CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Questions and Answers

Nonverbal deception cues include feigned unconcern, slouching, chewing objects, and manipulating clothing. Michelle’s conduct (chewing pen cap, picking at fabric, appearing unconcerned) matches these signs ofdeception.

TheFraud Examiners Manualexplains:

“Benford’s Law applies to data that is not assigned (such as IDs or phone numbers) but that occurs naturally in transactions. For example, payment amounts, invoice values, and expense reimbursements are well suited.”

Thus,payment amountsare best suited for Benford’s Law.

Court records are frequently used in fraud investigations. Both the Prep Guide and the Manual agree thatthe court clerk’s office (court authorities) is the original and most reliable sourceof certified and accurate records.

Although commercial services and online databases exist, the manuals emphasize that reliability and certification are best ensured by going directly to the court where the case was filed.

Thus, the statement isTrue.

Best practice for signed statements:

Fraud examiners should prepare the statement, keep it concise, and ensure voluntariness and intent are clear.

While not legally required, it isrecommendedthat two individuals witness the signing.✅Answer: C. Have two individuals witness the signing of the document when possible

The Manual and Prep Guide state:

“Before conducting a covert operation, it is essential that the basis for the operation be committed to writing, preferably in a memo. The memorandum should clearly state: the information upon which the covert operation will be based; the information that is expected to be gained from the operation; the identities of suspects, if known; operatives under the fraud examiner’s care, custody, or control. Confidential sources’ identities should not be disclosed.”

Thus,expected informationbelongs, butconfidential source identitiesmust not

TheFraud Examiners Manualadvises avoiding prematurely alerting perpetrators. Recommended methods include:

“Conducting investigations at times when the suspect is not present (such as nonbusiness hours)”.

This avoids tipping off suspects.

The recommended questioning order is:

“As a general rule, questioning should proceed from thegeneral to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

The best practices for signed statements include:

Adding omitted facts as anaddendum.

Preparingseparate statements for unrelated offenses.

Havingwitnesses to the signing.

But:

“The signed statement should be reduced to a short and concise written statement. The interviewer should prepare the statement and present it to the confessor for his signature” .

Thus, requiring the suspect to handwrite the entire statement isnot a best practice.

When introducing themselves, fraud examiners should avoid titles likeinvestigatororCertified Fraud Examinerthat might raise suspicion or defensiveness. TheManualrecommends using neutral titles such asauditorbecause it is less threatening and more acceptable in an organizational setting.

TheFraud Examiners Manualstresses confidentiality:

“To preserve confidentiality, investigators should avoid transmitting confidential information by email or other electronic means whenever possible, as these are susceptible to interception or unauthorized access.”

Suspending employees or blanket bans on discussion are not best practices. Confidentiality is preserved primarily by secure communication and controlled access to information.

Phone records are classified asnonpublic records. TheFraud Examiners Manualexplains that personal telephone and mobile records usually requireconsent, subpoena, or warrantto access. Public records, by contrast, include real property ownership and corporate filings. Therefore,Bis correct.

TheFraud Examiners Manuallists required steps before seizing evidence:

Obtain legal authority.

Review privacy issues.

Ensure software/hardware are validated.

Document surroundings, inspect for traps, image drives, etc.

There isno requirementto assemble a team exclusively of outside experts.

Before seizing evidence in adigital forensic investigation, the2014 International Fraud Examiners Manualoutlines several critical steps:

Obtain legal authority / review orders:

“Before obtaining evidence, ensure that there is legal authority to seize evidence and review the data associated with the evidence. This might require obtaining a warrant in a criminal matter or ensuring that internal policies authorise seizure for an internal investigation.”

Determine privacy issues:

“Before the fraud examiner can seize evidence, he must take certain steps to help ensure that the evidence will be admissible: He must determine whether there are any privacy interests in the item(s) to be searched… In every case where it becomes necessary to seize a computer or other device capable of storing digital evidence, the investigator should consult with legal counsel.”

Use only trained professionals/software:

“It is important to allow a trained examiner to conduct a proper seizure and examination of digital evidence to help ensure that the information can be used in a legal proceeding.”

✅These are allvalid required steps.

In contrast, the idea that the team must be composedonly of outside digital forensic expertsisNOT a required step. The Manual stresses flexibility in team composition:

“Some organisations have their own in-house personnel… while others might prefer the use of an outside examiner. Sometimes retrieving digital data is as easy as searching the target computer’s hard drive, but other times retrieval requires a thorough knowledge of computers.”

Thus, requiringonly outside expertsis not a standard step, since investigations may useinternal, external, or a mixof specialists depending on the situation.

“As a general rule, questioning should proceed from the general to the specific; it is best to seek general information before details. A variation… is to begin with known information and work towards unknown areas”【9:2014 International Fraud Examiners Manual.pdf†L39-L51】.

Random order isnot recommendedand breaks the logical flow.

The Fraud Examiners Manual explains that recommendations in a report areoptional, not mandatory. When included, they should cover remedial measures such as control reviews or increased security.

