through a legitimate vendor that is overpaid and then refunds the excess, not a business set up for the fraud. Vendor identity theft scheme would hijack an existing supplier's name and payment details to redirect what the employer owes that supplier, whereas this fraudster registers a new business of his own and steals no one's identity.

Correct answer: A subcontractor pays the site engineer to approve inflated change orders

A subcontractor pays the site engineer to approve inflated change orders is correct: a kickback is a payment from a vendor to an insider in return for approving inflated or unearned charges, and here the payment buys approval of padded change orders. A foreman steers the millwork subcontract to secretly owned family firms is a conflict of interest, an undisclosed personal stake with no payment from an outside party. A subcontractor dilutes the concrete mix to pocket material cost savings is product substitution, which defrauds the owner but involves no payment to an insider. A subcontractor bills the property owner to charge unworked labor shifts is a billing fraud for labor never performed, again with no insider receiving a payment.

Correct answer: Fictitious refund scheme

Fictitious refund scheme is correct: a refund entered with no customer present is a fictitious return, the core of a false refund register disbursement scheme, in which the cashier records a refund for merchandise no one brought back and keeps the cash. False void disbursements reverse a sale, typically using a customer's receipt, rather than processing a return. Cash larceny scheme takes money from the till without entering any refund at all. Register skimming scheme takes sales before they are rung up, so there is no refund transaction for the footage to show.

Correct answer: Bribery involves outsiders buying decisions; a conflict of interest involves undisclosed personal stakes

Bribery involves outsiders buying decisions; a conflict of interest involves undisclosed personal stakes is correct: bribery is a third party offering something of value to influence an official act or business decision, while a conflict of interest arises when the employee has an undisclosed economic or personal interest of his own in the transaction. Bribery involves undeclared shareholding stakes; a conflict of interest involves outside vendor payments swaps the two definitions: the hidden ownership stake belongs to the conflict of interest, and the outside payment belongs to bribery. Bribery involves governing officials exclusively; a conflict of interest involves private company stakes is wrong because commercial bribery between private parties is still bribery, and a conflict of interest can arise in a government post or through an interest other than a stake in a private company. Bribery involves finalized procurement awards; a conflict of interest involves resulting employer losses is wrong because bribery is complete once the offer is made to influence a decision, and a conflict of interest does not require proof of loss.

Correct answer: Internet romance scam

Internet romance scam is correct: the fraudster builds a fake online relationship and then uses the victim's trust to obtain money for an invented crisis, which is the romance form of social-engineering consumer fraud. Family emergency scam is wrong because that scheme impersonates a grandchild or other relative in distress, not a romantic partner. Tech support swindle poses as a computer help desk and charges for fake repairs or remote access, with no relationship involved. Fake charity scam solicits donations for a sham cause or disaster, which is not money sent to a supposed partner.

Correct answer: Improper asset valuations

Improper asset valuations is correct: overstating ending inventory, for example by inflating counts, carries assets above their real value and lowers cost of goods sold, which raises net income; this is improper asset valuation financial statement fraud. Fictitious revenue scheme inflates revenue by recording sales that never happened rather than manipulating inventory counts. Inventory larceny schemes are noncash asset misappropriation, which reduces actual inventory instead of overstating it on the books. Concealed liability fraud flatters the statements by leaving obligations out, not by inflating the inventory figure.

Correct answer: Check tampering

Check tampering is correct: check and payment tampering is the scheme in which the perpetrator physically prepares, alters, forges or diverts the organization's own checks or electronic payments and converts them for personal benefit. Skimming scheme takes incoming money before it is recorded, not an outgoing company payment. Kickback scheme is wrong because the company's payment goes to a real vendor, which deposits it and then pays the employee out of its own funds, so the perpetrator never handles or converts the company's instrument; a kickback is corruption, not a fraudulent disbursement. Deposit larceny is cash larceny of recorded incoming receipts, which again involves money coming in rather than the company's own outgoing instrument.

Correct answer: An employee with sole vendor setup authority and payment approval

An employee with sole vendor setup authority and payment approval is correct: capability is the position and skill needed to commit and conceal the fraud, and being able to create vendors and approve their payments with no independent review is exactly the capability a complex billing scheme needs. An employee with heavy overdue household debts and hospital bills describes pressure, the motive side of the fraud triangle, not the capability to carry out a billing scheme. An employee with old unresolved pay grudges and career resentment describes rationalization, the attitude used to justify fraud. An employee with unvetted payroll edit rights and paycheck pickup has capability for a payroll scheme such as ghost employees, not for a billing scheme.

Correct answer: Identity theft

Identity theft is correct: filing benefit claims under the stolen identities of real workers misuses other people's personal identifying information to obtain government benefits, which is identity theft committed as benefits fraud. Ghost employees are nonexistent people added to an employer's payroll so their paychecks can be collected, while these claims use real people and are filed against a benefits program. Phishing scheme describes one way of harvesting personal data, not the scheme of filing claims in other people's names. Synthetic fraud builds new identities from a mix of real and invented data, whereas the stem says the identities of real workers were used as they are.

Correct answer: Billing for phantom deliveries

Billing for phantom deliveries is correct: invoices that are paid while the goods never show up in receiving records point to a billing scheme for goods not received. Billing for duplicate invoices is a duplicate-payment or pay-and-return scheme, in which goods were received once and paid for twice. Billing for middleman markups is a pass-through scheme, in which real goods are delivered through an intermediary at an inflated price, so receiving records would show them. Billing for overpriced goods describes overcharging, typically funded by a kickback, where the goods do arrive but cost too much.

Correct answer: Rotating checks from linked banks to inflate float balances

Rotating checks from linked banks to inflate float balances is correct: check kiting writes checks between accounts at different banks and exploits the time checks take to clear, so each account shows money that does not actually exist. Passing checks from closed accounts to acquire retail goods describes paper hanging, which relies on worthless checks rather than on float between banks. Washing checks from pilfered mail to overwrite payee fields describes check alteration, a form of check theft and forgery. Sending checks from bogus buyers to get overpayment refunds describes the counterfeit-check overpayment scam aimed at sellers, not kiting between the fraudster's own accounts.

Correct answer: Unsupported travel advances

Unsupported travel advances is correct: an employee who approves his own travel advances and never submits receipts to reconcile them keeps money the company advanced for business travel without ever showing that it went to business costs, which is expense reimbursement fraud through unsupported advances. Mischaracterized trip costs are personal costs written up as business costs on a submitted expense report, so the fraud sits in a false description on a claim; this employee files no claim and describes nothing, and the advance is simply kept. Skimmed travel advances is wrong because skimming takes incoming cash before it is recorded, while a travel advance is a payment the company itself makes and records. Forged travel advances is wrong because forgery means signing another person's name or approval, and this employee approves the advances under his own authority.

Correct answer: Omitting a material related-party footnote

Omitting a material related-party footnote is correct: leaving out a disclosure that users need, such as a significant transaction with a related party, is financial statement fraud through improper disclosure even when every recorded number is accurate. Neglecting a reasonable bad-debt allowance overstates receivables, which is improper asset valuation. Recording a fabricated period-end shipment creates sales that did not occur, which is fictitious revenue. Excluding a substantial past-due liability leaves an obligation off the books, which is concealed liabilities rather than a missing disclosure.

Correct answer: Skimming takes unrecorded receipts; a false refund removes recorded cash

Skimming takes unrecorded receipts; a false refund removes recorded cash is correct: skimming takes money before it is ever entered in the books, while a false refund is a register disbursement that creates a recorded but fictitious refund to justify taking cash that had already been recorded. Skimming siphons logged takings; a false refund pockets unlogged revenue reverses the two schemes. Skimming avoids ledger entries; a false refund escapes register postings is wrong because a false refund, unlike skimming, leaves a recorded refund transaction behind. Skimming creates drawer shortages; a false refund needs buyer signatures is wrong on both counts: skimming leaves no shortage because the sale was never recorded, and a false refund needs no customer signature.

Correct answer: Round-tripping fraud

Round-tripping fraud is correct: two companies buy equal amounts from each other with no economic substance, so both report revenue that reflects no real sale, which is financial statement fraud through round-tripping. Channel stuffing ships excess goods to distributors to pull sales into the period, without any reciprocal purchase. Bill-and-hold revenue is recognized on goods billed but not shipped, which also involves no matching purchase from the customer. Concealed liabilities understate obligations and expenses rather than inflating revenue through reciprocal sales.

Correct answer: Corruption, asset misappropriation, or statement fraud by staff

Corruption, asset misappropriation, or statement fraud by staff is correct: occupational fraud is the use of one's job for personal enrichment through the deliberate misuse of the employing organization's resources, and its three categories are corruption, asset misappropriation and financial statement fraud committed by people inside the organization. Robbery, counterfeit currency, or chargeback fraud by outsiders describes external crimes by customers and strangers, not employees. Collusion, inflated invoices, or bid suppression by contractors describes vendor fraud committed from outside the organization. Bribery, tax fraud, or environmental violations by corporations describes crimes committed by or for the organization itself, not by an employee against it.

Correct answer: Noncash larceny by undercharging

Noncash larceny by undercharging fits: ringing up friends' goods at an unauthorized discount lets company merchandise leave the store unpaid for, a noncash asset misappropriation in which no cash reaches the cashier. Sales skimming by understatement is wrong because skimming means the cashier pockets sale proceeds before they are recorded, and this cashier keeps nothing. Register disbursement by voiding is wrong because a false void pays cash out of the drawer for a sale that supposedly never happened, and no void is processed here. Cashier kickbacks by discounting is wrong because a kickback requires the cashier to receive a payment for the favor, and nothing in the facts shows any payment.

Correct answer: A vendor gives free renovations to a manager who keeps awarding contracts

A vendor gives free renovations to a manager who keeps awarding contracts illustrates it: the renovations are a noncash thing of value given to influence contract awards, which is bribery with something of value other than cash. A supplier wires cash kickbacks to a manager who keeps approving invoices is corruption, but the thing of value is cash. A family business sells materials to a manager who keeps hiding ownership is a conflict of interest: the manager buys from a firm the family owns, and no outside party hands the manager anything of value. A clerk passes company laptops to a manager who keeps reselling equipment involves noncash property, but it is stolen company property, an asset misappropriation rather than a corrupt payment.

Correct answer: Overstated travel reimbursement

Overstated travel reimbursement fits: the trips were real, and the mileage on each was nudged upward, so every claim exceeds the cost actually incurred. Fictitious hotel reimbursements would invent expenses that never took place, but these trips occurred. Mischaracterized expense claims present personal costs as business costs, which is not what slightly inflated mileage on business trips shows. Multiple expense reimbursements claim the same expense more than once, whereas here each trip is claimed once at an inflated figure.

Correct answer: Taking tiny sums across many accounts so each shortfall remains unnoticed

Taking tiny sums across many accounts so each shortfall remains unnoticed is salami slicing: each slice is too small to draw attention, but together the slices add up to a significant loss. Splitting one purchase across several orders so each avoids review limits is split purchasing, which slips one large purchase past approval rather than stealing small amounts. Breaking cash deposits across several days so each avoids federal reports is structuring, a money laundering technique used to evade currency transaction reporting. Shifting later receipts across older balances so each gap stays concealed is lapping, which covers one stolen payment with the next rather than taking many tiny sums.

Correct answer: Double payment billing using reprinted invoices

Double payment billing using reprinted invoices fits: the same invoice number paid twice to one vendor within a short window means an invoice was resubmitted and paid again. Shell company billing using fabricated invoices would show an unfamiliar vendor billing for fictitious work, not one vendor's invoice numbers repeating. Accomplice vendor billing using padded invoices inflates the amount on an invoice rather than paying the same invoice number twice. Personal purchase billing using vendor invoices charges the company for goods the employee keeps, and it does not depend on duplicate invoice numbers.

