ACFE CFE-Investigation Dumps

The Fraud Examiners Manual stresses that interview notes should be kept separately for each interview, even if the session is electronically recorded, because recordings can fail or be challenged. Verbatim transcripts are not expected, and impressions of guilt should never be included. Best practice is to keep clear, accurate, separate records for every interview .

The manual notes:

“Records subpoenaed in a criminal case usually are available only to the government during the investigation, and perhaps thereafter if not disclosed at trial”.

Thus, statement D is false.

The Fraud Examiners Manual specifies:

“Fraud examinations should proceed from the general to the specific. That is, they should begin with general information that is known and then move to more specific details.”

Therefore, statement B is false, making it the correct answer.

A key principle in fraud examinations is confidentiality. Fraud examiners must avoid tipping off the suspect, which could lead to destruction of evidence or flight. Measures include limiting discussions, informing only those with a legitimate need-to-know, and investigating discreetly.

To confirm ownership of a building, real estate and permit records are most useful. The Manual notes that real property records and related permits identify the owner, provide legal descriptions, and show improvements such as construction of commercial buildings. Court or voter registration records would not typically establish property ownership.

The Fraud Examiners Manual notes that EU privacy laws (e.g., EU Data Protection Directive, precursor to GDPR) restrict or prohibit the transfer of personal data to non-EU countries without compliance:

“Many foreign countries—and those in the European Union (EU) in particular—restrict or prohibit processing and transferring personal data… The EU’s directive… places limits on transmitting personal data to non-EU countries”.

Thus, since the fraud examiner is handling data about an EU-based employee, GDPR compliance is required, even if the examiner is outside the EU.

The Fraud Examiners Manual notes:

“Management of an organisation should ensure that the organisation has a proper and effective document retention policy in place… An effective policy requires clear retention protocols… and should be immobilised due to a pending investigation or foreseeable litigation.”

Thus, the existence of a document retention policy is a critical factor in deciding how to dispose of evidence.

Wire transfer records include specific transactional details:

“The information contained on a wire transfer generally will include… the amount of the transfer, the date, the name of the sender, the routing number of the originating bank, the identity of the beneficiary, [and] the routing number of the recipient bank”.

They do not list things like the type of money order, customs port of entry, or government ID numbers (CFE Prep explicitly states that recipient government IDs are not typically included).

For publicly traded companies, the best source for information on officers and directors is regulatory securities records. These records typically include “identification of officers and directors, financial statements, significant owners, and accountants and attorneys”.

The 2014 International Fraud Examiners Manual states:

“Asset hiders look for certain characteristics in the financial vehicles they use to conceal assets. Asset hiders want products that are liquid (i.e., items that can be purchased and sold in a short period of time). Moreover, asset hiders want products that are difficult to trace or untraceable. With such instruments, asset hiders can break or muddy links between the initial receipt of the assets and their final disposition. Asset hiders also look for products that are secure and accessible.”

The CFE Prep - Investigations guide confirms:

“Asset hiders want products that are liquid, difficult to trace, secure, and accessible… NOT transparent.”

???? Interpretation:

Accessibility = common desirable trait (correct).

Transparency = opposite of concealment (not desirable).

Exclusivity = not a standard consideration.

Traceability = asset hiders want the opposite (difficult to trace).

The Fraud Examiners Manual stresses confidentiality:

“To preserve confidentiality, investigators should avoid transmitting confidential information by email or other electronic means whenever possible, as these are susceptible to interception or unauthorized access.”

Suspending employees or blanket bans on discussion are not best practices. Confidentiality is preserved primarily by secure communication and controlled access to information.

Explanation with Extracts = The Fraud Examiners Manual explains:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging the data… allows a fraud examiner to view and analyse the contents of a computer without altering the original data in any way”.

Imaging creates an exact, sector-by-sector copy of the drive.

Thus, imaging protects original data integrity.

Best practice is to conduct interviews individually. The Manual states:

“When conducting interviews, witnesses should be interviewed separately. Interviewing multiple witnesses together risks contamination of testimony and reduced reliability of responses”.

