CFE Fraud Schemes Notes: Skimming, Billing Schemes and Cash Theft Explained

CFE fraud schemes notes start with one distinction: did someone take money before recording it, after recording it, or pay it out on a false claim? Skimming steals cash before it enters the books. Cash larceny steals cash after someone records it. Fraudulent disbursement schemes, including billing schemes, payroll fraud, expense reimbursement fraud, check tampering, and register disbursements, trick the employer into paying money no one owed. Noncash theft covers inventory and other assets, with no cash payment. If you can place a scheme on that map, you can answer most exam questions about it, even when a new story dresses up the facts.

First, use this note with a plan, not as a single read. Build your week around it with the free study timetable generator, which turns an exam date and daily study hours into a day-by-day plan with revision and mock slots. Work one scheme family per session, then test yourself with the contrast scenarios below.

Table of Contents

CFE Fraud Schemes Notes: The Map to Learn First

Asset misappropriation is the theft or misuse of an employer’s resources. Cash schemes steal money before or after it is recorded, while fraudulent disbursement schemes trick the employer into paying out money that was never owed. The exam test is: trace whether money was taken in, paid out, or diverted.

That map matters because the ACFE groups asset misappropriation into cash schemes and noncash schemes, and then splits cash schemes into cash receipt schemes and fraudulent disbursement schemes. The ACFE data similarly list cash on hand as a further form, so treat this map as a study aid, not an exhaustive list.

First, scale explains why examiners care about this area. According to the ACFE 2024 Report to the Nations, asset misappropriation appeared in 89% of the 1,921 occupational fraud cases studied, with a median loss of $120,000 for asset misappropriation schemes. Similarly, according to the report, a typical fraud case lasted 12 months before detection. Therefore, those two facts frame the topic: these schemes are common, they run for a long time, and they survive because controls around cash and payments are weak.

Bucket	Money movement	Core question	Examples
Cash receipt schemes	Money coming in is taken	Was the receipt recorded before the theft?	Skimming, cash larceny
Fraudulent disbursement schemes	Money going out is diverted	Was the payment real and authorized?	Billing, payroll, expense, check tampering, register disbursements
Noncash schemes	Assets other than cash are taken	What asset left, and how was it hidden?	Inventory theft, theft of equipment or data

CFE Fraud Schemes Notes: Cash Receipt Schemes

Controls against both cash receipt schemes are simple. First, separate the person who receives cash from the person who records it and the person who reconciles the bank account. Next, use pre-numbered receipts and account for every number. Require daily deposits intact, and let someone with no cash handling duties reconcile the bank account.

Skimming: theft before recording

Skimming is the theft of cash from a victim organization before the cash enters the accounting system. Because no one ever records the transaction, or records it for less than collected, there is no full audit trail in the books. That single feature, off the books, is the definition to hold onto. If someone fully records a sale and then takes the cash, it is cash larceny, not skimming; but someone who records a sale for less than the amount collected still commits skimming, as an understated sale.

The most basic skimming scheme is an unrecorded sale. For example, an employee sells goods or services, collects payment, and makes no record of the sale. A second form is an understated sale: someone records the sale, but for less than the amount collected, and the difference is kept. A third form targets receivables. An employee intercepts a customer check or payment before someone posts it, and then covers the missing credit, often by lapping, which means applying a later customer payment to the earlier customer account so the first account looks current. Lapping is a concealment method, not a separate theft type. The theft is skimming. Lapping is how the thief buys time.

Skimming red flags and detection

Skimming also happens where cash enters through the mail or at a counter. Similarly, an employee opening mail can take a check before it reaches the cash receipts journal. A cashier can pocket cash and skip the register entry. In each case, the control failure is the same: the person who handles the receipt also controls the record, or no independent record exists at all.

Similarly, red flags for skimming include missing receipt numbers, gaps in sequential documents, customer complaints that no one credited their payments, and revenue that falls behind expected levels while activity looks normal. Next, detection comes from outside the books: compare expected receipts with actual deposits, test sequential receipt numbers, and confirm balances directly with customers.

Cash larceny: theft after recording

Cash larceny is the theft of cash after someone records it in the accounting system. The books show the receipt, and then the cash disappears. A classic case is a thief who takes cash from a register after ringing up a sale, or intercepts a deposit on its way to the bank. The paper trail exists, which makes larceny easier to spot than skimming in principle, however, it still runs when no one reconciles the trail to the bank.

