CFE Study Guide — 2026 Edition

Fraudulent disbursements steal money through the books: the payment is recorded, but the payee, amount, or purpose is a lie. This is the largest asset-misappropriation family, and at 15 questions (13% of Section 1) it deserves the most study time in Part I.

Billing schemes

An employee causes the company to pay a false invoice — the classic shell-vendor scheme:

• Shell companies. The perpetrator creates a fictitious vendor, submits invoices for goods or services never delivered, and approves the payment.
• Non-accomplice vendors. Real vendors are overbilled through pass-through or pay-and-return schemes, with the excess kicked back.
• Personal purchases. The employee buys personal items on company accounts.

Red flags: vendors with P.O.-box addresses, sequential invoice numbers, no phone listing, invoices just below approval thresholds, and a single employee who controls vendor setup, approval, and payment.

Check tampering

The perpetrator steals or alters a company check: forged maker (signing someone else's name), forged endorsement (signing the payee's name to cash it), altered payee (changing who the check is payable to), or authorized maker (a signatory writing checks for personal benefit). Concealment runs through the bank reconciliation — the reconciler intercepts the statement or forces the balance.

Payroll schemes

• Ghost employees. A fictitious (or terminated) person stays on the payroll; the perpetrator collects the check or direct deposit.
• Falsified hours or wages. Inflated timecards, overstated pay rates, commission fraud.
• False workers' compensation claims.

Detection: payroll headcount vs. HR records, no deductions or withholdings anomalies, duplicate bank accounts or addresses across employees, and checks never cashed by the "employee."

Expense reimbursement schemes

Mischaracterized expenses (personal costs claimed as business), overstated expenses (altered receipts), fictitious expenses (wholly invented claims), and multiple reimbursements (the same receipt submitted twice). Prevention: original receipts, supervisory approval by someone who knows the traveler's itinerary, and data analysis for duplicates and round-dollar patterns.

Register disbursements

At the cash register: false refunds (a refund is rung for a "customer" and the cash pocketed) and false voids (a sale is voided after the customer pays). Controls: managerial approval of refunds and voids, review of refund logs, and surveillance at the register.

Why this domain is weighted so heavily

These schemes are the everyday work of fraud examiners — small, repeatable, and committed by trusted insiders. The exam tests scheme identification from fact patterns, the red flags of each, and the control that would have prevented it.

Key numbers

Figure	Value	Source
Exam weight of this domain	13% of Section 1 (15 of its 120 questions) — the most questions of any domain	[1]
Core billing red flag	Invoices for fictitious goods or services, such as a shell company billing for services not rendered	[2]

Key takeaways

• Billing = false invoices from shell or manipulated vendors; watch vendor-setup controls.
• Check tampering has four forms: forged maker, forged endorsement, altered payee, authorized maker.
• Ghost employees are detected by comparing payroll to HR records and hunting duplicate payment details.
• Expense fraud splits into mischaracterized, overstated, fictitious, and multiple-reimbursement claims.
• Register fraud = false refunds and false voids; both need managerial approval and log review.

Chapter 4 quiz — 12 questions

Answer each question, then check the key that follows.

1. An employee creates a fictitious vendor, submits invoices for services never performed, and approves the payments. Which scheme is this?

• A. Check tampering with forged endorsements
• B. A payroll scheme using ghost employees
• C. Billing scheme using a shell company
• D. An expense reimbursement fraud scheme

2. Which check-tampering method involves signing the payee's name to negotiate the check?

• A. Forged maker
• B. Altered payee
• C. Authorized maker
• D. Forged endorsement

3. A payroll clerk keeps a terminated employee on the payroll and diverts the direct deposits. This is best described as which scheme?

• A. Falsified hours
• B. Commission fraud
• C. A workers' compensation scheme
• D. A ghost-employee scheme

4. Which control most directly prevents an employee from both creating a vendor and approving its invoices?

• A. Surprise cash counts by supervisors
• B. Separating vendor setup from payment approval
• C. Mandatory password change policies
• D. Independent review of bank reconciliations

5. Submitting the same hotel receipt for reimbursement twice is an example of which expense scheme?

• A. Mischaracterized expenses
• B. Multiple reimbursements
• C. Overstated expenses
• D. Fictitious vendors

6. A cashier rings a $200 refund with no customer present and pockets the cash. Which scheme is this?

• A. False void
• B. Skimming
• C. False refund
• D. Check kiting

7. Which red flag most strongly suggests a shell-company billing scheme?

• A. A P.O.-box vendor with sequential invoices from one approver
• B. A vendor offering a two-percent early-payment discount
• C. Invoices consistently paid exactly on their due dates
• D. A vendor with a listed phone number and website

8. In an authorized-maker check scheme, who commits the fraud?

• A. An outsider who steals blank checks
• B. A customer who alters the payee line
• C. An authorized signer misusing that authority
• D. A bank teller who forges endorsements

9. Which analytical test best detects ghost employees?

• A. Confirming receivable balances with customers
• B. Reviewing utility bills for duplicate vendor payments
• C. Testing journal entries for round-dollar amounts
• D. Reconciling payroll headcount with HR records