Both the CFE Prep Guide and the Fraud Examiners Manual state that every fraud examination must be conducted under the assumption that litigation will result. This ensures that evidence is collected and preserved properly, in compliance with legal standards:

“Each fraud examination should begin with the proposition that the case will end in litigation… If the fraud examiner assumes that litigation will occur, he will conduct the examination in accordance with the proper rules of evidence”.

This principle protects the integrity of the examination and ensures admissibility of evidence if the matter proceeds to court.

Fraud examiners must not opine on guilt, innocence, intent, or disposition. Reports should focus on facts and expert conclusions within their field. The Manual stresses:

“The fraud examiner should refrain from expressing opinions as to the guilt or innocence of any person or entity. Such conclusions are reserved for the trier of fact” (Fraud Examiners Manual, Reporting section).

Options A, B, and D relate to accounting and internal control assessments, which fall within an accounting expert’s scope. Only C is improper because it speculates about the suspect’s character or intent, which is outside the CFE’s role.

The Fraud Examiners Manual explains:

“Each transaction on a blockchain ledger is recorded with a cryptographic address… by analyzing these addresses, fraud examiners can sometimes establish patterns and connections that identify users or link them to criminal activity”.

CFE interview guidance identifies verbal behaviors that often appear when an interviewee is being deceptive. A strong indicator is answering with a question rather than providing a direct denial. When asked directly about misconduct, truthful respondents commonly give a straightforward “no” and may add clarifying facts. Deceptive respondents sometimes deflect, buy time, or attempt to regain control by replying with a question such as, “Why would I do something like that?” This response avoids the substance of the allegation and shifts the burden back to the interviewer, potentially probing how much evidence the interviewer has. While Options A, B, and D are denials (and any denial could be untrue), the CFE materials specifically flag “answering with a question” as a frequent deceptive tactic because it functions as diversion and can indicate discomfort with issuing a clear denial. Therefore, among the choices presented, Option C is most consistent with a deceptive verbal response pattern described in CFE interview methodology.

CFE Prep clarifies entrapment:

“Entrapment occurs when law enforcement induces a person to commit a crime that he is not predisposed to commit… It is imperative that adequate predication exists before the operation is commenced. For example, if the officer received a reliable tip, that could serve as adequate predication.”

Here, the officer acted on a reliable tip, so the entrapment claim would fail.

When a respondent says “I’m too busy,” it can be diffused by stressing “the interview will be short, the interviewer is already there, the project is important, [and] the interview will not be difficult”.

Thus, stressing brevity is the recommended reaction.

In admission-seeking interviews, one rationalization technique is to depersonalize the victim (e.g., shifting the perception so the harm was against a company, not individuals). The example in the question—“It isn’t like you took something from a friend or neighbor”—is exactly this technique.

When a witness resists an interview with “I’m too busy,” CFE interview guidance treats this as a common barrier that may conceal other causes—reluctance, discomfort, ego concerns, or simply a desire to avoid involvement. The recommended approach is to reduce resistance by emphasizing cooperation, importance, and minimal burden: communicate that the witness’s help is needed, the interview will be brief, and it will not be difficult. Option D directly reflects these recommended diffusion techniques by stressing both the importance of the witness’s assistance and the short duration of the meeting, which lowers the perceived cost of participation. Option A is inappropriate and potentially coercive, may exceed the examiner’s authority, and can create hostility or claims of intimidation—undermining credibility and reliability of information obtained. Option C is confrontational and escalates resistance without advancing the interview. Option B can be helpful as a scheduling accommodation, but CFE guidance for this specific resistance phrase prioritizes overcoming the objection by reassuring brevity and importance, making D the best answer among the options.

The Fraud Examiners Manual defines double-negative questions as those containing two forms of negation in a single clause. They are confusing and “often suggest an answer opposite to the correct one.” The example given is almost identical to the question here:

“Didn’t you suspect that something wasn’t right?”.

Thus, Sylvia’s question is a double-negative question, which should be avoided.

The Fraud Examiners Manual emphasizes that before commencing legal action to recover assets, the examiner must consider whether the defendant has assets worth pursuing:

“The most important question a fraud examiner should ask before beginning legal action to recover assets is whether the defendant has sufficient property or money to satisfy a judgment. Legal actions can be time-consuming and costly, and recovery efforts are futile if the defendant is judgment-proof.”

