Investigations Flashcards
What is contained on the signature card of a personal bank account?
To open a personal account, the account must provide a signature card, or similar document, evidencing a contract between the customer and bank.
The card contains the person’s name, address, telephone number, identification number, amount of the opening deposit (and possibly the source of the opening deposit) and security data ( e.g. mother’s maiden name)
No fingerprints
Most cryptocurrencies rely on public blockchains that provide visibility into every transaction that takes place.
True / False
True
Which of the following documents is most likely to be included with the account-opening documents for a corporation’s business account?
Copies of corporate resolutions of the board of directors authorizing the opening of the account
A bank credit department generally maintains which of the following types of basic loan records?
The credit or loan file
Calibrating
observing behavior before asking critical questions
Electronic recording devices can distract subjects and inhibit their responses
True / False
True
Which of the following is the MOST APPROPRIATE type of question for fraud examiners to ask during interviews to confirm facts that are already known?
Leading Questions
In interview situations, _____________ questions consist of a series of interrelated questions and frequently require more than one answer, such as “What are your duties here, and how long have you been employed?”
Complex
Closed questions are worded in a way that makes it difficult for the respondent to answer “yes” or “no.”
True / False
False
To better prepare for the possibility that interview records will be subpoenaed, fraud examiners should document their notes for each interview separately, even when documenting electronic recordings.
True
A(n) ______________ interview is one that has the potential to bring about strong emotional reactions in the respondent.
Volatile
The proper way an interviewer should start the calibration of a witness is through the use of:
Noncritical questions on background information.
Lucas, a Certified Fraud Examiner (CFE), is conducting an admission-seeking interview of William, a fraud suspect. Lucas asks William, “Did you just want extra money, or did you do this because you had financial problems?” This is called a(n):
Alternative Question
In interview situations, admission-seeking questions should be phrased as “Did you do it?” rather than “Why did you do it?”
Why did you do it?
Which of the following is a recommended tactic for interrupting an accused’s denials during an admission-seeking interview?
Reasoning
Delays
Repeated Interruptions
All of the above.
All of the above
You can use all of them
Reasoning, Delays, Repeated Instructions.
An admission-seeking Interview is specifically designed to:
Obtain a legal admission of wrong doing.
Predication
The basis upon which a fraud examination is undertaken.
To preserve the confidentiality of a fraud investigation by ensuring that it is afforded protection under a legal professional privilege, the investigation should be conducted at the direction of, or under the supervision of, a government official.
False
- Generally, to receive protection under a legal professional privilege, an investigation must be conducted at the direction of, or under the supervision of, a legal professional, not a government official.
B. Fraud examinations should begin with general information that is known, starting at the periphery, and then move to the more specific details
True
To properly prepare an organization for a formal fraud investigation, all employees should be notified of the investigation’s existence and purpose.
False
Generally, it is not good practice to alert all of an organization’s employees that an investigation will be taking place, nor should the investigation’s purpose be explained to all employees.
Formal Fraud examination report includes
- copies of important documents
Most evidence in fraud cases will be in document form, and when reporting the results of a fraud examination, it is best to include copies (not originals) of important documents in the formal report or in the attached appendices. Also, when operating under a lawful court order that compels a custodian to furnish original documents, the fraud examiner should copy those documents (preferably in the presence of the custodian). Then the fraud examiner should furnish the custodian with a receipt describing the documents copied or taken.
A fraud examiner is preparing the fraud examination report at the conclusion of a fraud investigation. When including information regarding the interviews conducted during the examination, the fraud examiner should:
Report the details of each witness interview in a separate memorandum.
Which of the following is a recommended method for organizing and presenting information in a fraud examination report?
Chronologically
Which of the following is NOT a purpose of the follow-up/recommendations section of a written fraud examination report?
A. To state necessary remedial measures for the organization to undertake
B. To identify any aspect of the investigation that remains outstanding
C. To make recommendations related to procedures and controls
D. To calculate the amount of loss caused by any misconduct identified during the investigation
D. To calculate the amount of loss caused by any misconduct identified during the investigation
When reporting the results of a fraud examination, the Certified Fraud Examiner (CFE) generally should include their opinion regarding the credibility of the witnesses.