Correct answer: Payment card fraud using hijacked identities

Payment card fraud using hijacked identities fits: the ring buys goods with card numbers that belong to other people, which is identity theft carried out through payment card fraud. Synthetic card fraud using invented profiles opens new accounts under made-up identities, but this ring uses real victims' existing card data. Retail return fraud using stolen merchandise brings goods back to a store for refunds, while this ring resells what it buys. Card chargeback fraud using bogus complaints is committed by cardholders who dispute their own genuine purchases, not by strangers using someone else's card.

Correct answer: Statement fraud flatters reported results; misappropriation enriches the thief

Statement fraud flatters reported results; misappropriation enriches the thief states the contrast: financial statement fraud mainly improves how the organization's results look, while asset misappropriation moves assets straight to the person who takes them. Statement fraud pays the perpetrator; misappropriation boosts company earnings reverses the two, and misappropriation drains earnings rather than boosting them. Statement fraud favors outside investors; misappropriation rewards the culprit fails on its first half, because investors who rely on inflated statements are among the main victims. Statement fraud lowers corporate taxes; misappropriation rewards the employees also fails on its first half, because statement fraud usually overstates income, which raises the tax bill rather than lowering it.

Correct answer: Shell company invoices coded in catch-all accounts

Shell company invoices coded in catch-all accounts fits: a sudden rise in miscellaneous or consulting expense paid to new vendors is the classic sign of a billing scheme that pays fictitious suppliers out of accounts that draw little scrutiny. Personal travel claims coded in catch-all accounts would come through employee expense reports, not as payments to new vendors. Ghost employee payroll coded in catch-all accounts is a payroll scheme, and ghost employees are paid through payroll rather than set up as new vendors. Vendor kickback markup coded in catch-all accounts inflates an existing vendor's prices in its usual purchase accounts rather than adding new vendors.

Correct answer: Authorized maker scheme with a spurious payee

Authorized maker scheme with a spurious payee fits: an employee who is allowed to sign checks writes them for invented commissions to a relative, which is check tampering by an authorized maker paying a fictitious obligation. Forged endorsement scheme with a stolen check describes someone intercepting a check meant for another payee and endorsing it falsely, but this employee wrote the checks directly. Commission scheme with a doctored sales total inflates a salesperson's own commission through payroll, and no payroll entry or sale is involved here. Shell company billings with a bogus agreement bills the company through invoices from a fictitious vendor, whereas these checks went to a relative with no vendor or invoice at all.

Correct answer: The company accepts costlier terms due to the buyer's hidden stake

The company accepts costlier terms due to the buyer's hidden stake describes the harm: an employee with an undisclosed interest steers purchases, so the employer overpays or accepts unfavorable terms. The company funds phantom goods due to the vendor's bogus invoices describes a billing scheme for goods not received, not a conflict of interest. The company reports padded profits due to the clerk's fake entries describes financial statement fraud, which misstates results rather than skewing a purchase. The company loses supplies due to the clerk's private resale habit describes theft of inventory, an asset misappropriation rather than a hidden interest in a deal.

Correct answer: Skimmed collections hidden by lapping later payments

Skimmed collections hidden by lapping later payments fits: lapping covers each stolen customer payment with the next one received, so the scheme needs daily attention, which explains a worker who is never absent and blocks any review of receivables. Stolen remittances hidden by writing off receivables is a one-time concealment that does not require the perpetrator to be present every day. Account shortages covered by kiting interbank checks exploits bank float between accounts rather than customer receivables. Fictitious sales hidden by booking bogus receivables inflates revenue on the financial statements and does not explain a clerk guarding receivables from review.

Correct answer: Buying and selling one security to inflate volume

Buying and selling one security to inflate volume is wash trading: the same party sits on both sides of the trades, so volume rises with no real change in ownership and misleads other investors. Placing and canceling huge orders to shift prices is spoofing, which relies on orders never meant to execute rather than completed trades with oneself. Hyping and dumping cheap stocks to lure investors is a pump-and-dump scheme, which relies on promotion followed by a sell-off. Knowing client orders and acting ahead to benefit is front running, which trades on advance knowledge of customer orders.

Correct answer: Ghost employee scheme using a discharged worker

Ghost employee scheme using a discharged worker fits: pay that keeps flowing after a documented termination date means the departed worker's record was left active so someone could collect the checks. Overtime employee scheme using a faked timecard is a falsified-wages scheme that inflates hours for someone still on the job. Employee commission scheme using a phantom sale inflates commission pay through invented sales, not pay to someone who has left. Employee disability scheme using a faked injury is a workers' compensation scheme, which draws benefits rather than continuing regular paychecks.

Correct answer: Diverting a valid invoice payment to a hacker's account

Diverting a valid invoice payment to a hacker's account is invoice redirection: the invoice is genuine, but the payer is deceived, often by a spoofed email from the vendor, into changing the bank details so the money reaches the fraudster. Rerouting a purchased goods shipment to a clerk's house diverts goods, not an invoice payment. Emailing a phony vendor invoice to a company's payables bills for work that never existed, while redirection exploits a genuine invoice. Presenting a bogus delivery invoice to a client's buyer bills for goods that were never delivered, a billing scheme rather than a redirected payment.

Correct answer: Fake register disbursements

Fake register disbursements fits: false refunds and false voids pay cash out of the register, so a cashier whose refund rate runs far above the peer group is exactly what this benchmark exposes. Unrecorded register revenue is skimming, which leaves no refund on record at all. Embezzled register currency is cash larceny, which takes recorded cash without processing any refund. Undercharged register sales give goods away at reduced prices, a pattern that shows in discount and markdown data rather than in refund rates.

Correct answer: Financial statement fraud through concealed liabilities and expenses

Financial statement fraud through concealed liabilities and expenses fits: the executive's misstated compensation entries understate the compensation expense the company records, which is the concealed liabilities and expenses category, so reported earnings look better than they are. Financial statement fraud through inflated receivables and inventory is an improper asset valuation scheme that overstates asset balances, while this executive's misstated entries were compensation expense, which touches no receivable or inventory. Financial statement fraud through fictitious revenues and deliveries books sales that never happened, while this executive manipulated expense entries, not revenue. Financial statement fraud through improper footnotes and disclosures misleads readers through the notes and leaves the recorded figures as they are, whereas this executive changed the recorded expense itself.

Correct answer: A supplier slips a buyer untraceable cash to win contracts

A supplier slips a buyer untraceable cash to win contracts is an off-book corruption payment: the bribe moves entirely outside the victim organization's records, so its books show no trace of it. A cashier pockets a customer payment to settle large debts is also off the books, but it is skimming, not corruption, because no outside party pays anyone for influence. A bookkeeper settles a sham vendor invoice to siphon funds runs through the company's own payables, an on-book billing scheme. A manager hides a personal vendor stake to steer purchases is a conflict of interest: the manager profits through an undisclosed ownership interest, and no vendor pays anyone to win the business.

Correct answer: Hidden auto-renewal scam

Hidden auto-renewal scam fits: a free trial that silently converts into recurring charges the consumer never agreed to is a deceptive recurring-billing consumer fraud. Advance-fee prize scheme asks victims to pay up front to claim a prize, rather than enrolling them in ongoing charges. Card-data identity theft involves a stranger misusing stolen card details, whereas this consumer handed the card over for the trial. Phony tech-support fraud persuades victims to pay for bogus repairs to a device, not to keep paying for a trial they signed up for.

Correct answer: Most employees handle exploitable property in their daily work

Most employees handle exploitable property in their daily work explains the role of opportunity: nearly every job touches some cash, inventory or payment process, which is why asset misappropriation is so widespread. Most employees face financial pressures in their private lives describes pressure, a different side of the fraud triangle. Most employees rationalize modest thefts in their own judgment describes rationalization, not opportunity. Most employees lack practical access in their junior positions reverses the point: broad everyday access is exactly what makes the opportunity so common.

Correct answer: Tampering with remitted company checks

Tampering with remitted company checks fits: comparing the cleared check image with the check register exposes an altered payee or a forged endorsement, the marks of check and payment tampering. Kiting with interlinked account checks exploits float between bank accounts, and the payee and endorsement on each check are genuine. Billing with fictitious shell invoices produces checks payable to the shell exactly as recorded, so a payee comparison shows nothing amiss. Commission padding with payroll checks inflates the amount paid to a real salesperson whose name and endorsement are correct.

Correct answer: Adding a ghost employee and siphoning the wages

Adding a ghost employee and siphoning the wages fits: the company believes it is paying a worker, but the payroll disbursement goes to the fraudster, which is a fraudulent disbursement disguised as payroll. Inventing a temp agency and paying the invoices is a shell company billing scheme run through accounts payable, not payroll. Inflating a meal claim and pocketing the excess is an expense reimbursement scheme. Signing a company check and miscoding the entry is check tampering by an authorized maker, which runs through the check register rather than payroll.

Correct answer: Ponzi payout scheme approaching bankruptcy

Ponzi payout scheme approaching bankruptcy fits: a Ponzi operator pays earlier investors with money from new ones, so blocking redemptions with shifting excuses while still raising new money signals that inflows can no longer cover what is owed. Pyramid recruitment scheme losing recruits pays participants for signing up others rather than promising returns from a managed fund. Microcap promotion scheme dumping holdings is a pump-and-dump, in which promoters sell their own shares into hype rather than holding investor money that must be redeemed. Boiler room telemarketers pushing equities sell dubious stock by high-pressure calls, and investors hold the shares themselves, so there is nothing to redeem.

Correct answer: A legitimate MLM relies on consumer sales; a pyramid relies on recruitment fees

A legitimate MLM relies on consumer sales; a pyramid relies on recruitment fees states the real test: a lawful company is sustained by genuine product sales to end users, while a pyramid survives on payments from each new layer of recruits. A legitimate MLM relies on direct sellers; a pyramid relies on downline bonuses is wrong because lawful MLMs also pay commissions on a downline's sales, so downline pay alone does not mark a pyramid. A legitimate MLM relies on state permits; a pyramid relies on unlicensed agents is wrong because regulators do not pre-approve MLM plans, and registration does not make a pyramid lawful. A legitimate MLM relies on limited levels; a pyramid relies on unlimited layers is wrong because the number of levels does not decide legality; the source of the money does.

Correct answer: Payment of commercial bribery

Payment of commercial bribery fits: the vendor secretly pays the manager while the manager steers bids its way and leaves the rejections undocumented, which is a bribery or kickback corruption scheme. Payment of illegal gratuities rewards a decision after the fact without any agreement to influence it, whereas these payments go with a steady stream of awards. Payment of economic extortion would require the manager to demand money under threat of harm to the vendor, which the facts do not describe. Personal conflict of interest involves the manager's own undisclosed stake in the vendor, while here an outside vendor pays the manager.

Correct answer: Improper asset valuations

Improper asset valuations fits: fabricating support such as fake bank confirmations to prop up overstated balances inflates or invents assets on the balance sheet, the improper asset valuation category of financial statement fraud. Noncash asset requisition is a larceny method in which an employee uses requisition paperwork to move company property out, which removes assets rather than inventing them. Fictitious sales revenues book sales that never occurred, while this scheme fabricates support for asset balances. Corporate asset larcenies take real company property, which leaves the books overstated only as a side effect, not through fabricated confirmations.