Before commencing legal action to recover assets, the most critical consideration is whether the defendant has recoverable assets. If the defendant lacks property or funds, pursuing legal action could be costly and ultimately fruitless.

From the 2014 International Fraud Examiners Manual:

“After a fraud is discovered, fraud examiners might need to assist in making a recommendation concerning the recovery of lost assets… A domestic judgment against a foreign defendant is usually helpful for recovering the defendant’s assets located in the domestic country, but might be worthless for obtaining the defendant’s assets in a foreign country.”

This emphasizes that enforcement of judgments is only meaningful if assets exist to satisfy them.

Similarly, the CFE Prep - Investigations material highlights asset tracing and recovery as the foundation for deciding legal action:

“Records obtained from financial institutions are perhaps the single most important financial source available to fraud examiners for purposes of tracing assets.”

???? Interpretation of Answer Choices:

A. Prior arrests → Not directly relevant to whether asset recovery will succeed.

C. Statute of limitations → Important for legal viability, but meaningless if no assets exist to recover.

D. Guilt of the suspect → Guilt must be established in criminal cases, but in civil recovery, asset availability is paramount.

B. Defendant’s property or money → This is the most important practical question, because without assets, recovery efforts will not yield compensation regardless of guilt or legal timelines.

“Once a denial is uttered, it becomes extremely difficult for the accused to change his response, because doing so would be an admission that he lied. Therefore, the interviewer must prevent an outright denial, thereby making it easier for the subject to confess”.

“One of the most effective techniques to stop or interrupt a denial is through a delaying tactic… the interviewer should attempt to delay the outright denial; he should not argue with the accused”.

Thus, Charles should interrupt with a delaying tactic.

The manual states:

“When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence.”

Thus, B is the least accurate statement.

Referring to the informant in the memorandum using the informant's initials

Best practice requires that informants be identified only by symbols (e.g., I-1, I-2), not by initials, to protect their identity. Cash payments are acceptable but must be accompanied by a receipt.

CFE admission-seeking guidance explains that once a suspect begins providing detailed information about the offense, the interviewer should transition to obtaining a verbal confession and then “probe gently” for additional details—preferably details only the subject would know. As part of confirming the general details of the offense during the verbal confession, the interviewer should obtain key baseline facts such as estimates of amounts involved, identification of other parties involved, and the location of physical evidence. Among the choices, a general estimate of the amount of money involved (A) is explicitly aligned with what the CFE guidance expects the interviewer to gather during the verbal admission stage because it helps establish scope and supports later corroboration and restitution analysis. Option B is less fitting because the emphasis is on what the suspect can reliably provide (their own actions and knowledge), not “facts known to others.” Option C attempts to build a defense narrative rather than obtain factual admission details. Option D may be useful for remediation later, but it is not a primary objective during the verbal confession stage.

“Due to the risks of illicit transactions, most jurisdictions require financial institutions to obtain information about the ownership and control of the foreign bank with which they maintain correspondent relationships”.

Predictive analytics is defined as:

“the use of historical data combined with statistical, analytical, and machine learning techniques to create models that capture trends and produce forecasts”.

So, option C best describes predictive analytics.

Fraud examiners can obtain documentary evidence by consent, subpoena, or other legal means. While oral consent may sometimes be sufficient, bank records from financial institutions generally require written consent. Without written consent, the bank is not required to provide access. As stated in the manual:

“Accessing a subject’s bank records from financial institutions, for instance, generally requires written consent. If no consent is given… legal action might be required, most often a subpoena or other court order”.

Thus, although the suspect gave oral consent, Alex cannot access the bank records without written authorization or legal order.

“Distractions should be kept to a minimum. Ideally, there should be no photographs, windows, or other objects in the room. Chairs should be placed about four to six feet apart, and the accused should not be permitted to sit behind any physical barriers, such as chairs, tables, or desks” .

The door should be closed (but not locked), not open .

Tables or desks should not be between interviewer and suspect .

Thus, the correct adjustment is removing distractions (pictures/posters).

Best practices when working with confidential informants include documenting payments and identities in ways that protect anonymity but avoid risks. The Fraud Examiners Manual and CFE Prep emphasize avoiding cash payments because they reduce transparency and create audit trail problems. Paying in cash is therefore NOT considered a best practice, whereas using initials, obtaining receipts, and documenting informant information in reports can be acceptable methods.

