Fraud Investigation, Evidence Handling, and Reporting
What this domain tests
This domain tests investigation planning, evidence integrity, analytical technique, and the reporting obligations and confidentiality rules that follow a finding.
Core rules and concepts
- Investigation structure: intake and allegation, authority and scope, written plan, legal hold and preservation, evidence collection, interviews, analysis, report, referral.
- Evidence types: documentary, testimonial, electronic. Maintain chain of custody with dates, handlers, and storage; hash electronic files at collection; authenticate documents; the best-evidence rule favors originals; business records may be admissible under the business-records exception; spoliation destroys credibility and can create liability.
- Analysis techniques: timeline construction, link charts, net-worth analysis, source-and-application-of-funds analysis, bank deposit analysis, and beneficiary analysis showing who actually received money.
- Reporting: a Suspicious Activity Report goes to FinCEN, generally within 30 days of initial detection, extendable to 60 days if no suspect is identified; continue review after filing. Federal law prohibits disclosing a SAR to the subject. Also consider HUD OIG, the FBI, state regulators, investor repurchase demands, and GSE fraud reporting.
Worked example
A straw buyer’s account receives six deposits of about $9,500 from unrelated third parties within 30 days, followed by a $57,000 wire to the settlement agent. The SAR narrative should state who, what, when, where, why, and how: identify the account holder, the dates and amounts, the counterparties, the property, the suspected straw-buyer scheme, and the disbursement pattern. It should not include legal conclusions or accusations, and the borrower must not be told a SAR was filed. Internal escalation and document preservation run in parallel.
Traps that cost marks
- Disclosing a SAR or its existence to the subject. This is prohibited.
- Assuming chain of custody matters only for originals; it applies to copies and electronic files too.
- Treating attorney-client privilege as automatic for internal investigation reports; it depends on purpose and structure.
- Confusing a SAR with a police report or a substitute for one.
- Missing the 30-day filing clock and the extension conditions.