“Finally, the fraud examiner might decide to include a section for recommendations. The recommendations section should containremedial measures or specific recommendations for follow-up actions… This section is optional”.

Therefore,Cis correct. Options A and D are incorrect because recommendations are not required in every report, and B misstates its purpose.

The Manual says admission-seeking interviews should be conducted only when:

There is reasonable probability the subject committed the act,

All other reasonable investigative steps are complete, and

“The interviewer can reasonably control the place, time, and subject matter of the interview.”.Therefore, Erica must ensure control oftime, place, and contentbefore scheduling.

TheFraud Examiners Manualnotes that EU privacy laws (e.g., EU Data Protection Directive, precursor to GDPR) restrict or prohibit the transfer of personal data to non-EU countries without compliance:

“Many foreign countries—and those in the European Union (EU) in particular—restrict or prohibit processing and transferring personal data… The EU’s directive… places limits on transmitting personal data to non-EU countries”.

Thus, since the fraud examiner is handling data about an EU-based employee, GDPR compliance is required, even if the examiner is outside the EU.

The manuals explain that in verbal confessions, subjects oftenunderestimatethe amounts to minimize guilt, not overestimate. The process involves moving from accusation to benchmark admission, handling lies tactfully, and obtaining details by chronology, transaction, or event. Thus, optionBis NOT true.

“Opinions or conclusions concerning the guilt or innocence of a fraud suspect is outside the scope of a fraud examination and should never be included in a report”.

Functions of a fraud examination report include presenting evidence, corroborating facts, and supporting credibility. Communicating the examiner’s qualifications to provide opinions isnota function.

Therefore, option D is not a function of a fraud examination report.

TheFraud Examiners Manualmakes clear:

“Fraud examiners should never offer opinions regarding guilt or innocence. Reports must be factual, objective, and free from speculation. Statements implying guilt are improper.”

Thus, while it is proper to note contradictions, evidence, or control weaknesses, it isimproper to declare the suspect guilty.

“Once a denial is uttered, it becomes extremely difficult for the accused to change his response, because doing so would be an admission that he lied. Therefore, the interviewer must prevent an outright denial, thereby making it easier for the subject to confess”.

“One of the most effective techniques to stop or interrupt a denial is through a delaying tactic… the interviewer should attempt to delay the outright denial; he should not argue with the accused”.

Thus, Charles should interrupt with a delaying tactic.

Best practices for admission-seeking interviews emphasize building rapport, presenting a morally acceptable reason, and maintaining empathy to encourage a confession. The manual states examiners should “present a morally acceptable reason for the suspect’s behavior” and avoid creating hostility . Minimizing empathy is counterproductive andnot recommended.

TheFraud Examiners Manualstates:

“Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction… emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive”.

Thus, statement C isNOT true.

Predictive analytics is defined as:

“the use of historical data combined with statistical, analytical, and machine learning techniques to create models that capture trends and produce forecasts”.

So, optionCbest describes predictive analytics.

TheFraud Examiners Manualnotes:

“Companies are formed by submitting some type of organisational filing… these company records are generally public records and will include: corporate name, ownership information, location of the principal office, date of incorporation”.

The Prep guide also confirms: “A company’s organisational filing with the government generally includes information about the company’s ownership, initial shareholders, and the location of its principal office”.

TheFraud Examiners Manualstresses that fraud examiners mustnever promise unconditional confidentiality, because findings often must be disclosed to management, auditors, or authorities. They can only offer “qualified confidentiality” (best efforts to protect identity, but with necessary limits). Therefore, optionAis the most appropriate response.

TheFraud Examiners Manualstresses that interview notes should be kept separately for each interview, even if the session is electronically recorded, because recordings can fail or be challenged. Verbatim transcripts are not expected, and impressions of guilt should never be included. Best practice is to keep clear, accurate,separate recordsfor every interview .

“Fraud examinations should proceed from thegeneral to the specific. That is, they should begin with general information that is known, starting at the periphery, and then move to the more specific details”.

This method avoids premature assumptions and ensures systematic evidence development.

“Documentary evidence, including digital evidence, will not be admitted… unless it is established as authentic… fraud examiners mustcapture, download, and preserve any useful information as soon as they discover it, and memorialize each step of the collection process”.

“Credit card records… show card purchasing limits, previous payment history, account balance,when and where the subject has travelled, restaurants frequented, and assets acquired. In short, these records show the movements and habits of the person”.

Therefore,Bis correct.

Both the Manual and CFE Prep guides emphasize thatdeleted files are recoverable until overwritten. Once overwritten, the original data cannot be retrieved:

“Deleted files are recoverable until they are overwritten because data is not erased… until overwritten. So, deleted files that have been overwritten generally arenot recoverable.”

Other file types (deleted shortcuts, hidden files, etc.) can often be recovered, butoverwritten files are lost permanently.

TheFraud Examiners Manualexplains:

“A Certified Fraud Examiner should not promise confidentiality or leniency to an informant to obtain testimony… the confidentiality relationship runs first to the client or employer”.