Correct answer: A promoter peddles worthless pre-IPO shares to the public

A promoter peddles worthless pre-IPO shares to the public is consumer-facing investment fraud: an outsider targets members of the public with a sham investment, rather than an employee defrauding an employer. A CFO reports padded post-merger profits to the investors is financial statement fraud committed through the CFO's position, which makes it occupational fraud even though investors are harmed. A VP steers lucrative sole-source contracts to the vendor is an employee abusing a position to favor a supplier, an occupational corruption scheme. A CEO expenses high-end personal vacations to the company is expense reimbursement fraud against the employer, also occupational.

Correct answer: Personal purchases billed through a sham supplier

Personal purchases billed through a sham supplier fits: the employee set up the vendor, had the goods sent home and approved the invoice, so the company paid for the employee's own purchases through a billing scheme. Inflated resales moved through a middleman vendor is a pass-through scheme, in which goods reach the company at a marked-up price, but here the goods went to a personal address. Company stock diverted through a personal address is noncash larceny of existing inventory, while these goods were bought on a fraudulent invoice. Personal expenses charged through a business card is purchasing-card misuse, which needs no fake vendor or approved invoice.

Correct answer: Billing for undelivered goods

Billing for undelivered goods fits: matching receiving documents to vendor invoices exposes invoices for shipments that never arrived, the core of a billing scheme for goods not received. Billing for overpriced resale is a pass-through scheme, in which the goods do arrive, so receiving documents match and only the price is wrong. Billing for invented services involves nothing that passes through receiving, so a receiving-document match cannot expose it. Kickbacks for steering orders are paid outside the company's records and leave invoices matching real deliveries.

Correct answer: A fraudster uses a victim's identity to live continually as that person

A fraudster uses a victim's identity to live continually as that person describes identity cloning: the impostor takes over the victim's identity for daily life and work over an extended period. A fraudster uses a victim's identity to receive surgery as that patient is medical identity theft, limited to obtaining treatment or benefits. A fraudster uses a victim's identity to face charges as that individual is criminal identity theft, in which an arrested person gives the victim's name. A fraudster uses a victim's identity to open accounts as that applicant is financial identity theft through new accounts, not living as the victim.

Correct answer: Recording fictitious noncash revenues or assets

Recording fictitious noncash revenues or assets fits: entries that raise reported margin without bringing in cash, such as fake credit sales or overstated inventory, explain profits rising while operating cash flow stays flat or falls. Skimming unrecorded retail receipts or deposits removes revenue and cash together, so it cannot make reported margin improve. Recording shell company billings or overcharges adds costs, so it can drain cash but cannot make reported margin rise. Recording unsupported register refunds or voids reduces recorded sales, which pushes reported margin down rather than up.

Correct answer: Insiders or bidders covertly collude to fix contract outcomes

Insiders or bidders covertly collude to fix contract outcomes is bid rigging: an employee of the purchasing organization helps a favored bidder, or the bidders agree among themselves, to decide in advance who wins and at what price, so the competition is a sham. Contractors or vendors tip officials to reward finished deals describes an illegal gratuity, a reward given after an award rather than an arrangement made to rig it. Purchasers or officials steer awards to benefit hidden stakes is a conflict of interest, in which an official's undisclosed ownership, not collusion over the bids, drives the award. Contractors or vendors pad invoices to bill unperformed labor is billing fraud during contract performance, after the bidding is over.

Correct answer: Hidden check tampering

Hidden check tampering fits: an employee who writes a company check to themselves and then deletes the audit trail is concealing a check tampering scheme. Interbank check kiting moves checks between bank accounts to exploit float, and it does not involve writing a company check to oneself. Shell vendor invoicing pays a fake company through accounts payable, which leaves a vendor and invoice trail rather than a self-issued check. Lockbox check skimming steals incoming customer checks before they are recorded, rather than issuing a company check to oneself and erasing the trail.

Correct answer: An employee submits a fake taxi receipt for a nonexistent ride

An employee submits a fake taxi receipt for a nonexistent ride fits: the whole expense is invented, which is the fictitious expenses category of expense reimbursement fraud. An employee submits a paid rental receipt for a second payment is a multiple reimbursement, because the expense was real but is claimed twice. An employee submits a genuine meal receipt for a padded amount is an overstated expense, a genuine cost claimed at a higher figure. An employee submits a family hotel receipt for a business cost is a mischaracterized expense, a real personal cost passed off as business.

Correct answer: Conflict of interest in purchasing

Conflict of interest in purchasing fits: the employee has an undisclosed family stake in a vendor that charges above-market prices, so a hidden interest steers the company's spending. Payment of kickbacks in purchasing would require the vendor to pay the employee for the business, and no such payment appears. Offers of gratuities in purchasing describe rewards given after a decision, not a vendor owned by the employee's own family. Extortion of vendors in purchasing would have the employee threatening vendors to extract payment, which the facts do not show.

Correct answer: Financial statement fraud via premature revenues

Financial statement fraud via premature revenues fits: recording a sale before the goods ship or the service is performed books real revenue in the wrong period, the timing-differences category. Financial statement fraud via fictitious revenue records sales that never happen at all, whereas this sale is real but booked too early. Financial statement fraud via improper valuation overstates an asset balance rather than shifting the timing of revenue. Financial statement fraud via hidden obligations conceals liabilities or expenses instead of moving revenue into an earlier period.

Correct answer: Copying trade secrets or databases for personal gain

Copying trade secrets or databases for personal gain is misappropriation of intangible assets: confidential information and proprietary data belong to the company even though they cannot be carried off like equipment. Removing company laptops or tablets for personal use takes tangible noncash property, not intangible assets. Inflating patent value or goodwill for bonus payouts is improper asset valuation, a financial statement fraud rather than a misappropriation. Diverting license fees or royalties for personal use takes cash income, which makes it skimming rather than theft of the intangible asset itself.

Correct answer: Shell company billing scheme

Shell company billing scheme fits: a vendor whose address matches an employee's home is very likely a fictitious company the employee set up to bill the organization. Ghost employee hiring scheme surfaces by comparing payroll records with one another, such as shared addresses or bank accounts among employees, not vendor addresses. Payee check tampering scheme alters the payee on an issued check and is found by examining cleared checks. Airfare claim padding scheme inflates an employee's travel expenses, which a vendor address match cannot reveal.

Correct answer: Falsified hours payroll scheme

Falsified hours payroll scheme fits: overtime paid for time the badge records show the worker was already gone means hours were claimed that were never worked. Ghost employee paycheck scheme pays someone who does not work for the company at all, while this worker is real and on the job. Forged sales commission scheme inflates commission pay through falsified sales records, not hours. Unapproved salary raise scheme raises the pay rate itself, whereas here the rate is unchanged and the hours are overstated.

Correct answer: Planting malicious code to capture bank credentials

Planting malicious code to capture bank credentials is malware-enabled fraud: software secretly installed on a device records data or credentials that the fraudster then uses for unauthorized transactions. Emailing imitation login pages to collect passwords is phishing, which tricks users into typing their credentials themselves rather than infecting their devices. Spoofing executive emails to redirect wire payments is business email compromise, a deception that needs no malicious software. Porting victim phone numbers to intercept passcodes is SIM swapping, which hijacks a phone account through the carrier rather than through malware.

Correct answer: Billing schemes through concentrated control

Billing schemes through concentrated control fits: one person who can set up vendors, confirm receipt of goods and approve invoices can create a fake vendor and pay its invoices with no one positioned to catch it. Tampering schemes through unchecked approval involve forging or altering company checks, a weakness in check custody and signing rather than in vendor setup and invoice approval. Payroll schemes through unshared timekeeping exploit control over time records, which these duties do not include. Expense schemes through unchecked processing involve employee reimbursement claims, not vendor invoices or receiving reports.

Correct answer: Misusing transactional influence for personal advantage

Misusing transactional influence for personal advantage is correct: the ACFE describes corruption as an employee wrongfully using influence in a business transaction to gain a benefit, often together with a third party such as a vendor. Misappropriating organizational assets for private gain is wrong because that describes asset misappropriation, the theft or misuse of resources; manipulating earnings statements for investor deception is wrong because that describes financial statement fraud; exploiting unwary consumers for counterfeit investments is wrong because that is consumer investment fraud against outsiders, not an employee trading on influence in a transaction.

Correct answer: Sales cutoff manipulation

Sales cutoff manipulation is correct: comparing the timing of large revenue entries with shipping records near period-end tests whether sales were booked in the wrong period, a timing-difference form of financial statement fraud. Improper asset valuations is wrong because overvalued inventory or receivables are tested against valuation support, not shipment dates; improper note disclosures is wrong because omitted or misleading disclosures concern the notes, not when revenue was recorded; concealed tax liabilities is wrong because unrecorded obligations are found by searching for unrecorded liabilities and later payments, not by matching shipments.

Correct answer: Pocketing proceeds from unbooked client jobs

Pocketing proceeds from unbooked client jobs is correct: doing a side job for a client on company time and keeping the cash means the sale never enters the books, which is skimming through unrecorded sales. Keeping overage from understated job tickets is wrong because that sale is recorded, only at a lower amount, the understated-sales variant; removing currency from recorded deposit bags is wrong because taking cash after it has been recorded is cash larceny; lapping payments from later customer ledgers is wrong because lapping conceals stolen receivable payments on sales that were recorded.

Correct answer: Single-victim shell company billing

Single-victim shell company billing is correct: a vendor whose sequentially numbered invoices go to one customer and no other suggests a shell company set up to bill that single victim. Non-accomplice vendor price padding is wrong because in a non-accomplice vendor scheme the vendor is real and bills many customers, so its invoice numbers would not run in an unbroken series for one buyer; bid-rigging supplier kickback deals is wrong because a colluding supplier in a bribery scheme is also a real business with other customers; forged-maker vendor check tampering is wrong because check tampering forges signatures on the company's own checks and does not involve a vendor's invoices.

Correct answer: Misappropriation of entrusted company assets

Misappropriation of entrusted company assets is correct: embezzlement is an asset misappropriation in which an employee diverts assets lawfully placed in their care to personal use. Larceny of unentrusted organization property is wrong because taking assets the employee was never entrusted with is larceny, not embezzlement; corruption of procurement contract decisions is wrong because that is a corruption scheme such as bribery or a kickback; misstatement of reported financial condition is wrong because that is financial statement fraud, which can hide a theft but is not the theft itself.

Correct answer: Vendor kickbacks or hidden conflicts

Vendor kickbacks or hidden conflicts is correct: a manager who insists on personally handling one supplier is a classic corruption red flag, pointing to a kickback arrangement or an undisclosed conflict of interest with that supplier. Skimmed income or lapped receivables is wrong because skimming and lapping involve incoming customer payments, not a supplier relationship; ghost employees or falsified payroll is wrong because payroll schemes run through the payroll records, not through a supplier; register voids or fictitious refunds is wrong because register disbursement schemes happen at the point of sale.

Correct answer: Tracking cashier drawer imbalance patterns

Tracking cashier drawer imbalance patterns is correct: short and over analysis reviews cash drawer overages and shortages by cashier and register so that recurring shortages, a sign of cash larceny, stand out. Auditing voided ticket approval signatures is wrong because that tests for false voids, not drawer counts; measuring delayed branch deposit intervals is wrong because deposit-lag analysis looks for skimming or lapping in the gap between receipt and deposit; analyzing customer refund frequency spikes is wrong because that targets false refunds rather than the cash balance in the drawer.

Correct answer: Overstated expense reimbursement

Overstated expense reimbursement is correct: a currency conversion that always favors the employee inflates the reimbursed amount above the true cost of a real expense. Mischaracterized expense reports is wrong because that scheme passes off a personal cost as a business one rather than inflating it; duplicate expense reimbursements is wrong because that is the multiple-reimbursements scheme, which claims the same expense more than once; fictitious subscription expenses is wrong because a fictitious expense scheme invents a cost that never happened, while a conversion trick inflates one that did.