True / False
False
The fraud examiner should be careful not to include any statement of opinion as to the integrity or veracity of any witness, even if the fraud examiner is convinced that the witness is being untruthful. Truthfulness, or lack thereof, can be demonstrated through conflicting statements by the witness or suspect.
Supervised machine learning
humans identify patterns for the programs to look for in data sets, and the programs flag any data that fit the patterns.
Un supervised machine learning
Unsupervised machine learning involves a program identifying similarities, patterns, or anomalies within a data set on its own. The program will not determine what the similarity, pattern, or anomaly means, just that it exists. Unsupervised machine learning programs are most useful in identifying patterns in large data sets that can then be turned into rules for supervised machine learning programs.
Predictive analysis
Predictive analytics uses historical data, along with analyses, statistics, and machine learning components, to build a mathematical model that captures important trends. This model is then used to process current data to create a quantitative prediction about future events or outcomes.
Link Analysis
Link analysis is a type of software used by fraud examiners to create visual representations (e.g., charts with lines showing connections) of data from multiple data sources to track the movement of money; demonstrate complex networks; and discover communications, patterns, trends, and relationships.
Tangible evidence is more volatile than digital evidence because tangible information is subject to claims of spoliation, whereas digital evidence is not.
True / False
FalseDigital evidence is more volatile than tangible information because digital data can be altered or destroyed more easily than tangible
The General Data Protection Regulation (GCPR) only applies to organizations that collect or process personal information if those organizations are based in the EU.
True / False
False
GDPR also applies to organizations that are not based in the EU if they collect or process the personal data of any person located in the EU for the purpose of:
- Offering goods or services to the person, regardless of whether payment is required
- Monitoring the person’s behavior
Which of the following is LEAST LIKELY to be revealed by analyzing a subject’s electronic payment records?
A. The market value of any real property owned
B. The locations of the subject’s residences and businesses
C. Assets the subject has purchased
D. Loans the subject has obtained
You would least likely know about the market value of any real property owned.
Electronic payments (or e-payments) refers to any type of noncash payment that does not involve a paper check. Electronic payment records can reveal, among other things:
Assets the subject has purchased
The locations of the subject’s assets (e.g., through the payment of real estate taxes, broker’s fees, or utility payments)
The locations of the subject’s residences and businesses (e.g., through analyzing the payments of utility bills)
Loans the subject has obtained (e.g., through analyzing loan payments)
Payments made to nonexistent employees with direct deposit
The cities and countries in which the subject conducts business (e.g., through analyzing the payments for carrier services to deliver packages)
Transfers of funds between individuals without an established business relationship
Assets ostensibly owned by family members or close associates but effectively controlled, held, or gifted by the subject
Hotel payments
The true owner of a property (e.g., through analyzing the mortgage payments and payments for homeowner’s insurance)
When a fraud examiner prepares a memorandum reflecting the information furnished by a confidential source, how should the fraud examiner identify the source?
B. The Fraud examiner should use symbols to denote the source’s identity.
In interview situations, an ________ is an orderly, continuous account of an event or incident given by a respondent with minimal or no prompting.
Free narrative.
When searching regulatory securities records for information on a publicly traded company, which of the following information is LEAST LIKELY to be found?
The complete books and records of the company.
Corporate financial statements
Identification of officers and directors
Identification of significant owners (e.g., those with more than 10% of a business’s stock)
A description of the registrant’s properties and businesses
A description of the significant provisions of the security to be offered for sale and its relationship to the registrant’s other capital securities
Identification of events of interest to investors
Identification of accountants and attorneys
A history of the business
The complete books and records of a com
Grigori, a fraud suspect, has confessed to Dmitri, a Certified Fraud Examiner (CFE), that he has embezzled funds. Dmitri is unsure whether Grigori had an accomplice. Which of the following is the most appropriate question concerning accomplices?
Who else knew about this besides you?
By asking who else “knew,” the interviewer is not only asking for the names of possible conspirators, they are also asking about others who might have known what was going on and failed to report it. This question should be worded as “Who else knew?” rather than “Did someone else know?”
Giada, a fraud examiner, is investigating a suspected embezzlement by one of XYZ Corporation’s employees. As part of the investigation, she is assembling a financial profile of the suspect. Among other things, Giada wants to see if the suspect has made any significant real estate purchases since the embezzlement scheme began. Information on real estate transactions such as deeds, grants, transfers, and mortgages is usually located:
With the jurisdiction’s land registry office.