The correct answer is: Whether recording is legal depends on consent laws — so the most helpful question is effectively: “Is consent required from one or all parties to record this conversation?”

Among the provided choices, the closest match is NOT listed explicitly. But based on the ACFE manuals, the correct interpretation is that none of the technical details (audio/video, file format, time, duration) matter — only the legal consent requirement matters.

Complete Detailed Explanation with Exact Extracts from Fraud Examiner (CFE) - Investigation Documents: =

The 2014 International Fraud Examiners Manual states:

“In some circumstances, recording an interview might be illegal. Some jurisdictions limit an employer’s right to record employee interviews during an investigation. In fact, in some jurisdictions, audio recording an interview is permitted only with the consent of all parties to the communication. Thus, fraud examiners should always consult with an attorney when deciding whether to record an interview.”

It further emphasizes:

“A telephone recording consent form stipulates where, when, and with whom telephone conversations can be recorded… Be cautioned that the form alone does not make the conduct of recording a telephone conversation illegal or legal.”

???? Interpretation:

The legality of recording has nothing to do with:

Audio vs video (A)

Digital file format (B)

Work hours (C)

Duration (D)

Instead, it depends entirely on jurisdictional consent laws (one-party vs all-party consent).

The Manual emphasizes that interviews should be held where the respondent feels comfortable and secure, not threatened:

“When possible, the interview should be held in a venue where the subject will feel comfortable and secure”.

Holding it in an uncomfortable setting is counterproductive and contrary to best practices.

The Fraud Examiners Manual lists specific queries for accounts payable analysis, including:

“Review recurring monthly expenses and compare to posted/paid invoices.”.

While comparing book vs. tax depreciation applies to asset management (not A/P), and identifying paycheck anomalies applies to payroll (not A/P), the most effective A/P-specific test is the recurring expense comparison. Hence, C is correct.

The calibration (or norming) process in interviews is meant to establish a baseline of the subject’s normal verbal and nonverbal behavior. This is done by asking noncritical background questions so that later deviations can be more reliably identified.

From the CFE Prep guide:

“The proper way an interviewer should start the calibration (norming) of a witness is through the use of: Noncritical questions on background information. … Examples of noncritical questions include ‘When did you start with the company?’ and ‘How long is your commute?’”.

Thus, the correct answer is D. “How many jobs have you had before this one?” since it is a nonthreatening background question.

“Even when a victim refers a fraud case for criminal prosecution, the government will usually not disclose the contents of nonpublic records with the victim during the investigation”.

Thus, option D is most accurate.

“Metadata information can help determine who wrote a document, who received, opened, copied, edited, moved, or printed the document, and when these events occurred”.

Thus, metadata is the best source for creation date.

Guidance on reports:

“A fraud examination report should be accurate, clear, and impartial. The fraud examiner should avoid technical jargon where possible and write in plain language so that readers without specialized knowledge can understand”.

Reports should only include relevant, factual findings—not every detail or opinion.

So, the most accurate statement is that jargon should be avoided.

Textual analytics is described as:

“a method of using software to extract usable information from unstructured text data… to reveal patterns, sentiments, and relationships indicative of fraud… Textual analytics provides the ability to uncover additional warning signs of rogue employee behavior”.

Its purpose is not to find direct admissions but to identify indicators and patterns.

The Fraud Examiners Manual advises that fraud examiners should preserve and organize evidence, and one of the key steps is to establish a document database early. This allows examiners to track documents, index them, and link them to findings. Dusting for fingerprints, leaving originals behind, or organizing solely in chronological order are not standard best practices .

“Credit card records… show card purchasing limits, previous payment history, account balance, when and where the subject has travelled, restaurants frequented, and assets acquired. In short, these records show the movements and habits of the person”.

Therefore, B is correct.

The Fraud Examiners Manual explains that recommendations in a report are optional, not mandatory. When included, they should cover remedial measures such as control reviews or increased security.

“Finally, the fraud examiner might decide to include a section for recommendations. The recommendations section should contain remedial measures or specific recommendations for follow-up actions … This section is optional”.

Therefore, C is correct. Options A and D are incorrect because recommendations are not required in every report, and B misstates its purpose.