Correct answer: Manipulating humans into aiding attackers

Manipulating humans into aiding attackers is correct: social engineering exploits human trust to get someone to reveal information or take an action that enables fraud, and it underlies phishing, vishing and pretexting. Planting keylogging malware into browsers is wrong because it is a technical malware attack that needs no persuasion; redirecting traffic into spoofing domains is wrong because that is pharming, which corrupts name resolution rather than deceiving a person; overloading company servers into crashing is wrong because that is a denial-of-service attack.

Correct answer: Fictitious or premature revenues

Fictitious or premature revenues is correct: large sales booked every fourth quarter and reversed every first quarter show revenue that either never existed or was recognized before it was earned, inflating each year-end. Hidden or unrecorded liabilities is wrong because leaving obligations off the books understates expenses rather than creating sales that later reverse; inflated or obsolete inventories is wrong because that is an improper asset valuation scheme; omitted or deceptive disclosures is wrong because it misleads through the notes, not through recorded sales.

Correct answer: Inflated-invoice kickback agreements

Inflated-invoice kickback agreements is correct: a vendor deliberately overprices purchases and shares the excess with the employee who approves them, an invoice kickback, which the Fraud Tree classes as bribery under corruption. Shell-company intermediary upcharges is wrong because in a pass-through scheme the employee's own shell company resells goods at a markup, so no outside vendor shares the proceeds; post-approval gratuity disbursements is wrong because an illegal gratuity rewards a decision after the fact with no prior agreement to split inflated proceeds; undisclosed-stake supplier conflicts is wrong because a conflict of interest rests on the employee's hidden financial interest in the vendor, not on sharing overcharges with an independent one.

Correct answer: Steady outsized returns, unexplained methods

Steady outsized returns, unexplained methods is correct: a Ponzi operator must report smooth, unusually high returns while keeping the strategy vague, because payouts come from new investors' money rather than real investing. Recruitment bonus payouts, membership quotas is wrong because pay tied to recruiting is the hallmark of a pyramid scheme; advance transfer charges, promised windfalls is wrong because fees demanded before a promised payment mark an advance-fee scheme; wildly hyped microcaps, coordinated selloffs is wrong because that pattern marks a pump-and-dump stock manipulation.

Correct answer: Disguised product-sales pyramid

Disguised product-sales pyramid is correct: forcing new participants to buy inventory they must resell, so that they effectively pay to work, is how a pyramid scheme hides behind a sales opportunity while its income really comes from recruits' purchases. Ponzi early-investor repayments is wrong because a Ponzi scheme pays earlier investors with later investors' money and sells no inventory; channel-stuffed reseller orders is wrong because channel stuffing is a company inflating its own revenue by shipping excess goods to distributors; advance-fee opportunity swindle is wrong because an advance-fee scheme takes an upfront payment for something never delivered, whereas these participants do receive inventory.

Correct answer: Fraudulent refund payments

Fraudulent refund payments is correct: requiring every register refund to match an original sale exposes false refunds, a register disbursement scheme in which a cashier records a return or refund with no genuine sale behind it and takes the cash. Fraudulently voided orders is wrong because false voids reverse a completed sale and are tested against voided receipts and approvals, not refunds; skimmed unrecorded revenue is wrong because skimming leaves no recorded sale or refund to match; pilfered register receipts is wrong because cash larceny takes recorded receipts without creating any refund.

Correct answer: Physical merchandise vanishing beyond documented outflows

Physical merchandise vanishing beyond documented outflows is correct: shrinkage caused by theft shows as goods missing from the physical count beyond what recorded sales, transfers and legitimate adjustments explain. Perpetual records understating counted warehouse holdings is wrong because records that show fewer units than the count describe an inventory overage, the reverse of shrinkage; obsolete stockpiles carrying overstated ledger valuations is wrong because overvaluing goods still on hand is improper asset valuation, not a loss of units; register drawers showing persistent unexplained shortages is wrong because missing drawer money points to cash larceny, a theft of recorded cash rather than of goods.

Correct answer: Check-theft payment skimming

Check-theft payment skimming is correct: an employee who insists on receiving and opening all incoming mail can intercept customer checks before they are recorded, which is skimming of incoming payments. Forged-maker check tampering is wrong because check tampering forges or alters the organization's own checks, not payments arriving from customers; post-recording vault larceny is wrong because cash larceny takes receipts after they are recorded, while mail interception happens before; check-kiting interbank float is wrong because kiting exploits the float between bank accounts and needs no intercepted mail.

Correct answer: Inoperative shell collecting diverted payments

Inoperative shell collecting diverted payments is correct: in billing schemes a fictitious vendor is an entity that does not exist or does no real business and is set up only to receive fraudulent payments for the perpetrator. Phantom employees drawing fabricated paychecks is wrong because a fictitious worker on the payroll is a ghost employee scheme, not a vendor in a billing scheme; wholesaler splitting inflated purchase markups is wrong because a supplier that overprices its goods and shares the excess with an insider is an operating business paying kickbacks, which is corruption rather than a fictitious vendor; undisclosed affiliate winning rigged contracts is wrong because a related-party vendor that actually operates points to a conflict of interest.

Correct answer: Improper expense classification

Improper expense classification is correct: labeling recurring operating costs as extraordinary misclassifies those expenses, moving them out of ongoing results so that earnings from continuing operations look stronger, an improper-classification form of financial statement fraud. Improper expenditure deferments is wrong because deferring or capitalizing costs removes them from expense altogether rather than relabeling them; improper inventory revaluations is wrong because that misstates what goods on hand are worth, not how costs are labeled; improper commitment disclosures is wrong because it concerns what the notes say about obligations, not how expenses are classified.

Correct answer: Bribery buying prearranged approval

Bribery buying prearranged approval is correct: the loan officer accepted a hidden fee in exchange for approving the loan, so payment was agreed in advance to influence the decision, which is bribery. Illegal gratuity rewarding approval is wrong because a gratuity is given after a decision with no prior agreement; extortion threatening credit denial is wrong because extortion requires the officer to demand payment under threat, and here the borrower paid for a favor; concealed interest skewing approval is wrong because a conflict of interest rests on the officer's own undisclosed stake, not on a payment from the borrower.

Correct answer: Pyramid rewarding recruit-based payouts

Pyramid rewarding recruit-based payouts is correct: an investment program that pays members referral bonuses for enrolling others and has no real product is a pyramid scheme, because its income comes from new participants' fees. Ponzi recycling later-investor deposits is wrong because a Ponzi scheme pays returns to passive investors out of later deposits, while this program openly pays for enrolling others; advance-fee demanding upfront transfers is wrong because an advance-fee scheme takes a payment for a promised benefit that never arrives; affinity-group scam exploiting churches is wrong because affinity fraud describes whom a scheme targets, a trusted community, not a program built on recruitment bonuses.

Correct answer: Ghost employee disbursements

Ghost employee disbursements is correct: confirming that every listed employee has a valid, unduplicated tax identification record exposes fictitious workers placed on the payroll, whose identifiers are invented or copied. Inflated employee timesheets is wrong because falsified hours are claimed for real employees with valid records; boosted employee commissions is wrong because commission schemes inflate the sales or rates of real staff; unauthorized employee raises is wrong because an altered pay rate also belongs to a genuine, properly identified employee.

Correct answer: Deceptive phone calls manipulating victims

Deceptive phone calls manipulating victims is correct: vishing is voice phishing, in which a caller uses the telephone to deceive victims into revealing information or sending money. Deceptive text messages manipulating users is wrong because that is smishing; deceptive mass emails manipulating targets is wrong because that is ordinary phishing by email; deceptive spoofed sites manipulating users is wrong because a counterfeit website is a web-based lure, as in pharming, not a voice call.

Correct answer: Look-alike supplier invoicing

Look-alike supplier invoicing is correct: creating a near-duplicate payee record with a slightly altered spelling lets an employee bill through a supplier that resembles a real one and route the payments to themselves, slipping past controls that look only for exact duplicates. Altered-payee check tampering is wrong because it changes the payee named on a check already issued and creates no new payee record; double-paid invoice recycling is wrong because it pays an existing payee's invoice a second time rather than paying a look-alike record; mailroom-stolen check cashing is wrong because intercepting a check made out to a genuine payee and forging its endorsement needs no new payee record at all.

Correct answer: Embezzlement diverts entrusted assets; larceny grabs unentrusted goods

The answer "Embezzlement diverts entrusted assets; larceny grabs unentrusted goods" is correct: embezzlement is the conversion of assets lawfully placed in the employee's care, while larceny is taking assets the person was never entrusted with. "Embezzlement takes unassigned holdings; larceny misuses custodial cash" is wrong because it reverses the two; "Embezzlement precedes journal entries; larceny follows recorded income" is wrong because the before-or-after-recording test separates skimming from cash larceny, not embezzlement from larceny; "Embezzlement implicates staff insiders; larceny denotes outsider theft" is wrong because employees commit larceny too, as in cash larceny from a register.

Correct answer: Fictitious or uncollectible sales

Fictitious or uncollectible sales is correct: revenue that grows steadily while receivables grow much faster and stay uncollected suggests sales recorded to customers who do not exist or will never pay, a form of fictitious revenue. Hidden or understated liabilities is wrong because leaving obligations off the books affects expenses and debts, not receivables; overstated or obsolete stockpiles is wrong because that is an inventory valuation problem; deceptive or withheld disclosures is wrong because it misleads through the notes rather than through booked sales.

Correct answer: Scripted cover stories extracting personal data

Scripted cover stories extracting personal data is correct: pretexting is a social engineering technique in which the fraudster fabricates a scenario, such as posing as a bank or an auditor, to obtain information or access. Mass spoofed emails harvesting online passwords is wrong because that is phishing, a broadcast lure rather than a tailored false identity; nearby onlookers capturing typed security codes is wrong because that is shoulder surfing; trash searches yielding discarded tax documents is wrong because that is dumpster diving, which involves no conversation at all.

Correct answer: Collusive falsified-hours payroll

Collusive falsified-hours payroll is correct: a manager who approves overtime that friends never worked and then splits the extra pay is running a falsified-hours scheme with accomplices, who are real employees. Ghost-employee fraudulent payroll is wrong because a ghost employee does not exist, while these friends are on staff; payroll commission-rate overrides is wrong because a commission scheme inflates sales or rates rather than hours; vendor-kickback invoice approvals is wrong because a kickback runs through a supplier's invoices, not through payroll.

Correct answer: Employees deliberately misusing employer resources for personal enrichment

Employees deliberately misusing employer resources for personal enrichment is correct: the ACFE defines occupational fraud as the use of one's occupation for personal enrichment through the deliberate misuse or misapplication of the employing organization's resources or assets, a definition that spans asset misappropriation, corruption and financial statement fraud. Employees negligently misapplying corporate finances for business purposes is wrong because careless errors made toward business ends lack both the deliberate intent and the personal enrichment the definition requires; employees committing miscellaneous workplace offenses for whatever motives is wrong because the definition covers enrichment through the employer's resources, not every offense committed at work; outside contractors knowingly defrauding customer organizations for profit is wrong because those outsiders are cheating a customer, not the organization that employs them.

Correct answer: Bearer check tampering

Bearer check tampering is correct: writing company checks payable to 'cash' and converting them personally is check tampering, because a check made out to cash can be negotiated by whoever holds it. Interbank check kiting is wrong because kiting exploits the float between bank accounts; payment check skimming is wrong because skimming takes incoming customer checks before they are recorded, not the company's own checks; fake refund processing is wrong because a false refund removes cash through the register, not through the checkbook.