However, the exam distinction is clean. Skimming means no record, except for an understated sale. Cash larceny means a fully recorded receipt exists and someone took the cash anyway. Change that one fact and the answer changes with it.

CFE Fraud Schemes Notes: Fraudulent Disbursement Schemes

Fraudulent disbursement schemes cause the victim organization to pay out money for an illegitimate purpose. However, the payment looks authorized on its face. That is what makes this family so costly: the money leaves through the payment system, with a document, approval, or a payroll record behind it. According to the ACFE 2024 Report to the Nations, billing schemes alone appeared in 22% of cases studied, with a median loss of $100,000. Learn billing first, then the other four disbursement families, because billing is the largest disbursement family in the ACFE data cited above.

Billing schemes

A billing scheme causes the employer to issue a payment by submitting or manipulating an invoice. The ACFE recognizes three main forms, and exam questions hinge on which one is present.

In a shell company scheme, the employee creates a fictitious vendor and submits invoices for goods or services no one ever delivered. Then, payments flow to a company the fraudster controls. Similarly, red flags include a vendor with no physical address, a phone number that matches an employee number, and invoices in round amounts.

In a non-accomplice vendor scheme, a real vendor exists, but the employee manipulates its invoices. Someone may overbill the vendor, or the employee may submit the same invoice twice, or claim goods no one ever received. A distinct subcategory is pay-and-return: someone deliberately overpays a legitimate vendor, and the vendor returns the excess to the employee rather than to the employer. In contrast, the vendor is not part of the fraud, which is why the scheme can survive a vendor check.

In a personal purchases scheme, the employee buys personal items with company funds and runs them through accounts payable or a company card, disguised as business expenses. In every billing variant, the control that matters is independent verification that someone other than the person who ordered them and the person who approved payment actually received the goods or services.

Payroll schemes

Payroll schemes cause false payments through the payroll system. A ghost employee is a person who does not work for the organization, fictitious or a real former employee left on the roster, whose paycheck the fraudster collects. Similarly, falsified hours and salary schemes inflate hours worked, the pay rate, or both. Commission schemes falsify the sales that earn commissions or alter the commission rate.

Similarly, red flags include employees with no personnel file, paychecks collected by someone else, and duplicate bank details across employees. Therefore, controls include independent approval of new hires and pay changes, and payroll audits against personnel records.

Expense reimbursement schemes

Expense reimbursement schemes use false claims to get money back from the employer. The ACFE splits them into four forms, and the labels are worth learning. Mischaracterized expenses mean an employee claims a personal expense as a business expense. Overstated expenses mean an employee claims a real business expense at a higher amount than actually spent. Fictitious expenses mean an employee claims an expense that never happened at all. Finally, multiple reimbursement schemes submit the same expense more than once, often to different approvers or in different periods.

First, detection starts with the receipt and the business purpose. Does the receipt support the amount and the date? Are the same amounts appearing in more than one claim? Therefore, an expense claim is a disbursement, and it needs independent approval and supporting evidence as any other payment.

Check tampering

Check tampering schemes manipulate a company check to divert payment. First, forged maker schemes forge the signature of an authorized signer. Forged endorsement schemes forge the endorsement of the intended payee so someone else can cash the check. Altered payee schemes change the payee name on a legitimate check. Concealed check schemes submit a fraudulent check along with legitimate checks to an authorized signer, hoping the signer signs without a proper review. Authorized maker schemes are different: an employee with legitimate check signing authority writes a check for a fraudulent purpose, so the signature is real and the purpose is not.

In contrast, that last form is an exam trap. For example, a forged signature points to forged maker. A real signature on a check written to a shell vendor points to authorized maker, or to a billing scheme if a false invoice drove the payment.

Register disbursements

Register disbursement schemes steal cash from a cash register by recording a false disbursement. False refunds are the main form: an employee records a refund that never happened and pockets the cash. False voids work the same way: an employee voids a legitimate sale after the customer has paid, and keeps the cash. Therefore, the control is independent review of refunds and voids, plus surprise register counts.