Thus, Lisa cannot guarantee full confidentiality but may state she will do her best.

TheFraud Examiners Manualadvises:

“Do not slow down the interview process for note-taking. Instead, jot down key words … In general, it is better to err on the side of taking too few notes rather than too many.”

Therefore, the best practice isC.

Oral consent is generallynot sufficientto obtain a suspect’s bank records. TheCFE Prep - Investigationsstates:

“Accessing a subject’s bank records from financial institutions generally requires written consent. Oral consent is the least effective way to obtain permission”.

TheFraud Examiners Manualalso notes that bank information can usually only be obtained withsubpoena, search warrant, or written consent.

Complex questions:

“consist of a series of interrelated questions… too complicated to be easily understood, cover more than one subject, or require more than one answer”.

The question asked by Delta (“Were you aware that the signature was forged, and why didn’t you tell anyone earlier?”) covers two issues, making itcomplex.

Explanation with Extracts= TheFraud Examiners Manualexplains:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging the data… allows a fraud examiner to view and analyse the contents of a computer without altering the original data in any way”.

Imaging creates an exact, sector-by-sector copy of the drive.

Thus, imaging protects original data integrity.

TheFraud Examiners Manualclarifies:

“The recommendations section is optional, and there might be instances where the fraud examiner wishes to discuss remedial measures or specific recommendations in a separate document”.

The Prep guide also states: “A written report might include a section for recommendations”.Thus, it isnot requiredin every report.

Explanation: After alibis are diffused, suspects may become quiet, withdrawn, or even cry. This often indicates they are considering confession. At this point, the interviewer should present analternative question, forcing a choice between two answers that both imply guilt, thus leading toward a benchmark admission.

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

The2014 Fraud Examiners ManualandCFE Prepexplain:

“Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.”

Thus, the correct answer isA.

CFE Prepclarifies entrapment:

“Entrapment occurs when law enforcement induces a person to commit a crime that he is not predisposed to commit… It is imperative that adequate predication exists before the operation is commenced. For example, if the officer received a reliable tip, that could serve as adequate predication.”

Here, the officer acted on a reliable tip, so the entrapment claim would fail.

The2014 International Fraud Examiners Manualprovides:

“Fraud examiners can use a correlation analysis to determine the relationships between different variables in raw data… For example, there should be a strong correlation between the independent and dependent variables because there is a direct relationship between them.Hotel costs should increase as the number of days travelled increases.”

CFE Prep – Investigationsechoes this:

“Using the correlation analysis function, fraud examiners can determine the relationships between different variables in the raw data. For example…Hotel costs should increase as the number of days travelled increases.”

Thus, the most useful analysis isCorrelation analysis.

“The interviewer must not express disgust, outrage, or moral condemnation… the basic logic of obtaining confessions can be summed up asmaximize sympathy and minimize the perception of moral wrongdoing”.

Sympathy creates an environment conducive to confession, while other options (third-party presence, emphasizing immorality, or pressuring with time) are explicitly discouraged.

The2014 International Fraud Examiners ManualandCFE Prep - Investigationsexplicitly state:

“Like some printers, copiers and other multifunction machines might have internal storage devices that store relevant data. In fact, almost every copier built since 2002 has a hard drive that stores images of documents the machines have copied, scanned, or emailed. Some copiers store user access records and a history of copies made. … when seizing a computer for forensic analysis, it is generally necessary to seize any copiers and scanners connected to it.”

Thus, the correct answer isC.

TheFraud Examiners ManualandCFE Prepemphasize:

“Generally, documentary evidence, including digital evidence, will not be admitted in a legal proceeding unless it is established as authentic… Consequently, fraud examiners who collect evidence from social media must capture, download, and preserve any useful information as soon as they discover it, and they must memorialize each step of the collection process”.

Thus, preservation for authenticity is the key.

“The locations of the subject’s residences and businesses (e.g., through analysing the payments of utility bills)… The cities and countries in which the subject conducts business (e.g., through analysing the payments for carrier services to deliver packages)”【6:2014 International Fraud Examiners Manual.pdf†L57-L77】.

They donotdirectly prove skimming or show market values of real estate.

According to theFraud Examiners Manual:

“Credit card records are important in tracing assets… information on credit card charges might provide leads to identifying hidden assets. For example, if a fraud examiner notices that the subject used his credit card to purchase items at a marina, the fraud examiner should investigate further to determine if the subject owns a boat”.

Therefore,Ais correct.

Body language alone (e.g., avoiding eye contact) cannot be taken as proof of deception. The Manual warns against drawing conclusions from a single behavioral cue:

“Avoiding eye contact isnot directly linked to deception. Such behavior could stem from cultural norms, nervousness, or personality traits. Examiners should consider clusters of behavior, context, and corroborating evidence before concluding deception”.

Therefore,Cis correct.

Explanation with Extracts= Pretexting is:

“The act of impersonating someone else or making false or misleading statements to obtain information from financial institutions. Several jurisdictions have prohibited pretexting against financial institutions”.Thus, falsely claiming to be the spouse constitutes illegal pretexting.