CFE-Investigation Certified Fraud Examiner (CFE) - Investigation Questions and Answers

“Due to the risks of illicit transactions, most jurisdictions require financial institutions to obtain information about the ownership and control of the foreign bank with which they maintain correspondent relationships”.

Explanation with Extracts: In interviews, deceptive subjects often stall to gain time to construct plausible responses. The CFE Prep - Investigations notes that deceptive interviewees may ask for questions to be repeated or otherwise delay in order to think of what to say.

Pretexting is defined as impersonating someone else or making false/misleading statements to obtain information. Many jurisdictions specifically prohibit pretexting against financial institutions, which includes pretending to be a customer to access their bank account information.

The manual emphasizes that interviews—especially with subjects in other jurisdictions—pose legal and cultural considerations. Fraud examiners must consider cultural norms (such as personal space, body language, and eye contact) and jurisdiction-specific laws governing the use of information from interviews. In particular, some jurisdictions limit how interview information can later be used. Therefore, the most accurate statement is that the examiner should verify such limitations before proceeding.

The Fraud Examiners Manual notes that predictive modeling and data analysis allow fraud examiners to detect fraud by using historical data to forecast future trends and anomalies. This matches option B.

“Once a denial is uttered, it becomes extremely difficult for the accused to change his response, because doing so would be an admission that he lied. Therefore, the interviewer must prevent an outright denial, thereby making it easier for the subject to confess”.

“One of the most effective techniques to stop or interrupt a denial is through a delaying tactic… the interviewer should attempt to delay the outright denial; he should not argue with the accused”.

Thus, Charles should interrupt with a delaying tactic.

Benford’s Law applies to naturally occurring sets of numbers such as invoice amounts, expense reports, and transaction data. The Fraud Examiners Manual shows Benford’s Law tests applied to vendor payments to detect anomalies like duplicate or inflated invoices. Telephone numbers, employee IDs, and bank account numbers are assigned numbers and do not follow Benford’s distribution, so they are unsuitable for this test.

The organizational filings with the government of the jurisdiction in which the company is incorporated

Organizational filings (e.g., articles of incorporation) are generally public records and include ownership information, initial shareholders, and the location of the principal office.

“Once a suspect utters a denial, it becomes extremely difficult… therefore, the interviewer must prevent an outright denial. Fraud examiners can use several techniques to stop or interrupt denials, including delays, repeated interruptions, and reasoning”.

Thus, the correct answer is D.

The Fraud Examiners Manual explains:

“Before running tests on the data, the fraud examiner must make certain the data being analysed are relevant and reliable for the objective of the engagement… Using the profile of potential frauds as a guide, the fraud examiner must identify the target data for analysis”.

CFE guidance on tracing illicit transactions explains that financial institution records—especially account statements—are among the most important sources for tracing because they can reveal transfers, counterparties, and leads to additional evidence. In the cryptocurrency context, the Manual specifically notes that when reviewing account statements, fraud examiners should look for transactions involving cryptocurrency exchanges and for payments to or deposits from such exchanges. Those banking “on-ramps/off-ramps” can connect a real-world identity (account holder) to crypto activity and help establish ownership or control indicators (e.g., exchange deposits/withdrawals, recurring transfers, related payment records). Option B is incorrect because public blockchains show transactions and addresses, but they generally do not contain direct personal identifiers. Option C is too broad and not supported as a “most accurate” statement across jurisdictions; requirements vary and many exchanges apply identification controls. Option D is incorrect because the Manual states that most cryptocurrencies rely on public blockchains that make transactions visible, not private blockchains. Therefore, A is the most accurate statement: ownership clues can sometimes be derived from bank statements that show exchange-related activity and related financial footprints.

The Manual says admission-seeking interviews should be conducted only when:

There is reasonable probability the subject committed the act,

All other reasonable investigative steps are complete, and

“The interviewer can reasonably control the place, time, and subject matter of the interview.”.Therefore, Erica must ensure control of time, place, and content before scheduling.