10. A manager claims a family vacation as a client-development trip. Which expense scheme is this?

• A. Overstated expenses
• B. Mischaracterized expenses
• C. Fictitious expenses
• D. Multiple reimbursements

11. Concealment of check tampering most often runs through which record?

• A. The bank reconciliation
• B. The sales journal
• C. The inventory count sheets
• D. The payroll register

12. Which register control addresses both false refunds and false voids?

• A. Manager approval and review of refund/void logs
• B. Daily cash-drawer counts by the cashier alone
• C. Longer customer receipt tapes
• D. Rotating cashiers across registers weekly

Answer key & explanations

1. C. A billing scheme causes the employer to pay invoices for fictitious goods or services — the classic example is an employee creating a shell company to bill for services never rendered. Check tampering is the tempting label because a payment results, but here the company issues a legitimate payment on a false invoice; nothing is forged or altered.^[2]

2. D. Signing the payee's name on the back to cash the check is a forged endorsement. Forged maker is the tempting confusion: that means forging the signature of the company's authorized signer on the front of the check.^[3]

3. D. A payroll scheme includes adding ghost employees to the payroll; a terminated employee kept on the payroll while someone diverts the pay is a ghost. Falsified hours is the tempting alternative, but that inflates pay for a real, working employee.^[4]

4. B. Separating vendor setup from payment approval means no one person controls the whole disbursement cycle; the CAQ guide gives separating approval and payment as a preventive control. Independent review of bank reconciliations is the tempting choice, but it detects problems after payments clear — it does not prevent one person from creating and paying a fake vendor.^[5]

5. B. Claiming the same receipt twice is a multiple-reimbursement scheme. Overstated expenses is the tempting label, but that inflates the amount of one claim; here each claim is for the true amount, it is simply paid twice.^[6]

6. C. A refund rung with no customer present is a false entry that conceals the removal of cash — a false refund, one of the register disbursement schemes. Skimming is the tempting label, but skimming takes cash before a sale is recorded; here the cash was recorded and a false refund is used to take it out.^[7]

7. A. A shell vendor usually has a mail-drop address, invoices numbered in sequence because it bills only one customer, and a single insider approving its bills. An early-payment discount is the tempting distractor, but it is ordinary commercial practice and a shell has no reason to offer one.^[2]

8. C. In an authorized-maker scheme, the employee with legitimate signing authority writes company checks for personal benefit. An outsider stealing blank checks is the tempting distractor, but that is forged-maker check tampering — the signature is forged because the thief lacks authority.^[3]

9. D. A ghost is someone on the payroll with no real employment relationship, so reconciling payroll to HR's personnel records exposes names with no personnel file. Testing journal entries for round dollars is the tempting distractor, but payroll disbursements run through the payroll system, and the ghost's pay looks like any other net pay.^[4]

10. B. The trip happened and was paid, but it is claimed for a false business purpose — a mischaracterized expense. Fictitious expenses is the tempting label, but that means claiming a cost that was never incurred at all.^[6]

11. A. A tampered check still clears the bank, so the discrepancy surfaces when the bank statement is reconciled; perpetrators conceal it by controlling or forcing the reconciliation. The CAQ guide describes reconciling the cash account to the bank statement as a detective control. The payroll register is the tempting alternative, but check tampering is not routed through payroll.^{[3, 5]}

12. A. False refunds and false voids are both false register entries, so requiring a manager's approval and independently reviewing the refund/void log addresses both. Daily drawer counts by the cashier alone are the tempting choice, but a false refund or void makes the drawer balance to the register, and a cashier counting their own drawer is not independent.^[7]

Sources cited in this excerpt

1. ACFE CFE Exam Content Outline (Last updated May 2026). http://cms.acfe.com/-/media/files/acfe/pdfs/cfe-exam/cfe-exam-content-outline_2026.pdf
2. Occupational Fraud 2024: A Report to the Nations — Glossary: billing scheme. https://www.acfe.com/-/media/files/acfe/pdfs/report-to-the-nations/2024-report-to-the-nations.pdf
3. Occupational Fraud 2024: A Report to the Nations — Glossary: check or payment tampering scheme. https://www.acfe.com/-/media/files/acfe/pdfs/report-to-the-nations/2024-report-to-the-nations.pdf
4. Occupational Fraud 2024: A Report to the Nations — Glossary: payroll scheme. https://www.acfe.com/-/media/files/acfe/pdfs/report-to-the-nations/2024-report-to-the-nations.pdf
5. Center for Audit Quality — Guide to Internal Control Over Financial Reporting. https://www.thecaq.org/wp-content/uploads/2019/03/caq_icfr_042513.pdf
6. Occupational Fraud 2024: A Report to the Nations — Glossary: expense reimbursements scheme. https://www.acfe.com/-/media/files/acfe/pdfs/report-to-the-nations/2024-report-to-the-nations.pdf
7. Occupational Fraud 2024: A Report to the Nations — Glossary: register disbursements scheme. https://www.acfe.com/-/media/files/acfe/pdfs/report-to-the-nations/2024-report-to-the-nations.pdf