Correct answer: Undisclosed ownership steering clients elsewhere

Undisclosed ownership steering clients elsewhere is correct: an employee who secretly owns a competitor and diverts the employer's customers to it holds an undisclosed financial interest that conflicts with the employer's, the business-diversion form of a conflict of interest. Commercial bribery securing profitable contracts is wrong because bribery requires a payment from an outside party to influence a decision; unrecorded contracts pocketing customer payments is wrong because skimming keeps the employer's own sales off the books rather than sending the customers to another firm; economic extortion pressuring contract suppliers is wrong because extortion demands payment under threat.

Correct answer: Ponzi exhausting newcomer deposits

Ponzi exhausting newcomer deposits is correct: a Ponzi operator pays existing investors with money from new ones, so a sudden surge of withdrawal demands that new deposits cannot cover forces an abrupt halt to all payouts. Pyramid saturating member networks is wrong because a pyramid collapses when recruitment dries up, not because passive investors ask for their money back; promoters dumping touted microcaps is wrong because a pump-and-dump ends with insiders selling a hyped stock, with no operator holding investors' money to pay out; agent diverting insurance premiums is wrong because an agent who pockets premiums leaves policies unfunded rather than running an investment program.

Correct answer: Cursory approvals accepting unverified receipts

Cursory approvals accepting unverified receipts is correct: expense reimbursement schemes persist chiefly because claims are approved with little verification of the supporting receipts, which gives employees the opportunity to mischaracterize, overstate, invent or duplicate expenses. Reimbursements bypassing company ledger records is wrong because reimbursements are recorded disbursements, not off-book transactions like skimming; collusive vendors supplying overstated invoices is wrong because an expense scheme needs no outside vendor, which is the mark of a billing scheme; inflated claims evading disbursement categories is wrong because the Fraud Tree classifies expense reimbursement schemes as one of its fraudulent disbursement categories, so no classification gap shields them and they persist through weak review instead.

Correct answer: Cash larceny depleting drawers

Cash larceny depleting drawers is correct: frequent 'no sale' openings followed by drawer shortages show recorded cash being removed from the register by the employee who controls it. Skimming unrung customer sales is wrong because skimming leaves the drawer in balance, since the sale was never recorded; register voids reversing sales is wrong because a false void creates a recorded reversal rather than an unexplained shortage; phantom refunds draining tills is wrong because a false refund also leaves a recorded refund to explain the missing cash.

Correct answer: Unapproved surcharges inflating actual invoices

Unapproved surcharges inflating actual invoices is correct: invoice padding adds unauthorized or inflated charges to otherwise legitimate invoices so the company overpays and the excess can be diverted. Shell company billing unperformed consultations is wrong because a shell-company scheme bills through a vendor that does not really exist for work that never happened, so no legitimate invoice is being padded; undelivered orders generating supplier invoices is wrong because that is billing for goods not received, where the whole invoice is false; duplicated payments recycling archived invoices is wrong because paying the same invoice twice involves no added charge.

Correct answer: Shell-company fictitious billing

Shell-company fictitious billing is correct: a vendor reachable only through an employee's personal cell phone and sending vague invoices is a classic sign of a fictitious entity that the employee controls and bills through. Non-accomplice vendor misbilling is wrong because it manipulates a real vendor's invoices, and a real vendor has its own business contacts; kickback-paying vendor collusion is wrong because a kickback vendor is also an operating business with genuine detail on its invoices; personal-purchase order spending is wrong because buying personal items through company purchasing uses a real supplier, not a phantom one.

Correct answer: Stolen personal details opening bogus accounts

Stolen personal details opening bogus accounts is correct: account application fraud is identity theft in which the fraudster uses a victim's stolen personal information to open new accounts in the victim's name. Phished logins hijacking current bank accounts is wrong because that is account takeover of an existing account; misused insurance cards obtaining medical care is wrong because that is medical identity theft, which bills treatment to the victim's existing coverage rather than opening new accounts; planted card readers cloning customer accounts is wrong because card skimming copies data from cards that already exist to make purchases, rather than opening new accounts.

Correct answer: Fictitious transaction entries

Fictitious transaction entries is correct: booking a gain on the sale of an asset that was never sold records income from a transaction that did not happen, a fictitious-revenue form of financial statement fraud. Improper inventory revaluation is wrong because valuation schemes misstate what existing assets are worth; premature earnings recognition is wrong because timing schemes book a real transaction in the wrong period, while this sale never occurred; manipulated liability reserves is wrong because reserve manipulation adjusts estimates of obligations rather than inventing a sale.

Correct answer: Official bribery buying regulatory leniency

Official bribery buying regulatory leniency is correct: a regulator who accepts payment to overlook violations is a public official taking something of value to influence official action, which is bribery of a public official. Commercial kickbacks winning private orders is wrong because kickbacks of that kind are commercial bribery between private parties, not a government regulator; illegal gratuity rewarding resolved matters is wrong because a gratuity is given after an action without a prior agreement, while this payment bought the outcome; economic extortion threatening harsh audits is wrong because extortion requires the official to demand payment under threat.

Correct answer: Advance-fee swindle collecting retainers

Advance-fee swindle collecting retainers is correct: a recovery scam asks prior fraud victims to pay an upfront fee for help recovering their losses, and the promised recovery never comes, the defining pattern of an advance-fee scheme. Ponzi recycling newer-investor principal is wrong because a Ponzi scheme pays returns to investors from later deposits; pyramid channeling entry-fee commissions is wrong because a pyramid pays participants out of the entry fees of recruits they enroll, and these victims recruit no one; identity-theft rings harvesting dossiers is wrong because the fee itself, not stolen personal data, is the object of this scam.

Correct answer: Multiple expense reimbursements

Multiple expense reimbursements is correct: claiming the same expense once through a personal credit card claim and again through a corporate card claim seeks payment twice for one cost. Exaggerated expense submissions is wrong because an overstated expense inflates a single claim rather than repeating it; mischaracterized expense claims is wrong because that passes off a personal cost as a business one; fragmented expense transactions is wrong because splitting one purchase into smaller charges to stay under an approval limit does not submit the same expense twice.

Correct answer: P-card purchase abuse

P-card purchase abuse is correct: an employee who charges personal items to a company purchasing card is spending company money for personal benefit, a fraudulent disbursement of company funds. Non-cash asset misuse is wrong because that category covers using or borrowing company inventory and equipment, whereas here company funds pay the merchant. Fake gift-card refund is wrong because it describes a register refund fraud, and no refund is processed here. Stolen debit-card use is wrong because it describes someone running another person's card, while this card was issued to the employee by the company.

Correct answer: Theft schemes such as skimming or larceny

Theft schemes such as skimming or larceny is correct: a manager who blocks rotation of cash-handling duties and resists audits is protecting an ongoing theft of cash receipts that would surface as soon as someone else counted the cash, the classic behavioral red flag for skimming or cash larceny. Check schemes such as forgeries or kiting is wrong because forged checks and check kiting run through the checkbook and the bank accounts, not through who counts the cash. Billing schemes such as shells or markups is wrong because billing schemes run through vendor invoices and accounts payable, not through the cash drawer. Payroll schemes such as padding or ghosts is wrong because padded hours and ghost employees run through payroll records, which rotating cash duties would not expose.

Correct answer: Recording undisclosed affiliated deals to inflate results or hide losses

Recording undisclosed affiliated deals to inflate results or hide losses is correct: related-party transaction fraud uses entities the company controls or is tied to, without disclosing the relationship, so the dealings look arm's-length when they are not. Recording unperformed service revenues to inflate results or hide losses is wrong because booking revenue for service not yet performed, or never performed, is premature or fictitious revenue, and neither scheme needs an undisclosed affiliate. Capitalizing routine overhead expenses to inflate results or hide losses is wrong because that is an improper asset valuation scheme that turns costs into assets. Recording lowball litigation estimates to inflate results or hide losses is wrong because booking lawsuit exposure below its probable amount is a concealed liabilities and expenses scheme, which involves no affiliated party at all.

Correct answer: A register disbursement scheme using fabricated return records

A register disbursement scheme using fabricated return records is correct: the saved customer receipts let the cashier ring up refunds for returns that never happened and take the cash out of the drawer, a false refund concealed with made-up return paperwork. A cash larceny scheme using fabricated deposit reconciliations is wrong because larceny takes cash that has already been recorded and hides the shortage in the deposit, while here the cash leaves through a recorded refund. A fictitious expense scheme using fabricated business receipts is wrong because the receipts belong to customers and support register refunds, not the employee's own expense reimbursement claims. A noncash larceny scheme using fabricated inventory writedowns is wrong because the cashier is removing cash from the register, not goods from stock.

Correct answer: A Ponzi lures outside investors with fake returns; embezzlement diverts an employer's entrusted assets

A Ponzi lures outside investors with fake returns; embezzlement diverts an employer's entrusted assets is correct: a Ponzi victimizes investors and pays them from newer investors' money, while embezzlement is the conversion of property an employer has entrusted to the employee. A Ponzi pays early recruits with enrollment fees; embezzlement requires an employee's forged signature is wrong on both halves: paying from recruits' fees describes a pyramid, and embezzlement needs no forgery, only misuse of lawful access. A Ponzi drains company accounts with sham invoices; embezzlement defrauds an investor's pooled savings is wrong because it reverses the victims of the two frauds. A Ponzi pays loyal clients with genuine profits; embezzlement seizes an outsider's unattended property is wrong because a Ponzi has no genuine profits, and taking property that was never entrusted is larceny, not embezzlement.

Correct answer: Supplier kickbacks combined with inflated billing

Supplier kickbacks combined with inflated billing is correct: the employee approves a padded contractor invoice and receives a cash payment from the contractor in exchange, which is a kickback, a form of bribery, with the overbilling funding it. Ghost employees combined with phantom timekeeping is wrong because the inflated headcount sits on a real contractor's invoice, not on the company payroll. Shell corporations combined with inflated billing is wrong because the contractor is a genuine outside firm paying the employee, not a fictitious entity the employee controls. Illegal gratuities combined with inflated billing is wrong because a gratuity rewards a decision after the fact with no prior agreement, while this payment was the agreed price for approving the invoice.

Correct answer: Recording a reduced sale and pocketing the cash difference

Recording a reduced sale and pocketing the cash difference is correct: under-ringing records the sale at less than the customer paid, so the register balances to the lower figure and the gap can be taken off-book, a form of skimming. Recording a voided sale and pocketing the original payment is wrong because that is a false void, a register disbursement that reverses a sale already recorded in full. Omitting a sale altogether and pocketing the cash received is wrong because recording no sale at all is unrecorded-sales skimming, whereas under-ringing records the sale at a lower amount. Recording a complete sale and pocketing the cash afterward is wrong because taking cash after the full sale is recorded is cash larceny, not under-ringing.

Correct answer: Financial statement fraud through fictitious subscriber revenue

Financial statement fraud through fictitious subscriber revenue is correct: revenue that auditors cannot trace to any real customer is fictitious revenue, sales booked to customers who do not exist, and the growing user counts are offered to make those sales look plausible. Financial statement fraud through premature revenue recognition is wrong because that scheme books real customers' revenue too early, while here the customers cannot be found at all. Financial statement fraud through improper asset capitalization is wrong because it inflates assets by treating costs as investments, not by inventing users or sales. Financial statement fraud through deferred revenue misstatement is wrong because deferred revenue is cash already received from real customers for future delivery, and misstating it shifts real revenue between periods, while here no real customer stands behind the revenue.

Correct answer: Chemically dissolving a check's ink to alter the payee or amount

Chemically dissolving a check's ink to alter the payee or amount is correct: check washing uses solvents to lift the original writing from a genuine check so that a new payee or a larger amount can be written in. Digitally scanning a check's image to forge the design or border is wrong because that describes counterfeiting, which produces a new fake check rather than altering a real one. Rapidly cycling a check's float to inflate the balance or credit is wrong because that describes check kiting, which exploits the clearing delay between banks. Falsely endorsing a check's back to divert the funds or deposits is wrong because that describes a forged endorsement, which leaves the face of the check untouched.