The 2014 Fraud Examiners Manual and CFE Prep explain:

“Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.”

Thus, the correct answer is A.

Predictive analytics is defined as:

“the use of historical data combined with statistical, analytical, and machine learning techniques to create models that capture trends and produce forecasts”.

So, option C best describes predictive analytics.

The CFE Prep – Investigations states:

“If a fraud examiner gets a verbal confession from the fraudster, it does not matter whether the fraudster claims his conduct was an accident. The following items of information should be obtained … admission that the accused knew the conduct was wrong, facts known only to the confessor, the accused’s motive, approximate dates, involvement of others, physical evidence, and disposition of illicit income.”

Thus, the examiner does not need a statement about accident.

Textual analytics is used to extract investigative insight from unstructured data—communications and documents that are not stored in standard database fields—such as emails, chats, memos, and other narrative text. CFE investigative guidance explains that textual analysis applies linguistic methods and statistical techniques to identify themes, anomalies, and linkages within large volumes of text. Its purpose is not to determine truthfulness or deception with certainty (Option A), because text analytics cannot reliably “detect lies” in a definitive way. Nor is its primary objective to guarantee discovery of a confession (Option B); admissions can appear, but that is not the defining function of the approach. Option C aligns more with flow-of-funds visualization or link/relationship charting for financial movements rather than analyzing language content. Instead, textual analysis is performed to categorize and structure text so patterns, sentiments, recurring topics, and relationships between people and events become visible—helping examiners prioritize leads, identify risk indicators, and focus investigative testing on communications most indicative of potential fraud.

When a suspect becomes withdrawn or emotional after alibis are diffused:

“The interviewer should not remain silent or discourage the accused from showing emotion. Such reactions often indicate consideration of confession. At this point, the interviewer should present an alternative question and continue reinforcing guilt with evidence”.

Thus, Scarlett should continue presenting evidence.

“Deleted files are recoverable until they are overwritten because data is not erased until it is overwritten… Deleted files that have been overwritten generally are not recoverable”.

Other data such as time/date stamps, websites, or chats can often be retrieved.

The recommended questioning order is:

“As a general rule, questioning should proceed from the general to the specific; that is, it is best to seek general information before seeking details”.

This ensures the respondent provides a free narrative before narrowing down to specifics.

When dealing with potentially hostile or volatile interviewees, fraud examiners are advised not to give much advance notice. This reduces the chance that the subject will prepare evasive or combative responses. The Fraud Examiners Manual emphasizes minimizing preparation time for resistant interviewees to ensure more candid responses.

When preparing for interviews, fraud examiners should avoid scripting detailed questions. Instead, they prepare notes of key points to cover.

From the Fraud Examiners Manual:

“Whenever possible, do not prepare a list of predetermined questions to ask the subject. The interview should flow freely. The interviewer might, however, want to develop a list of key points to cover during the interview”.

Therefore, the best preparation method is to note key points instead of detailed questions.

“Introductory questions should be designed to establish rapport… the interviewer must establish some common ground with the respondent before he begins the fact-gathering portion of the interview. Interviewers usually establish rapport by spending a few minutes with the respondent in an informal dialogue”.

Thus, Vishal’s small talk about ties and sports is rapport-building.

The 2014 Fraud Examiners Manual and CFE Prep list common concealment methods:

“Some common techniques for hiding assets include transferring assets into foreign trusts, overpaying taxes, prepaying on a home mortgage, obtaining a life insurance policy, and transferring assets into someone else’s name.”

Thus, the correct answer is D.

The Fraud Examiners Manual states:

“Records obtained from financial institutions are perhaps the single most important financial source available to a fraud examiner for tracing purposes”.

These records reveal deposits, withdrawals, transfers, and are essential in asset tracing.

Nonpublic records include banking, tax, credit, phone, credit card, and health care records.