Suppose you need to prove a suspect’s illicit income circumstantially. Which of the following methods of tracing assets would yield the BEST result when the suspect is spending their illicit funds on items that would not cause an increase in net worth, such as travel and entertainment?
The expenditures method.
The expenditures method (also known as the sources and application of funds method) compares the suspect’s known expenditures and known sources of funds during a given period of time. That is, this analysis seeks to quantify the cost of the subject’s lifestyle and determine whether the subject’s reported income is sufficient to support their lifestyle. The expenditures method is best used when the subject spends illicit income on consumables (e.g., travel and entertainment) that would not cause an increase in net worth.
The expenditures method
Compares the suspect’s known expenditures and known sources of funds during a given period of time. That is, this analysis seeks to quantify the cost of the subject’s lifestyle and determine whether the subject’s reported income is sufficient to support their lifestyle.
Best used to trace travel and entertainment.
Prior to conducting an interview, an investigator should prepare a thorough list of questions to ensure that the interview is well structured and that no predetermined lines of inquiry are forgotten.
True / False
False
Whenever possible, do not prepare a list of predetermined questions to ask the subject. The interview should flow freely. The interview might, however, want to develop a list of key points to cover during the interview.
Mario wants to locate Juliette, a fraud suspect. Mario calls Juliette’s parents posing as an old friend and asks for Juliette’s address, which they give him. This act would be considered illegal pretexting in all jurisdictions.
True / False
False
Broadly defined, pretexting is the act of impersonating someone else or making false or misleading statements to obtain, sell, or buy information about a person or organization. Under the broad definition, pretexting for nonfraudulent purposes is not always illegal, but it should be used with caution. For example, if a fraud examiner is trying to find a witness or a suspect, they might call the person’s relative and pretend to be an old friend who is requesting the individual’s phone number. This type of pretexting might be permissible. However, it is more often illegal to use pretexting to obtain certain types of information, such as financial records and phone history records.
Steganography
the process of hiding one piece of information within an apparently innocent file.
For example, a user can use the least significant bits of a bitmap image to hide a message. By hiding the message in the least significant bits of an image, there is almost no perceivable change in the bitmap image itself. And without directly comparing the altered image to the original, it is practically impossible to tell that the image was altered.
The Asset Method
Identifying assets previously acquired, identifying current liabilities, and taking the difference between the two is the process involved in the asset method, not the expenditures method.
Suppose you need to prove a suspect’s illicit income circumstantially. Which of the following methods of tracing assets would yield the best result when the suspect is using his illicit funds to accumulate wealth and acquire assets, thus causing his net worth to increase?
- allows the fraud examiner to prove income circumstantially by showing that the subject’s assets for a given period exceed those that be accounted for from know or admitted sources of income.
A fraud examiner can request a business’s bank records even if the business is not legally obligated to comply.
True
The simplest way to obtain relevant documents, such as bank records is to request them. This usually works for fraud examiners representing large organizations that are important customer to the party with the information.
A fraud examiner in an organized crime investigation believes a particular commercial restaurant is being used as a place of operation for the suspects. Which of the following types of records would be the LEAST LIKELY to help the fraud examiner discover who owns the building in which the restaurant operates?
A. Fire department records
B. Voter registration records
C. Health department records
D. Building permit records
Voter registration records
There are many public records often found at the local level that can help fraud examiners gather various types of information. To determine who owns a particular property, there might be direct information or leads found in the records of several agencies, including health and fire departments. Many local health or fire departments conduct routine inspections of businesses for health and safety code or fire code violations. These inspection records might contain valuable information about the business, its operations, the employees, and the owners.
If a business, or an individual, constructs a new building or makes improvements to an existing building, there should be a building permit on file with the local building authority. In addition, before most businesses can open their doors, local agencies might require that they possess certain permits. In many cases, the person applying for permits will be the owner or someone traceable to the owner.
Voter registration records are not public in all jurisdictions, but if they are available, they might contain useful information. Usually, much of the information contained in such records is withheld from the public for privacy purposes, but voter registration records might contain a person’s date of birth, mailing address, and political affiliation. However, this information is less likely than the other sources listed to identify the owner of a commercial building.