Correct answer: Ponzi-pyramid hybrid scheme

Ponzi-pyramid hybrid scheme is correct: the guaranteed high yield paid out of incoming money is the Ponzi element, and making each participant recruit others before their own payouts unlock is the pyramid element. Advance-fee windfall scheme is wrong because an advance-fee fraud demands an up-front fee to release a promised sum, not a quota of recruits. Prime-bank investment fraud is wrong because it sells fictitious bank instruments to investors and does not condition payouts on recruitment. Chain-referral bonus scheme is wrong because it pays only for bringing in recruits and lacks the guaranteed investment return the program promises.

Correct answer: Rewarding an official's completed act with a favor

Rewarding an official's completed act with a favor is correct: an illegal gratuity is something of value given because of an official act already performed, with no agreement beforehand. Buying an official's future decisions with a bribe is wrong because a payment made to influence a decision not yet taken is bribery, not a gratuity. Paying an official's coercive demand with a payoff is wrong because payment extracted by an official's threat is economic extortion. Hiding an official's business stake with a nominee is wrong because a concealed ownership interest in a counterparty is a conflict of interest, and no reward changes hands.

Correct answer: Receivables skimming hidden by intercepted client calls

Receivables skimming hidden by intercepted client calls is correct: customers complain about missing credits because their payments were taken before being posted, and routing every such complaint to the thief keeps the shortfall from reaching anyone else, active concealment of skimmed receivables. Check tampering hidden by intercepted vendor statements is wrong because check tampering alters the company's own outgoing checks, and the complaints come from customers, not vendors. Cash larceny hidden by rolling unreconciled differences is wrong because larceny takes cash after it is recorded, so the customer's account would show the credit. Billing schemes hidden by intercepted vendor complaints is wrong because billing schemes drain accounts payable, which would not leave customers missing credits.

Correct answer: Overstating reserves in boom years to smooth future earnings

Overstating reserves in boom years to smooth future earnings is correct: a cookie jar reserve is over-provided while results are strong and then released into income when results weaken, so reported earnings look steadier than they are. Diverting reserves in flush years to fund concealed accounts is wrong because cookie jar reserves are excess accounting estimates that are later released into reported income, not cash moved into hidden accounts; siphoning funds that way is asset misappropriation, not earnings management. Understating reserves in lean years to lift current earnings is wrong because that simply understates expenses in the current period and builds nothing to draw on later. Shipping unordered inventory in final weeks to lift earnings is wrong because that is channel stuffing, a revenue scheme rather than a reserve scheme.

Correct answer: A shell-company billing scheme for nonexistent services

A shell-company billing scheme for nonexistent services is correct: a vendor that only ever bills vague consulting with no deliverables, approved by a single manager, is the profile of a fictitious company set up to invoice for services never performed. A pass-through billing scheme for intermediary services is wrong because in a pass-through the employee's company buys real services from a genuine supplier and resells them at a markup, so deliverables would exist. A non-accomplice billing scheme for duplicated services is wrong because that manipulates payments to an innocent real vendor, such as paying the same invoice twice, rather than invoicing through a vendor that delivers nothing. A personal-purchase billing scheme for private services is wrong because that charges the company for goods or services the employee keeps, while these invoices are for business consulting that never existed.

Correct answer: Diverting supplier deliveries before inventory updates

Diverting supplier deliveries before inventory updates is correct: goods taken at receiving, before they are entered into the inventory records, never appear on the books, so the theft is off-book from the start. Shipping fictitious orders before credit authorization is wrong because that is a false shipment scheme that sends goods already in stock to an accomplice. Scrapping saleable inventory before quarterly recounts is wrong because that writes off recorded stock as scrap or obsolete, so the goods had already been logged. Requisitioning surplus inventory before job completion is wrong because an asset requisition scheme draws recorded stock out under a false work need, again after it was logged.

Correct answer: Fictitious refunds paid through online checkout

Fictitious refunds paid through online checkout is correct: an employee who creates refunds for customers who returned nothing, payable to a wallet the employee controls, is running a false refund disbursement scheme in a digital channel. Customer refunds abused through returns portals is wrong because refund abuse by shoppers is external fraud, and here the refunds are created by an employee. Unrecorded orders skimmed through payment links is wrong because that is skimming of unrecorded sales, while this scheme pays out recorded refunds. Hacker refunds issued through phished passwords is wrong because no outside attacker is involved; the employee uses legitimate system access.

Correct answer: Larger median losses, reflecting big-ticket tender decisions

Larger median losses, reflecting big-ticket tender decisions is correct: in ACFE occupational fraud studies corruption is less common than asset misappropriation but its median loss is higher, because a corrupted purchasing or contract decision moves large sums. Smaller median losses, matching modest gift-sized gratuities is wrong because it reverses the relationship; asset misappropriation has the lowest median loss of the three categories. Similar median losses, mirroring small-scale inventory theft is wrong because the two categories' medians differ markedly. Record-high median losses, topping financial statement fraud is wrong because financial statement fraud, not corruption, has the highest median loss.

Correct answer: A payroll scheme siphoning paycheck withholdings

A payroll scheme siphoning paycheck withholdings is correct: amounts deducted from employees' pay for benefits are supposed to be remitted to the plan, and a clerk who redirects them to a personal account is committing a payroll fraud variant. A payroll scheme inventing nonexistent employees is wrong because a ghost employee scheme adds fake payees, while these deductions come from real employees' checks. A payroll scheme overstating overtime timesheets is wrong because falsified hours raise a worker's gross pay rather than diverting amounts withheld from it. A payroll scheme inflating quarterly commissions is wrong because a commission scheme overstates sales or rates to raise pay, not to capture deductions.

Correct answer: Deliberately causing or faking a covered loss to collect insurance proceeds

Deliberately causing or faking a covered loss to collect insurance proceeds is correct: a staged loss is a loss that is either engineered or invented outright so that a claim can be paid. Knowingly inflating or padding a genuine loss to increase insurance payouts is wrong because exaggerating a real loss is claim padding, and the loss in that case was not staged. Secretly pocketing or delaying a customer premium to divert insurance funds is wrong because that is premium diversion by an agent, which involves no claim at all. Falsely omitting or understating a past loss to decrease insurance premiums is wrong because that is application fraud aimed at a lower premium, not at collecting on a loss.

Correct answer: Improper supplier billings evaded weak closing scrutiny

Improper supplier billings evaded weak closing scrutiny is correct: thinly documented vendor invoices approved minutes before the period-end close are being pushed through when review is most rushed, a billing scheme that exploits weak period-end review. Secret supplier kickbacks bought quick closing approval is wrong because nothing in the pattern shows a vendor paying the approver; the red flag is the timing and the missing support. Deferred supplier expenses shifted past closing cutoffs is wrong because approving invoices before the close records them in the current period rather than deferring them. Coerced supplier payoffs unlocked fast closing approval is wrong because economic extortion needs the employee to demand payment from the vendor, and nothing suggests such a demand.

Correct answer: Using a victim's identity and insurance card to obtain treatment or drugs

Using a victim's identity and insurance card to obtain treatment or drugs is correct: medical identity theft is the use of another person's identifying and health-insurance information to receive care, prescriptions or other medical goods in that person's name. Using a victim's identity and payroll history to claim refunds or credits is wrong because filing tax returns in a victim's name is tax identity theft. Using a victim's identity and credit scores to open mortgages or accounts is wrong because that is new-account fraud for credit, which yields loans rather than medical services. Using a victim's identity and license details to deflect arrests or fines is wrong because giving police another person's name and license is criminal identity theft, which pins charges or fines on the victim instead of obtaining medical care.

Correct answer: Financial statement fraud through premature recognition of unshipped orders

Financial statement fraud through premature recognition of unshipped orders is correct: an improper bill-and-hold books revenue on goods the customer has neither demanded nor taken, pulling next quarter's sales into this one, a timing-difference scheme. Financial statement fraud through improper valuations of obsolete inventory is wrong because that overstates an asset, not revenue. Financial statement fraud through deliberate omission of affiliate dealings is wrong because that is an improper disclosure of related-party transactions. Financial statement fraud through material understatement of warranty costs is wrong because that conceals liabilities and expenses rather than accelerating revenue.

Correct answer: Ghost employee schemes pay imaginary payees, while falsified-hours schemes overpay actual staff

Ghost employee schemes pay imaginary payees, while falsified-hours schemes overpay actual staff is correct: a ghost employee is a payee who does not work for the company, while falsified hours and wages inflate the pay of genuine employees. Ghost employee schemes inflate hourly rates, while falsified-hours schemes invent phantom hires is wrong because it swaps the two: inventing payees is the ghost scheme, and inflating a real worker's pay is the falsified-wages scheme. Ghost employee schemes require clerk collusion, while falsified-hours schemes use forged checks is wrong because one person with payroll access can add a ghost, and falsified hours are paid through ordinary payroll checks. Ghost employee schemes pad expense claims, while falsified-hours schemes inflate earned bonuses is wrong because padded expense claims are expense reimbursement fraud and inflated bonuses or commissions are commission schemes.

Correct answer: Commercial bribery involving non-cash value

Commercial bribery involving non-cash value is correct: the free remodeling is something of value given by the vendor to influence the manager's decisions to steer business its way, which is bribery, the kickback form of corruption, even though no cash changes hands. Shell corporations involving non-cash value is wrong because a shell company is a fictitious vendor the employee controls that bills for work never done, while here a real outside vendor does real work and gives the manager a free remodel to keep the business coming. Economic extortion involving non-cash value is wrong because extortion requires the manager to demand the benefit under threat of harm, and the vendor here is offering it to win business. Concealed conflict involving non-cash value is wrong because a conflict of interest rests on the manager's undisclosed financial interest in the vendor, not on receiving a benefit from it.

Correct answer: Register skimming hidden by erased transaction entries

Register skimming hidden by erased transaction entries is correct: once the sale is deleted before the daily close, the cash was never on the books, which is the off-book hallmark of skimming at the point of sale. Receivables skimming hidden by lapped account payments is wrong because no customer payment on account is involved; these are register sales. Refund skimming hidden by stockpiled customer receipts is wrong because no refund is processed; the employee erases the sale itself. Cash larceny hidden by understating overnight deposits is wrong because nothing here touches the deposit: the employee hides the theft by deleting the sale entries before the daily close, so the cash never reaches the day's totals, whereas a short deposit would leave recorded sales that the bank deposit fails to match.

Correct answer: Reselling discarded salvage and returns for personal profits

Reselling discarded salvage and returns for personal profits is correct: theft of scrap or returned goods takes items that the company treats as having little value, such as salvage, scrap and customer returns, and sells them on for the employee's own gain. Diverting company vehicles and equipment for personal chores is wrong because that is misuse of company assets, which are borrowed and returned rather than stolen. Ordering surplus supplies and hardware for personal projects is wrong because buying personal items with company funds is a billing scheme for personal purchases. Requisitioning job materials and tools for personal remodels is wrong because an asset requisition scheme draws good inventory under a false work need, not scrap or returns.

Correct answer: Business email compromise posing as outside counsel

Business email compromise posing as outside counsel is correct: a spoofed message that impersonates a trusted law firm and pressures a finance employee into wiring an urgent, confidential payment is a classic business email compromise. Sweepstakes email fraud posing as foreign officials is wrong because that is an advance-fee lure promising a prize, not an impersonated business contact requesting a wire. Employee credential theft posing as outside counsel is wrong because the aim here was a payment, not the employee's login details. Ransomware email campaign posing as outside counsel is wrong because ransomware encrypts systems and demands a ransom, while here the victim sent the money believing the request was genuine.

