Fraud Prevention and Detection
Fraud Schemes and the Fraud Triangle
Fraud questions reward familiarity with typologies. Know the difference between internal fraud (employee embezzlement, payroll and expense manipulation, collusion with vendors) and external fraud (identity theft, account takeover, card-not-present fraud, check fraud, phishing and social engineering, authorized push payment scams). Understand the fraud triangle - pressure/incentive, opportunity, and rationalization - and the fraud diamond, which adds capability. Detection controls include segregation of duties, dual authorization, reconciliation, exception reporting, and behavioral analytics.
Detection Signals and Traps
Red flags include unusual transaction timing, round-dollar amounts, vendor addresses matching employee addresses, sudden lifestyle changes, dormant accounts reactivating, and beneficiaries that change immediately after contact detail changes. A major trap is confusing detection with prevention: a control that stops a transaction (e.g., call-back verification on new payee instructions) is preventive, while post-event review is detective. Another trap: assuming authorization equals legitimacy - an authorized transaction can still be fraudulent (e.g., authorized push payment scams, insider-approved payments).
Also distinguish first-party fraud (the customer fabricates a loss or disputes a legitimate charge) from third-party fraud (an outside actor impersonates the customer). Investigators should preserve evidence and follow escalation and reporting paths rather than confronting suspects informally.
Rule of thumb: For any scenario, name the scheme, the red flag, the control type (preventive/detective), and the response - most exam distractors fail on one of these four.
Worked example: A clerk creates a fictitious vendor with a post-office box, approves invoices below the dual-signature threshold, and pays them. Scheme = fictitious vendor/internal fraud; red flags = sub-threshold amounts, PO box address, single approver; control gap = no segregation between vendor setup and payment approval; fix = independent vendor master-file review.