CFCI case studies
CFCI · Put your knowledge to work in context.
The Certified Financial Crimes Investigator (CFCI) is one of three professional certifications listed by the International Association of Financial Crimes Investigators (IAFCI), alongside the CCCI and the ICIC. The IAFCI describes its certifications as designed "to recognize knowledge and expertise in financial crimes, cybercrimes, and digital forensics." That single sentence is the public description of the program, so candidates should treat the CFCI as a credential built around three knowledge areas: financial crime schemes, cybercrime, and digital forensics. The CFCI case studies are 5 cases and about 3,980 words.
1Under-Invoiced Ceramics and a Delaware Round-Trip
Meridian Home Goods, a mid-sized U.S. importer, has moved 4.3 million across 14 shipments from a Vietnamese supplier over nine months.
803 words, about 4 min2Lookalike Domain and a Friday Afternoon Wire
on a Friday, an accounts payable clerk at a 600-employee logistics firm received an email that appeared to come from the CFO, asking her to urgently update wire instructions for a long-standing supplier ahead of a contract deadline. The thread included what looked like prior correspondence.
810 words, about 4 min3Signal Timer Running on a Seized iPhone
On a Thursday morning a task force executes a search warrant at an apartment tied to a suspected money-mule network. Officers seize an unlocked iPhone 13 running iOS 17, a powered-on Windows 11 laptop with BitLocker enabled and a VPN client connected, and a locked Samsung Galaxy S22.
821 words, about 4 min4Twenty-Three Accounts, One Apartment Complex
A 1.1 billion regional credit union that files roughly 40 SARs a year gets an automated monitoring alert on 23 newly opened consumer accounts with near-identical profiles: opened within a 12-day window at two branches, holders aged 19-24, all listing the same apartment complex, all enrolling in mobile deposit within 48 hours. Over six weeks the accounts received 1,147 deposits totaling 1.92 million, overwhelmingly in the 9,600- 9,850 range, each followed within 24-72 hours by an outgoing Zelle or ACH transfer to 11 distinct accounts at three other institutions.
793 words, about 4 min5Ransomware, an Unproven Backup, and a Friday Deadline
A 220-bed community hospital's EHR is encrypted on a Tuesday morning. The ransom note demands 40 BTC, about $1.1 million at the time, and threatens to publish 84 GB of patient records including 12,000 oncology files.
753 words, about 4 min