ANALYSING DOCUMENTS

Question 1

From the moment evidence is received, its chain of custody must be maintained for it to be
accepted by the court. This means__________

Answer 1

that a record must be made when the item is received or when it leaves the care, custody, or control of the fraud examiner. This is best handled by a memorandum of interview with the custodian of the records when the evidence is received.

Question 2

The memorandum of interview with the custodian should state:

Answer 2

• What items were received
• When they were received
• From whom they were received
• Where they are maintained

Question 3

If both parties agree, it is possible to obtain evidence by __________

Answer 3

consent

Question 4

If the evidence is owned by and in the control of the party that requests the investigation

Answer 4

then the investigator is usually able to obtain the

documents as required.

Question 5

If evidence is held by other parties or in uncontrolled locations

Answer 5

specific legal action is required before attempting to obtain it. This usually takes the form of a subpoena or other order from the court to produce the documents and records (including electronic records).

Question 6

Evidence is generally either_______

Answer 6

direct or circumstantial

Question 7

Direct evidence

Answer 7

shows prima facie the facts at issue; it proves the fact directly.

Question 8

Circumstantial evidence is

Answer 8

that which indirectly shows culpability

Question 9

Good organisation of evidence in complex cases includes the following:

Answer 9

• Segregating documents by either witness or transaction.
• Making a key document file for easy access to the most relevant documents
• Establish a database early if there is a large amount of information to process

Question 10

A chronology of events. The purpose is

Answer 10

to establish the chain of events leading to the proof.

Question 11

if the fraud examiner suspects that significant documents are phony

Answer 11

he should consider consulting with an expert

Question 12

Expert forensic examinations conducted as a part of a fraud investigation can contribute to its success in several ways:

Answer 12

• Expert examination results can assist in developing and proving the fraud theory: who
did what and when they did it.
• Expert examination results can corroborate or refute statements by witnesses or fraud
suspects.
• Having the results of expert examinations before interviews can provide significant leverage for the examiner during his interviews with fraud suspects, even resulting in admissions of guilt from suspects who are confronted with the factual evidence.
• Forensic handwriting examinations and comparisons can result in the positive identification of the writer or signer of a document. Since writing is a conscious act, the dentification might serve to prove that a particular act is intentional or wilful. Proof of intent is usually necessary to prosecute a wrongdoer successfully.

Question 13

most examinations (more than 95 percent of all U.S. Federal Bureau of Investigation Laboratory 
document examinations, for example) concern

Answer 13

signatures, handwriting, hand printing, or

documents created by a typewriter or word processor

Question 14

the following forensic examinations could be of particular value when a fraud involves documents:

Answer 14

• Detection of forged signatures
• Identification of the writers of signatures, handwriting, and hand printing
• Detecting altered documents
• Detecting and restoring erasures and eradications
• Determining when a document was or was not prepared
• Detecting counterfeited documents and examining printed documents
• Detecting and restoring faint indented writings
• Comparisons of paper and inks
• Determining whether two sheets of paper came from the same tablet or pad of paper
• Examinations of paper folds and sequence of folds
• Comparisons of torn or cut paper edges
• Restoration of charred and partially burned documents
• Identifying the machine that made a photocopy and whether two copies were made on
the same machine
• Examinations of facsimile (fax) copies
• Identifying the source of, or alterations to, notary seals, wax seals, and cachets
• Detecting the opening and resealing of sealed documents and examining adhesives
• Detecting inserted text in typewritten, printed, or handwritten documents
• Determining the sequence of handwritten text, signatures, and typewriting
• Identifying rubber stamp impressions
• Identifying mechanical cheque-writer and numbering device impressions

Question 15

The examiner should never ______ on the original document other than ______

Answer 15

write or make markings - his unobtrusive initials for identification.

Question 16

Photocopies and laser-printed documents

should always be stored in

Answer 16

paper folders or envelopes

Question 17

Recognising Phoney Documents. Signature forgeries

Answer 17

might be recognised by irregularities noticeable in the written letters and/or by their differences in size from a genuine signature. A side-by-side comparison with a genuine signature might reveal the differences

Question 18

Recognising Phoney Documents.Substituted pages in multiple-page documents

Answer 18

by holding each page in front of a bright light. Differences in the whiteness, density, thickness, opacity, and paper-fibre patterns of the substituted sheets might be apparent

Question 19

Recognising Phoney Documents.Some ink differences, alterations, erasures, and obliterations

Answer 19

by holding the paper in front of a bright light or holding a light over the writings at different angles and observing differences in the colour and reflectivity of the inks or disturbances to the
paper surface.

Question 20

Recognising Phoney Documents.Counterfeited printed documents,

Answer 20

disclosed by side-by-side comparisons with corresponding genuine documents. Be alert for the use of incorrect or different versions or form revisions of the documents. For forensic examinations it will be necessary to obtain and furnish genuine comparison samples of the printed documents to the document examiner.