Business entity organisational filings (corporate constitutions, articles of incorporation) are generally public records and can be obtained from the government.

Therefore, reviewing a company’s business filings does not require access to nonpublic records.

Textual analytics is described as:

“a method of using software to extract usable information from unstructured text data… to reveal patterns, sentiments, and relationships indicative of fraud… Textual analytics provides the ability to uncover additional warning signs of rogue employee behavior”.

Its purpose is not to find direct admissions but to identify indicators and patterns.

“Metadata information can help determine who wrote a document, who received, opened, copied, edited, moved, or printed the document, and when these events occurred”.

Thus, metadata is the best source for creation date.

The Fraud Examiners Manual makes clear:

“Fraud examiners should never offer opinions regarding guilt or innocence. Reports must be factual, objective, and free from speculation. Statements implying guilt are improper.”

Thus, while it is proper to note contradictions, evidence, or control weaknesses, it is improper to declare the suspect guilty.

The manual and CFE Prep list the main limitations:

Coverage varies by jurisdiction.

Searches are limited in area.

Records are often abstracts.

Information may be inaccurate or outdated.

Searches can be erratic.

Nowhere is “difficulty in finding database companies” mentioned.

CFE interviewing guidance emphasizes that legal considerations can materially affect how interviews are conducted and that employee rights and obligations vary by jurisdiction and by case. In particular, whether a subject has a duty to cooperate (and the extent to which an organization can compel cooperation) can differ across jurisdictions and can also be constrained by contractual rights (e.g., union agreements, employment contracts) and local regulations. Because June’s subject is from a different jurisdiction, the most appropriate preparation step is to verify jurisdiction-specific rules that could limit compulsion or otherwise affect the interview’s legal permissibility and risk profile. Option D directly addresses this core cross-jurisdiction concern: what can legally be required of the subject. Option A is not a CFE-recommended preparatory focus; examiners should adapt to legal and procedural requirements rather than “teach” their own cultural practices to the subject. Option B is inappropriate and contrary to professional interviewing principles (the goal is cooperation, not discomfort). Option C is incorrect because consultation with counsel is not limited to “third jurisdiction” scenarios; the guidance underscores that interview-related legal risks and jurisdictional differences often warrant counsel input. Therefore, D best reflects CFE investigation knowledge for cross-jurisdiction interviewing readiness.

The 2014 International Fraud Examiners Manual states:

“Asset hiders look for certain characteristics in the financial vehicles they use to conceal assets. Asset hiders want products that are liquid (i.e., items that can be purchased and sold in a short period of time). Moreover, asset hiders want products that are difficult to trace or untraceable. With such instruments, asset hiders can break or muddy links between the initial receipt of the assets and their final disposition. Asset hiders also look for products that are secure and accessible.”

The CFE Prep - Investigations guide confirms:

“Asset hiders want products that are liquid, difficult to trace, secure, and accessible… NOT transparent.”

???? Interpretation:

Accessibility = common desirable trait (correct).

Transparency = opposite of concealment (not desirable).

Exclusivity = not a standard consideration.

Traceability = asset hiders want the opposite (difficult to trace).

The Manual and Prep Guide state:

“Before conducting a covert operation, it is essential that the basis for the operation be committed to writing, preferably in a memo. The memorandum should clearly state: the information upon which the covert operation will be based; the information that is expected to be gained from the operation; the identities of suspects, if known; operatives under the fraud examiner’s care, custody, or control. Confidential sources’ identities should not be disclosed.”

Thus, expected information belongs, but confidential source identities must not

The Fraud Examiners Manual explains:

“Each transaction on a blockchain ledger is recorded with a cryptographic address… by analyzing these addresses, fraud examiners can sometimes establish patterns and connections that identify users or link them to criminal activity”.