Correct answer: Bid rotation, a variant of bid rigging

Bid rotation, a variant of bid rigging is correct: competitors who secretly agree to take turns submitting the winning bid are rotating the awards among themselves. Bid suppression, a form of bid rigging is wrong because suppression has a competitor refrain from bidding or withdraw a bid, not alternate wins. Market division, a form of bid rigging is wrong because that allocates customers or territories so that each firm wins within its own share, rather than taking turns on each contract. Cover bids, a technique of bid rigging is wrong because complementary or cover bids are deliberately losing bids that make a chosen winner look competitive; the defining feature here is the agreement to take turns winning.

Correct answer: Financial statement fraud through inflated asset valuations

Financial statement fraud through inflated asset valuations is correct: depreciating fixed assets more slowly than warranted keeps their carrying value, and therefore assets and earnings, higher than they should be, an improper asset valuation. Financial statement fraud through fictitious income entries is wrong because no sales are invented; the misstatement is in the depreciation of existing assets. Financial statement fraud through undisclosed asset pledges is wrong because hiding that assets are pledged as collateral is an improper disclosure, which leaves their recorded values unchanged. Financial statement fraud through omitted asset acquisition is wrong because leaving purchases off the books would understate assets, the opposite of what slow depreciation does.

Correct answer: A false refund records a fictitious return; a false void reverses a genuine sale

A false refund records a fictitious return; a false void reverses a genuine sale is correct: a false refund processes a return of merchandise that never came back, while a false void cancels a real, completed sale after the customer has gone, and both let the employee remove the matching cash from the register. A false refund cancels a valid purchase; a false void invents a phantom exchange is wrong because it swaps the two schemes. A false refund skims a customer purchase; a false void steals a recorded deposit is wrong because skimming and deposit larceny are separate cash schemes, while refunds and voids are register disbursements. A false refund involves a rogue customer; a false void reflects a clumsy cashier is wrong because both are deliberate employee frauds, not customer scams or honest mistakes.

Correct answer: Online account takeover using stolen logins

Online account takeover using stolen logins is correct: signing in to a real customer's existing account with captured credentials and moving that customer's money out is account takeover, a form of identity theft. Mule account cashouts using rapid transfers is wrong because the money mule is only the exit route for the stolen funds, not the scheme that gained access to them. Business email compromise using fake bosses is wrong because that scheme uses spoofed or hijacked email posing as an executive to trick a business into sending a payment, while here no one is deceived into paying and the rep moves the money straight out of the victim's own account. New account fraud using fabricated profiles is wrong because it opens fresh accounts in a false name rather than taking over one that already holds the victim's money.

Correct answer: Commercial bribery with a non-cash benefit

Commercial bribery with a non-cash benefit is correct: the vacation was agreed in advance as the price of steering the contract, and offering anything of value to influence a business decision is bribery whether or not it is cash. Illegal gratuities with a non-cash benefit is wrong because a gratuity rewards a decision after the fact without a prior agreement, and this deal was arranged beforehand. Economic extortion with a non-cash benefit is wrong because extortion requires the employee to demand the benefit under threat, not to accept an agreed exchange. Concealed conflict with a non-cash benefit is wrong because a conflict of interest depends on an undisclosed financial interest in the vendor, which the facts do not describe.

Correct answer: Ponzi payments disguised by a fake strategy

Ponzi payments disguised by a fake strategy is correct: paying withdrawals out of new deposits while claiming that a secret algorithm earns steady profits is the defining pattern of a Ponzi scheme. Pyramid payouts disguised by a fake product is wrong because a pyramid pays participants for recruiting others, and nothing here depends on recruitment. Rigged trades disguised by a fake algorithm is wrong because market manipulation distorts real trading prices, while this promoter is not trading at all. Embezzled assets disguised by a fake ledger is wrong because embezzlement simply diverts entrusted money, whereas here earlier investors are being paid with later investors' deposits to keep the scheme going.

Correct answer: A payroll scheme involving padded commission payouts

A payroll scheme involving padded commission payouts is correct: inflating reported sales to collect commissions that were never earned is a commission scheme, a payroll fraud in which the employee's own pay is overstated. A payroll scheme involving ghost commission accounts is wrong because a ghost employee scheme pays a salesperson who does not exist, while this employee is real and pads his or her own figures. A corruption scheme involving secret commission fees is wrong because a secret commission is a bribe paid by an outside party, and no third party is paying anyone here. A payroll scheme involving falsified overtime claims is wrong because falsified hours raise hourly pay, not sales-based commissions.

Correct answer: Pyramid business scheme

Pyramid business scheme is correct: returns that depend on each member enrolling paying recruits beneath them, rather than on any genuine product or investment, are the defining feature of a pyramid. Ponzi investment scheme is wrong because a Ponzi pays earlier investors out of later investors' money without requiring them to recruit anyone. Affinity network scheme is wrong because affinity fraud describes exploiting trust within a group, not a payout structure that depends on recruitment. Multilevel sales scheme is wrong because a lawful multilevel marketing plan pays on sales of real products to customers, not on recruits' enrollment fees.

Correct answer: Receivables skimming concealed by phony bad-debt entries

Receivables skimming concealed by phony bad-debt entries is correct: the customer's incoming payment was stolen before it was posted, and writing the real balance off as uncollectible hides the missing payment. Receivables skimming concealed by lapped follow-up funds is wrong because lapping covers the shortfall by applying later customers' payments to the earlier account, and the stem says the balance was written off instead. Receivables skimming concealed by forced sub-ledger sums is wrong because force balancing simply plugs the receivables subledger to hide the gap, while here the specific balance was written off as bad debt. Cash larceny concealed by altering bank-deposit receipts is wrong because larceny takes money after it is recorded, while this payment never reached the books.

Correct answer: Assets and owners' equity both fall by $8,000, so the books balance

Assets and owners' equity both fall by $8,000, so the books balance: the entry debits repairs expense and credits cash, and the expense flows through net income into retained earnings, so both sides of Assets = Liabilities + Owners' equity drop by the same amount. That two-sided entry is exactly why the theft does not show up as an out-of-balance ledger. Assets and liabilities both falling is what a fake payment of an existing payable would do, not a debit to an expense, and either option claiming the books are off misses that a debit to an expense keeps the ledger balanced.

Correct answer: $390,000

$390,000 is correct: net sales are $900,000 minus $40,000 of returns, or $860,000, and cost of goods sold is $120,000 + $500,000 - $150,000, or $470,000, leaving $390,000. $430,000 subtracts cost of goods sold from gross sales and forgets the returns, $510,000 leaves beginning inventory out of cost of goods sold, and $470,000 is cost of goods sold itself. Operating expenses come after gross profit and do not enter this figure at all.

Correct answer: $55,300

$55,300 is correct: revenue of $500,000 less cost of goods sold of $300,000 gives gross profit of $200,000, less $120,000 of operating expenses gives operating income of $80,000, less $10,000 of interest gives pretax income of $70,000, and after 21% tax net income is $55,300. Under accrual accounting the $380,000 collected is irrelevant to revenue. $63,200 applies tax to operating income before interest, $70,000 stops at pretax income, and $80,000 is operating income.

Correct answer: Dividends paid to common shareholders, shown as a financing outflow

Dividends paid to common shareholders, shown as a financing outflow, is correct: ASC 230 lists distributions to owners as financing activities with no alternative. Interest paid is the tempting choice because the loan itself is financing, but US GAAP classifies interest paid as an operating outflow (the financing option exists only under IFRS). A truck purchase is an investing outflow, and repaying loan principal is a financing outflow, not investing.

Correct answer: Operating cash flow rises and investing cash flow falls by $2 million

Operating cash flow rises and investing cash flow falls by $2 million is correct: capitalizing the payments turns them into capital expenditures, so the same $2 million of cash leaves through investing activities instead of operating activities. Total cash cannot change, because the same cash was spent either way, so both options that move the net change in cash are wrong. The reversed option has the direction backward; this shift is why improper capitalization can make operating cash flow look healthier than it is.

Correct answer: Gross receivables and the allowance both fall; net income is unchanged

Gross receivables and the allowance both fall; net income is unchanged is correct: the entry debits the allowance (a contra-asset) and credits accounts receivable, so net receivables, total assets, and income are untouched at that moment. That is what makes write-offs attractive for hiding skimmed receivables. Options where net income falls describe the direct write-off method with a bad debt expense debit, and net receivables do not fall because the contra-asset shrinks by the same $6,000.

Correct answer: Revenue overstated by $27,000 and liabilities understated by $27,000

Revenue overstated by $27,000 and liabilities understated by $27,000 is correct: only 3 of 12 months, or $9,000, was earned by December 31, so the remaining $27,000 should sit in unearned revenue, a liability. The $9,000 options use the earned portion as the error instead of the unearned portion, and the assets version wrongly treats the error as a receivable even though the cash was already collected. The $36,000 option forgets that three months of service were actually performed.

Correct answer: Carrying its land and buildings at revalued fair amounts

Carrying its land and buildings at revalued fair amounts is correct: IAS 16 lets an entity choose a revaluation model for property, plant, and equipment, while US GAAP requires the historical cost model and forbids upward revaluation. LIFO is the reverse difference, since US GAAP permits it and IAS 2 prohibits it. Extraordinary items are now banned under both frameworks, and fair value through earnings for trading securities is available under both.

Correct answer: As material, because qualitative effects can outweigh its small size

As material, because qualitative effects can outweigh its small size is correct: SEC Staff Accounting Bulletin No. 99 treats a 5% rule of thumb only as a starting point and lists qualitative factors, including hiding a missed consensus and turning a loss into income, that can make a small misstatement material. Both immaterial options rely on size alone, which SAB 99 rejects. The per se option overstates the rule; intent is a factor that weighs toward materiality, but SAB 99 does not make every intentional misstatement automatically material.

Correct answer: $690,000

Accrual revenue is $690,000: cash collected of $640,000, plus the $35,000 increase in receivables (earned but not yet collected), plus the $15,000 decrease in unearned revenue (deposits received earlier and earned this year). The $660,000 figure subtracts the unearned-revenue decrease, treating it like cash refunded, and the $620,000 figure subtracts the receivables increase, which is the cash-flow adjustment run in reverse. The $590,000 figure makes both sign errors.

Correct answer: $260,000

Operating cash flow is $260,000: $250,000 plus $60,000 depreciation, minus the $10,000 gain (the sale proceeds belong in investing), minus the $45,000 receivables increase, plus the $20,000 inventory decrease, minus the $15,000 payables decrease. The $230,000 figure wrongly deducts dividends paid, which are a financing outflow under US GAAP. The $270,000 figure leaves the gain in operating cash flow, and the $350,000 figure adds the receivables increase instead of subtracting it.

Correct answer: Debit an expense account, since its balance is closed to retained earnings at year-end

Debit an expense account, since its balance is closed to retained earnings at year-end, is the best concealment: once nominal accounts are closed, the fictitious charge leaves no lingering balance to examine. Debiting a fixed asset is the strongest alternative, but the inflated asset stays on the balance sheet for years and can be tested against invoices and physical inspection. A fictitious receivable will never be paid and surfaces in aging reviews and confirmations, and an understated payable surfaces when vendors' statements show amounts still owed.

Correct answer: A pass-through scheme billing through a shell company

A pass-through scheme billing through a shell company is the most accurate label: BrightCo has no operations of its own and exists only to insert itself between a real supplier and the employer, marking up goods that are actually delivered. A conflict-of-interest purchasing scheme is the defensible alternative because Ken has an undisclosed interest, but the ACFE treats an employee-created shell that bills the employer as a billing scheme, while conflict-of-interest purchasing involves a genuine operating vendor. There is no kickback because the regular supplier is not colluding, and an overbilling scheme by a nonaccomplice vendor requires the vendor itself to be innocent and separate from the employee.