Question 21

Recognising Phoney Documents.Suspicious indented writings

Answer 21

might be revealed by reducing the light in the room and holding a bright beam of light (a narrow-beam flashlight or small high-intensity lamp will do the
job) low and parallel to the page surface.

Question 22

If fraud examiners find two signatures that are exactly alike, then ___

Answer 22

at least one is a forgery,

probably a tracing.

Question 23

Most attempts at disguise involve one or more of the following:

Answer 23

change in slant, change in size, change in shapes of capital (upper-case) letters, changes in the shapes and sizes of loops in letters that contain them, use of bizarre letter designs, or block (squared) hand printing. Only rarely is the opposite, non-writing hand used.

Question 24

Fraud examiners should be aware that it is _____

to successfully disguise writings to the point that they _______ . This is especially true when ____

Answer 24

possible
cannot be positively identified, even by experts
only limited amounts of writings are involved.

Question 25

Disguise is

Answer 25

he conscious intentional effort by a person to change or conceal his normal writings

Question 26

Distortions are

Answer 26

unintentional changes to a person’s writings that are beyond his range of natural variation.

Question 27

A forgery is defined as

Answer 27

any writing prepared with the intent to deceive or defraud. Most
forgeries are signatures

Question 28

A simulated or traced forgery is

Answer 28

a writing, usually a signature, prepared by carefully copying or tracing a model example of another person’s writings

Question 29

A freehand forgery occurs when

Answer 29

a writer signs the name of another person without knowing what the real person’s signature looks like. The writers of freehand forgeries can usually be
identified by experts.

Question 30

AUTOFORGERIES

Answer 30

The true-name signature of a person, prepared by him in a distorted or disguised fashion in
order to later deny it and disclaim it as genuine.

Question 31

A forensic document examiner cannot determine with accuracy

Answer 31

the writer’s age, sex, race, which hand was used, physical or mental condition, personality, or character from handwriting examinations

Question 32

There are three basic outcomes of forensic handwriting comparisons.

Answer 32

Non-Identification
The suspected person did not write the signature or other writings on the questioned document.

Identification
The suspected person did write the signature or other writings on the questioned document.

Inconclusive
No definite determinations were possible as to whether the suspected person did or did not
write the signature or other writings on the questioned document.

Question 33

Undictated writing samples should:

Answer 33

• Be as contemporaneous as possible to the date of the evidence documents;
• Consist of the same signature or words containing many of the same letters and
combinations of letters as the questioned writings on the evidence documents.
• Consist of the same type of writings as on the evidence documents, such as hand printed
or handwritten, capital letters or small letters or a combination of both.
• Consist, if possible, of the same kinds of writings.

Question 34

When obtaining a legal order for samples, the investigator and/or attorney should ensure
that the order specifies

Answer 34

that the samples should be provided in the writer’s normal handwriting and in sufficient quantity, text, and form, at the interviewer’s discretion, to
permit a determination of identity or non-identity. A court order with these specifications
will permit an inference of guilt, or might allow pursuit of contempt of court charges if the
suspect refuses to comply or attempts to prevent identification by intentionally disguising his
writings, limiting the amount of writings, or failing to follow the interviewer’s instructions
and dictations.

Question 35

Dictated writing samples should be obtained by using

Answer 35

the same types of materials as the evidence document: writing instrument (ball-point pen, fountain pen, pencil, etc.), paper (lined, unlined, size of sheet), and forms (cheque forms, business forms, etc.)

Question 36

Photocopies can be the actual original evidence in the case of:

Answer 36

• Anonymous letters
• Unauthorised “leaks” of information in the form of copies of letters, memoranda, files, and other records
• Copies made to conceal forgeries or to insert or manipulate text
• Spurious “disinformation” dissemination of phoney official documents

Question 37

Permanent “Trash Marks”

Answer 37

are usually caused by accidental deep
scratches and imperfections in the copier’s glass surface or document cover, in the printing
element surface, or other permanent machine parts that are not readily replaced or changed
during servicing of the machine

Question 38

Transient “Trash Marks”

Answer 38

usually caused by dirt, smudges, or small

bits of foreign matter on or in machine surfaces that will appear only until the machine is cleaned or serviced.

Question 39

Some indented writings can be visualised by

Answer 39

taking the document to an area with subdued
overhead lighting, placing the document on a flat surface, and shining a bright beam of light
from a small-beam flashlight or small high-intensity lamp across the paper surface at a low
oblique angle or parallel to the surface. Since shadows in the indentations will only show at
right angles to the beam of light, it will be necessary to move the light around in several
positions and note the changing shadows as they form the text of the indentations.

Question 40

Fraud examiners should ___ try to develop latent fingerprints that have been absorbed into
paper or other porous materials by dusting with fingerprint powder or any other means.

Answer 40

never