CFE interview guidance identifies verbal behaviors that often appear when an interviewee is being deceptive. A strong indicator is answering with a question rather than providing a direct denial. When asked directly about misconduct, truthful respondents commonly give a straightforward “no” and may add clarifying facts. Deceptive respondents sometimes deflect, buy time, or attempt to regain control by replying with a question such as, “Why would I do something like that?” This response avoids the substance of the allegation and shifts the burden back to the interviewer, potentially probing how much evidence the interviewer has. While Options A, B, and D are denials (and any denial could be untrue), the CFE materials specifically flag “answering with a question” as a frequent deceptive tactic because it functions as diversion and can indicate discomfort with issuing a clear denial. Therefore, among the choices presented, Option C is most consistent with a deceptive verbal response pattern described in CFE interview methodology.

Body language alone (e.g., avoiding eye contact) cannot be taken as proof of deception. The Manual warns against drawing conclusions from a single behavioral cue:

“Avoiding eye contact is not directly linked to deception. Such behavior could stem from cultural norms, nervousness, or personality traits. Examiners should consider clusters of behavior, context, and corroborating evidence before concluding deception”.

Therefore, C is correct.

The Fraud Examiners Manual states:

“The expenditures method works best when the subject spends illicit income on consumables (e.g., travel and entertainment), because when the subject spends the illicit income, it will not cause an increase in net worth.”

CFE Prep confirms:

“The expenditures method … is best used when the subject spends illicit income on consumables (such as travel and entertainment) that would not cause an increase in net worth.”

Thus, the correct answer is A.

The Fraud Examiners Manual defines:

“Testimonial evidence is that evidence which is presented in the form of witness statements, whether oral or written, offered in response to questions” (Fraud Examiners Manual – Evidence section).The colleague’s statement overhearing a conversation is testimonial evidence.

The Fraud Examiners Manual stresses that interview notes should be kept separately for each interview, even if the session is electronically recorded, because recordings can fail or be challenged. Verbatim transcripts are not expected, and impressions of guilt should never be included. Best practice is to keep clear, accurate, separate records for every interview .

When preparing to interview subjects across jurisdictions, fraud examiners must consider both legal rights and cultural differences. The Manual advises examiners to:

Research local laws governing the right to counsel during interviews.

Understand cultural norms (e.g., greetings, eye contact).Failing to observe these can damage credibility. Thus, it is most accurate that an examiner must determine whether the subject can legally insist on a lawyer’s presence .

The Fraud Examiners Manual explains:

“A Certified Fraud Examiner should not promise confidentiality or leniency to an informant to obtain testimony… the confidentiality relationship runs first to the client or employer”.

Thus, Lisa cannot guarantee full confidentiality but may state she will do her best.

The Fraud Examiners Manual states that admission-seeking interviews should avoid yes/no questions like “Did you steal the money?” because they encourage denials. Instead, the question should be phrased as if guilt has already been established. The Manual explicitly warns:

“The accusation should be made in the form of a statement; it should not be made in the form of a question… Avoid emotive words such as steal, fraud, and crime… Example: ‘It is not so much a question of what you did, but why you did it.’”

Thus, the most effective admission-seeking phrasing is: “Why did you take the money?” because it presumes involvement and encourages explanation rather than denial.

Explanation with Extracts = The Fraud Examiners Manual explains:

“Forensic analysis should not be performed on suspect devices directly because doing so can alter or damage digital evidence, and imaging the data… allows a fraud examiner to view and analyse the contents of a computer without altering the original data in any way”.

Imaging creates an exact, sector-by-sector copy of the drive.

Thus, imaging protects original data integrity.