The 2014 Fraud Examiners Manual and CFE Prep explain:

“Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.”

Thus, the correct answer is A.

“Introductory questions should be designed to establish rapport… Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Jason’s small talk about sports and compliments is clearly rapport building

“To locate people using online records… First, when searching for an individual, the fraud examiner should obtain a past address of the subject, and search activities should begin with that information”.

This aligns with the Prep guide: “Obtaining a past address of the subject should be the first step in trying to locate a subject using online records”.

Thus, B is correct.

CFE interviewing guidance emphasizes that legal considerations can materially affect how interviews are conducted and that employee rights and obligations vary by jurisdiction and by case. In particular, whether a subject has a duty to cooperate (and the extent to which an organization can compel cooperation) can differ across jurisdictions and can also be constrained by contractual rights (e.g., union agreements, employment contracts) and local regulations. Because June’s subject is from a different jurisdiction, the most appropriate preparation step is to verify jurisdiction-specific rules that could limit compulsion or otherwise affect the interview’s legal permissibility and risk profile. Option D directly addresses this core cross-jurisdiction concern: what can legally be required of the subject. Option A is not a CFE-recommended preparatory focus; examiners should adapt to legal and procedural requirements rather than “teach” their own cultural practices to the subject. Option B is inappropriate and contrary to professional interviewing principles (the goal is cooperation, not discomfort). Option C is incorrect because consultation with counsel is not limited to “third jurisdiction” scenarios; the guidance underscores that interview-related legal risks and jurisdictional differences often warrant counsel input. Therefore, D best reflects CFE investigation knowledge for cross-jurisdiction interviewing readiness.

When preparing for interviews, fraud examiners should avoid scripting detailed questions. Instead, they prepare notes of key points to cover.

From the Fraud Examiners Manual:

“Whenever possible, do not prepare a list of predetermined questions to ask the subject. The interview should flow freely. The interviewer might, however, want to develop a list of key points to cover during the interview”.

Therefore, the best preparation method is to note key points instead of detailed questions.

The Fraud Examiners Manual makes clear that covert operations are extraordinary measures that require high skill and planning and should be used only when no other practical method is available. They carry significant risks, including embarrassment, liability, and even injury or death. Therefore, covert operations should not be the first resort but instead follow conventional evidence-gathering efforts.

The Fraud Examiners Manual stresses that fraud examiners must never promise unconditional confidentiality, because findings often must be disclosed to management, auditors, or authorities. They can only offer “qualified confidentiality” (best efforts to protect identity, but with necessary limits). Therefore, option A is the most appropriate response.

“The failure to preserve the integrity of digital evidence could result in evidence being deemed inadmissible in a legal proceeding, or, even if admitted, it might not be given much weight because evidence of questionable authenticity does not provide reliable proof.”

Therefore, D is the most accurate statement.

Limitations of online public record searches include:

Need to search multiple jurisdictions.

Records are often only abstracts.

Information must be verified for accuracy.There is no mention that online record vendors are “difficult to find.” In fact, many such vendors exist.

Social media content is dynamic—posts can be edited, deleted, or moved—so fraud examiners must preserve relevant information promptly and in a manner that supports authenticity and admissibility. CFE investigative guidance emphasizes that documentary (including digital) evidence carries limited value in legal proceedings unless it can be shown to be authentic and in substantially the same condition as when collected. Simply saving a link (Option A) is weak because the underlying content can change, and a link does not preserve what was actually observed. Requesting a copy from the platform (Option B) is often impractical as a routine step and may require legal process; it also does not replace contemporaneous preservation by the examiner. A “forensic shutdown” (Option C) is not an appropriate method for preserving web-based social media content because the key evidence exists on external servers, not solely on the examiner’s machine. Proper practice is to download/capture and preserve what was observed while documenting the collection steps and maintaining a defensible chain of custody so authenticity can be established if needed in court.

The Fraud Examiners Manual and CFE Prep emphasize:

“Generally, documentary evidence, including digital evidence, will not be admitted in a legal proceeding unless it is established as authentic… Consequently, fraud examiners who collect evidence from social media must capture, download, and preserve any useful information as soon as they discover it, and they must memorialize each step of the collection process”.

Thus, preservation for authenticity is the key.