CFE Fraud Schemes Notes: Noncash Theft and Concealment

Noncash schemes steal assets other than cash, most often inventory, supplies, or equipment. Someone can hide inventory by falsifying receiving records, shipping records, or inventory counts, or by writing off stolen goods as damaged, obsolete, or scrapped. Similarly, a warehouse employee who controls physical access and the count has the same segregation problem as a cashier who controls both the register and the record.

Concealment methods cut across all scheme families. For example, lapping hides skimming of receivables. Fictitious credits, write-offs, and adjustments hide missing cash or inventory. Altered documents hide check tampering and billing fraud. When a question asks how someone concealed a scheme, answer with the method, not with a repeat of the theft.

Controls for noncash theft mirror cash controls. Restrict physical access, separate custody from record keeping, and count inventory independently and on a surprise basis.

How to Tell Similar Schemes Apart on Exam Day

First, an error in this area is choosing a close label instead of the exact one. Use these pairs as a drill.

Skimming versus cash larceny: unrecorded or understated means skimming, a fully recorded receipt followed by theft means cash larceny.
Skimming receivables versus lapping: skimming is the theft, lapping is the concealment that applies later payments to earlier accounts.
Shell company versus non-accomplice vendor: a fictitious vendor means shell company, a real vendor with manipulated invoices means non-accomplice vendor.
Billing versus check tampering: a false invoice driving payment means billing, a manipulated check driving payment means check tampering.
Forged maker versus authorized maker: a forged signature means forged maker, a real signature used for a fraudulent purpose means authorized maker.
False refund versus false void: a refund that never happened means false refund, a real sale canceled after payment means false void.
Mischaracterized versus overstated versus fictitious expense: wrong category means mischaracterized, inflated amount means overstated, no expense at all means fictitious.

Work each pair with a one-sentence fact pattern, then test yourself against the contrast scenarios below.

Practice scenarios: test the contrasts

Scenario 1: A clerk records a sale for $100, collects $100, and later takes $100 from the register.

Answer: Cash larceny. Someone fully recorded the sale before taking the cash.

Scenario 2: A clerk records a sale for $80, collects $100, and keeps $20.

Answer: Skimming, understated sale. Someone recorded the sale for less than collected.

Scenario 3: An employee slips a fraudulent check in with legitimate checks for a busy signer to sign.

Answer: Concealed check. The signer fell for the trick.

Scenario 4: An employee with signing authority writes a check to a personal account.

Answer: Authorized maker. The signature is real, the purpose is fraudulent.

Scenario 5: An employee claims a personal dinner as a client meeting.

Answer: Expense, mischaracterized. The expense was real, the category was wrong.

Scenario 6: An employee claims a real hotel bill at double the amount paid.

Answer: Expense, overstated. The expense was real, someone inflated the amount.

CFE Fraud Schemes Notes: Detection, Controls, and Revision Checklist

Finally, detection starts with tips. According to the ACFE 2024 Report to the Nations, tips detected 43% of frauds studied, more than three times as many as the next most common method. Analytical review comes next: compare revenue, refunds, voids, vendor payments, and payroll against prior periods, and investigate the outliers.

State the three buckets: cash receipt, fraudulent disbursement, noncash.
Define skimming and cash larceny, and state the one fact that separates them.
Name the three billing forms and one red flag for each.
Name the four expense reimbursement forms without mixing up mischaracterized and overstated.
Name the five check tampering forms, including authorized maker.
Explain lapping as concealment, not as a theft type.
State two controls for cash receipts, two for vendor payments, and two for payroll.

One Page Revision Box: CFE Fraud Schemes Notes

Scheme	Test	Key red flag
Skimming	Cash taken before recording	Missing or gapped receipt numbers
Cash larceny	Cash taken after recording	Deposit short against recorded receipts
Billing, shell company	Payment to a fictitious vendor	Vendor with no address and fast payment
Billing, non-accomplice vendor	Real vendor, manipulated invoice	Duplicate invoices, no receiving record
Payroll, ghost employee	Pay to a non-worker	No personnel file, paycheck collected by another person
Expense, fictitious	Claim for an expense that never happened	No receipt, no business purpose
Check tampering, authorized maker	Real signature, fraudulent purpose	Checks to unusual payees by one signer
Register, false refund	Refund recorded, no customer refund	High refunds by one employee