When a witness resists an interview with “I’m too busy,” CFE interview guidance treats this as a common barrier that may conceal other causes—reluctance, discomfort, ego concerns, or simply a desire to avoid involvement. The recommended approach is to reduce resistance by emphasizing cooperation, importance, and minimal burden: communicate that the witness’s help is needed, the interview will be brief, and it will not be difficult. Option D directly reflects these recommended diffusion techniques by stressing both the importance of the witness’s assistance and the short duration of the meeting, which lowers the perceived cost of participation. Option A is inappropriate and potentially coercive, may exceed the examiner’s authority, and can create hostility or claims of intimidation—undermining credibility and reliability of information obtained. Option C is confrontational and escalates resistance without advancing the interview. Option B can be helpful as a scheduling accommodation, but CFE guidance for this specific resistance phrase prioritizes overcoming the objection by reassuring brevity and importance, making D the best answer among the options.

“Even when a victim refers a fraud case for criminal prosecution, the government will usually not disclose the contents of nonpublic records with the victim during the investigation”.

Thus, option D is most accurate.

“Credit card records… show card purchasing limits, previous payment history, account balance, when and where the subject has travelled, restaurants frequented, and assets acquired. In short, these records show the movements and habits of the person”.

Therefore, B is correct.

Signs of stress (e.g., shallow breathing, stuttering, shifting posture) do not automatically equal deception. The Fraud Examiners Manual states:

“Signs of stress do not always mean a subject is lying. An honest subject might feel stress simply by being questioned. Conclusions must be based on clusters of behavior and corroborating evidence, not a single indicator”.

“Documentary evidence, including digital evidence, will not be admitted… unless it is established as authentic… fraud examiners must capture, download, and preserve any useful information as soon as they discover it, and memorialize each step of the collection process”.

The CFE Prep Guide clarifies:

“A fraud response plan outlines the actions… when suspicions of fraud have arisen. Because every fraud is different, the response plan should not outline how a fraud examination should be conducted. Instead, response plans should help organizations manage their responses and create environments to minimize risk and maximize the potential for success”.

Thus, statement D is false.

From the 2014 International Fraud Examiners Manual, under the section related to tracing financial transactions, specifically tracing the disposition of loan proceeds, the following objectives of tracing activities are explicitly outlined:

“Tracing the disposition of loan proceeds can help fraud examiners:

Determine whether loan proceeds were deposited into hidden or unknown accounts

Determine whether loan proceeds were used to pay off other loans

Identify the involvement of previously unknown individuals (potential witnesses)

Determine whether payments were made from hidden accounts

Identify undisclosed related-party transactions”

There is no mention that tracing loan proceeds can uncover previous civil offenses committed by the subject. Civil offenses refer to non-criminal violations (e.g., breach of contract, torts), which tracing of financial transactions like loan proceeds is not directly designed to uncover.

This is not a recognized purpose of tracing as taught in the CFE Investigation section. The core objectives revolve around uncovering hidden assets, hidden accounts, payments, and potential witnesses — not prior legal infractions.

Therefore, the correct answer is A, as it is the only option that is NOT true according to official CFE investigation materials.

The 2014 International Fraud Examiners Manual states:

“The information contained on a wire transfer generally will include the following items:

• The amount of the transfer

• The date of the transfer

• The name of the sender or originator

• The routing number of the originating bank or financial institution.”

Therefore, the correct answer is C.

When the objective is asset recovery through civil legal action, the practical value of litigation depends heavily on collectability—whether a favorable judgment can be satisfied. CFE guidance on tracing and asset recovery highlights that tracing engagements are commonly undertaken specifically to determine whether a potential defendant can pay a court-ordered sum if judgment is entered, and to locate assets that can be used to satisfy a judgment. If the defendant is judgment-proof or has insufficient reachable assets, the legal action might be economically irrational even if liability is strong. While statute of limitations (D) is legally important, the question asks what is most important before moving forward with a recovery action; from an investigative and recovery perspective, the threshold question is whether there are assets to recover or a realistic path to enforcement. Past arrests (B) do not answer the recovery feasibility question. Option C misframes the decision: legal actions proceed based on evidence and counsel’s assessment, but recoverability often drives whether to invest in litigation. Therefore, assessing whether the defendant has sufficient money or property to satisfy a judgment is the most important preliminary question.