Correct answer: Check tampering by an authorized maker

Check tampering by an authorized maker is the best answer, because Maria used her own signing authority to draw the check directly, bypassing accounts payable. A personal-purchases billing scheme is the tempting choice since the company paid for her personal garden, but billing schemes work by submitting a false or personal invoice through the payment process so the company issues the check. There was no pass-through intermediary marking up goods, and an expense reimbursement scheme requires an employee to submit a claim for reimbursement.

Correct answer: It shared the formula with distributors under no confidentiality terms

Sharing the formula with distributors under no confidentiality terms is most damaging, because a trade secret requires the owner to take reasonable measures to keep it secret. Reverse engineering is the tempting choice, but the statute asks whether information is readily ascertainable by proper means, and months of lab work does not make a formula readily ascertainable. Trade secrets need no patent filing, and an employee who developed the formula on the job does not defeat the employer's claim to it.

Correct answer: A policy sliding scheme

A policy sliding scheme is correct: sliding means adding coverages or products the insured did not request or consent to, with the extra charges hidden in the premium. Twisting and churning both involve getting a customer to replace or convert an existing policy, which did not happen with this new policy. Premium diversion is the agent pocketing premiums instead of sending them to the insurer, whereas here the premium was inflated, not stolen.

Correct answer: Churning

Churning is correct: the agent uses the values built up in a client's existing policy to buy another policy from the same insurer, falsely presenting it as costing nothing, in order to earn new commissions. Twisting is the close second, but it means inducing a customer to drop or replace a policy through misrepresentation, usually moving the business to another insurer; drawing down the same insurer's policy values is what defines churning. Rebating is giving the buyer part of the commission, and sliding is adding coverage the customer never requested.

Correct answer: A swoop-and-squat crash

A swoop-and-squat crash is correct: one car (the swoop) cuts in front of the squat car, the squat car brakes hard, the innocent driver behind rear-ends it, and the swoop car leaves. A panic-stop crash also uses a passenger-filled car braking suddenly in front of a victim, but there is no second car cutting in; that second car is what decides this case. Nothing shows that people jumped into the car after the crash, and a drive-down involves waving the victim into a turn or merge and then hitting it, not a rear-end collision.

Correct answer: A fictitious payee scheme

A fictitious payee scheme is correct: the agent changes the policyholder's address to one the agent controls, requests a loan or cash surrender, and changes the address back once the check is issued, so the payment goes to someone other than the true owner. Premium diversion is stealing premiums the customer pays in, not policy values paid out. A fictitious policy or fictitious death claim requires an invented insured or a death that never happened, but here the policy and the policyholder were real.

Correct answer: The owner raised the contents coverage weeks before the fire

The owner raised the contents coverage weeks before the fire is correct, because arson for profit is defined by a financial motive, and an increase in coverage at a struggling business is a classic profit indicator. Multiple points of origin and gasoline residue are the tempting choices, but they show only that the fire was set deliberately; they say nothing about whether the motive was profit or revenge. A threat from a fired kitchen worker actually points toward revenge.

Correct answer: Inspecting and photographing each vehicle prior to binding coverage

Inspecting and photographing each vehicle prior to binding coverage is correct: a physical inspection at underwriting confirms the car exists before any policy is issued, which stops paper-vehicle schemes before the first claim. Matching claims against an industry claims database is a strong detective control for duplicate or repeat claims, but it acts after a claim is filed and cannot show that a car never existed. Police reports are also post-loss and easy to obtain for invented thefts, and agent licensing checks do nothing about vehicles sold through a direct online channel.

Correct answer: Insurer fraud, committed by the administrator

Insurer fraud, committed by the administrator is correct: wrongfully denying valid claims by misrepresenting coverage and keeping the plan's money is fraud committed on the insurer or plan-administration side, against members and the plan. Premium diversion, committed by the plan sponsor is the tempting choice because funding deposits were misused, but the employer paid its deposits as required; the diverting party was the administrator that held them. The providers and members submitted valid claims, so they are victims, not perpetrators.

Correct answer: The surge in credit orders resold below cost just before the filing

The surge in credit orders resold below cost just before the filing is the hallmark of a bust-out: credit is built honestly, then maxed out on goods that are converted to cash and siphoned off before the company collapses. A short operating history is tempting because many bust-outs use new entities, but young businesses fail honestly all the time, so age alone does not separate fraud from failure. Choosing liquidation and having mostly unsecured trade creditors are equally common in genuine failures.

Correct answer: A fraudulent conveyance the trustee can seek to avoid and recover

A fraudulent conveyance the trustee can seek to avoid and recover is correct: under 11 U.S.C. 548 a transfer within two years of filing for less than reasonably equivalent value while the debtor was insolvent can be avoided, and $8,000 for a $60,000 truck fits. A preferential transfer is the tempting choice because the buyer is an insider within one year, but a preference requires a payment to a creditor on an antecedent debt, and the brother-in-law was owed nothing. It is not concealment because the sale was disclosed, and a bust-out involves inventory bought on credit, not a single below-value sale.

Correct answer: An examiner, who investigates and reports while management operates

An examiner, who investigates and reports while management operates, is correct: under 11 U.S.C. 1104(c) the court can appoint an examiner to investigate allegations of fraud or mismanagement while the debtor-in-possession keeps control of the business. A Chapter 11 trustee is the tempting choice because a trustee also investigates, but appointing one displaces management, which the court declined to do here. The US Trustee Program supervises cases and appoints trustees and examiners but does not take over the business, and a state-law receiver is a non-bankruptcy remedy.

Correct answer: When the broker reclaims input VAT on its zero-rated export of goods

When the broker reclaims input VAT on its zero-rated export of goods is correct: exports are zero-rated, so the broker claims a repayment of the VAT it paid on purchase, and the treasury refunds VAT that the missing trader never remitted, which is what turns the unpaid tax into a cash loss in a carousel. The missing trader's domestic sale is tempting because that is where the VAT goes unpaid, but at that point the treasury has only failed to collect; it has paid nothing out. The VAT-free acquisition is lawful, and buffers offset input against output and remit the small difference.

Correct answer: Claims data held separately by each state, blocking cross-state matching

Claims data held separately by each state, blocking cross-state matching is correct: each claim passed that state's own checks, so the fraud only shows up when the same identity is compared across states, which siloed systems prevent. Pressure to pay quickly is tempting because it is the classic prevention challenge, but the stem says each state did run its checks, so the gap was what they could see, not whether they checked. Self-certification does not explain it because each state verified wages against its own records, and federal law does not flatly bar states from sharing claims data through the national integrity hubs.

Correct answer: Change-order abuse in the post-award phase

Change-order abuse in the post-award phase is correct: a contractor wins with an unrealistically low bid and then recovers the margin, and more, through change orders approved after award, so a low bid followed by frequent change orders is a classic post-award red flag. Bid manipulation in the bid evaluation phase is tempting because the low bid looks suspicious, but the bids were sealed and opened publicly on time, so nothing was altered or leaked at evaluation. Bid tailoring would show up in specifications written to favor one vendor, and defective pricing is a failure to disclose accurate cost or pricing data during negotiation, which the facts do not describe.

Correct answer: The consistency principle

The consistency principle requires an entity to apply the same accounting methods from period to period, changing only when the new method is justifiably preferable, so that results remain comparable; switching back and forth to maximize margin defeats that, footnotes or not. Materiality is the tempting choice because each change is small, but materiality is a threshold for what must be reported, not the principle the switching offends. Conservatism concerns resolving uncertainty without overstating, and matching concerns timing expenses with revenue, which every cost-flow method still does.

Correct answer: Costing goods sold at the most recent purchase prices first

Costing goods sold at the most recent purchase prices first is the last-in, first-out (LIFO) method, which IAS 2 prohibits even though US GAAP permits it. The other three look aggressive to someone trained in US GAAP, and that is the trap: IAS 16 permits a revaluation model for property, plant and equipment, IAS 2 requires reversal of an inventory write-down when net realizable value recovers, and IAS 38 requires development costs to be capitalized once the technical-feasibility criteria are met.

Correct answer: Uses insurance claims jargon fluently and knows each step of the process

A claimant who is unusually familiar with insurance terminology and the claims process is a recognized red flag of claims fraud. Asking how long payment takes and which forms are outstanding is the tempting choice, but ordinary questions about the process are normal; the flag is pressure for a quick settlement or expert-level familiarity. A long claim-free record is the opposite of the recognized flag (a history of frequent claims), and missing receipts matter only for undocumented expensive property.

Correct answer: A past-posting claim

Past posting is buying coverage after a loss has occurred and then reporting the loss as if it happened after the policy took effect, which is exactly this. A backdated-policy claim is the tempting choice because both schemes reach a pre-coverage loss, but backdating moves the policy's effective date earlier, and here the effective date is recorded correctly; only the loss date was falsified. A paper accident is a collision that never happened at all, and an owner give-up is disposing of one's own vehicle and reporting it stolen.

Correct answer: Premium fraud by the employer, through misclassified payroll

Reporting high-risk roofing wages under a low-rated clerical code lowers the premium the carrier charges, which is classic employer premium fraud through payroll misclassification. Claim fraud by the employer is the tempting choice because the misstated duties came to light through a claim, but the fall was genuine and accurately reported, so the fraud lies in the rating data, not the loss. A false claims history is a different premium scheme that the facts do not show, and the roofer did nothing wrong.

Correct answer: Multiple filings, repeatedly invoking the stay to stall the sale

Multiple filings, repeatedly invoking the stay to stall the sale is correct: each petition automatically stays the foreclosure sale, and serial filings with no intent to complete a plan abuse that stay, which is why 11 U.S.C. 362(c)(3) and (c)(4) limit or deny the stay for repeat filers. Petition mill is tempting because skeletal petitions filed to stop a sale and then dismissed are its hallmark, but a petition mill is a third party that charges desperate homeowners or renters, and this debtor acted alone. He incurred no new debt, so it is not a planned bankruptcy, and he filed in his own name, so nothing was forged.

Correct answer: Matching the claimed payroll to IRS transcripts of filed payroll tax returns

Matching the claimed payroll to IRS transcripts of filed payroll tax returns is correct because those filings show the wages a business actually reported, so a claim of dozens of nonexistent workers would not match. Requiring a re-certification under penalty of perjury is tempting because it raises the legal stakes, but it is still the applicant's own word and verifies nothing. Confirming registration and EIN proves the business exists, which these did, and exclusion screening tests the owner's eligibility, not the payroll amount.

Correct answer: Labor mischarging of the engineers' hours to the cost contract

Labor mischarging of the engineers' hours to the cost contract is correct: shifting labor from a fixed-price contract, where the contractor bears overruns, to a cost-reimbursable contract, where the government pays actual costs, is the classic post-award cost mischarging scheme. Duplicate billing is tempting because the hours reached the government, but the hours were recorded only once and the fixed-price contract was billed at its set price, not by the hour. Defective pricing is ruled out because the cost data were accurate, and change-order abuse requires a contract modification, which never occurred.

Correct answer: Placement period

Placement period is correct: placement is the first phase of laundering, when dirty cash is physically introduced into the financial system, for example by depositing it or buying monetary instruments. Layering process is wrong because layering moves funds that are already in the system to obscure their trail. Integration step is wrong because integration returns the laundered funds to the economy as apparently legitimate wealth, the last phase. Smurfed deposits is wrong because smurfing is a technique of breaking cash into small deposits, used within placement, not a stage of its own.