Investigation

Fraud Examination Reporting Writing

A follow-up/recommendations section is generally an optional part of a written fraud examination report. This section identifies any aspect of the investigation that remains outstanding, usually because it is outside the mandate of the investigator. This could include the recovery of property that is in the possession of third parties or the collection of information held by vendors or suppliers.

UCC Filings

A search of Uniform Commercial Code (UCC) filings can help fraud examiners identify personal property that an individual or business has financed. These filings identify: • Name of the debtor or joint debtors • Current address of the debtors • Name of the financial lender • Type of collateral pledged as security • Date of filing and continuations

Diffusing an Alibi

A useful technique to diffuse an alibi is to discuss the accused's prior deceptions. The goal is to appeal to the accused's logic, not to scold or degrade. This technique is particularly useful in cases with a lack of physical evidence. As with other interview situations, the word lying should be avoided.

Establishing the interview theme

After providing the introduction and establishing rapport, the interviewer must state the interview's purpose in some way prior to the commencement of serious questioning. Otherwise, the respondent might be confused, threatened, or overly cautious. Stating the purpose of the interview is known as establishing the interview theme. The goal of the theme is to get the respondent to make a commitment to assist. Failure to get a commitment to assist from the respondent is one of the common mistakes made by interviewers. Obtaining a commitment to assist is a critical step in setting the tone for the interview. A commitment for assistance requires positive action on the part of the person being interviewed. Remaining silent or simply nodding the head in response to a request for assistance is generally not sufficient.

Tracing Illicit Funds

Although the procedures performed during a tracing investigation vary depending on the circumstances, an actual investigation to trace transactions generally should involve the following elements: • Collect information. • Profile the subject (i.e., assemble the personal—financial and behavioral—profile). • Review information for leads and prioritize leads. • Trace the illicit transactions.

Data Analysis - Planning

As with most tasks, proper planning is essential in a data analysis engagement. Without sufficient time and attention devoted to planning early on, the fraud examiner risks analyzing the data inefficiently, lacking focus or direction for the engagement, running into avoidable technical difficulties, and possibly overlooking key areas for exploration. The first phase of the data analysis process is the planning phase. This phase consists of several important steps, including: • Understanding the data • Defining examination objectives • Building a profile of potential frauds • Determining whether predication exists

Covert Operations

Before conducting a covert operation, it is essential that the basis for the operation be committed to writing, preferably in a memorandum. The memorandum should clearly state: • The information upon which the covert operation will be based • The information that is expected to be gained from the operation • The identities of suspects, if known • Operatives under the fraud examiner's care, custody, or control (confidential sources' identities should not be disclosed, but such sources should be referred to with a symbol) If the fraud examiner decides to pay an informant or source, he should make the payment in cash and obtain a receipt. If the source will not sign a receipt, the fraud examiner should not pay him. There have been numerous instances where a receipt was not obtained and the informant subsequently denied receiving funds or challenged the amount paid. If this happens, the fraud examiner will have to defend himself without proof; indeed, some investigators have been accused of having embezzled the payments. Payments should only be made on a cash-on-delivery-of-information basis.

Closing questions

Closing questions seek to close the interview positively. In routine interviews, closing questions serve the following purposes: reconfirm facts, gather additional facts, and conclude the interview in a manner required to maintain goodwill.

Verbal and nonverbal cues

Conclusions concerning behavior must be tempered by a number of factors. As a general rule, the more intelligent the respondent, the more reliable verbal and nonverbal clues will be. A higher level of intelligence breeds more consistency in responses from which deviations are more clearly recognizable. People of lower intelligence tend to be more erratic in their behavior, and thus meaningful deviations are more difficult to discern.

Cloud digital

Conducting digital forensic investigations in the cloud environment (i.e., cloud forensics) presents challenges not faced in traditional forensic practices. Some of the important challenges of acquiring evidence from the cloud are: • Lack of frameworks and specialist tools • Lack of information accessibility • Lack of data control • Jurisdiction of storage • Electronic discovery • Preserving chain of custody • Resource sharing • Lack of knowledge

Credit Card Records for Asset Tracing

Credit card records are important in tracing assets because they reveal a great deal of personal and business information about the account holder. Among other things, information on credit card charges might provide leads to identifying hidden assets. For example, if a fraud examiner notices that the subject used his credit card to purchase items at a marina, the fraud examiner should investigate further to determine if the subject owns a boat. The credit card application and the monthly statements that the bank sends to the cardholder are the records that are most valuable to fraud examiners. Credit card applications require an applicant to disclose financial information, and they generally require the same type of information found on a bank loan application. In today's environment, credit cards might be tied to bank accounts and might not require a separate application. Credit card statements also contain a great deal of important information. Generally, these statements contain the name of the credit card issuer, the cardholder's account number, a summary of the transactions on the account, payment information, and a list of all the transactions that occurred during that month's billing cycle (i.e., purchases, payments, credits, cash advances, and balance transfers). Credit card records can document out-of-town travel, and, often, the records will name people or entities with whom the subject conducts business.

Data mining

Data mining is the science of searching large volumes of data for patterns. It combines several different techniques essential to detecting fraud, including the streamlining of raw data into understandable patterns. Data mining can also help prevent fraud. Additionally, it is an effective way for fraud examiners to develop fraud targets for further investigation.

Double-negative questions

Double-negative questions are questions that have two forms of negation within a single clause. Double-negative questions, or statements containing double negatives, are confusing and often suggest an answer opposite to the correct one. Therefore, they should not be used. For example: "Didn't you suspect that something wasn't right?"

Electronic Payments

Electronic payments (or e-payments) refers to any type of noncash payment that does not involve a paper check. Electronic payment records can reveal, among other things: • Assets the subject has purchased • The locations of the subject's assets (e.g., through the payment of real estate taxes, broker's fees, or utility payments) • The locations of the subject's residences and businesses (e.g., through analyzing the payments of utility bills) • Loans the subject has obtained (e.g., through analyzing loan payments) • Payments made to nonexistent employees with direct deposit • The cities and countries in which the subject conducts business (e.g., through analyzing the payments for carrier services to deliver packages) • Transfers of funds between individuals without an established business relationship • Assets ostensibly owned by family members or close associates but effectively controlled, held, or gifted by the subject • Hotel payments • The true owner of a property (e.g., through analyzing the mortgage payments and payments for home owner insurance)

Encryption

Encryption refers to procedures used to convert information using an algorithm (called a cipher) that makes the information unreadable.

Event Logs

Every operating system generates event logs,or files that record events or transactions on a computer. In fact, a log entry is created for each event or transaction that takes place on any computer, and consequently, there are numerous types of event logs. Some common types of logs include system logs, application logs, and security logs. System logs record events executed on an operating system, including miscellaneous events and those generated during system startup, like hardware and controller failures. Common types of system events include starting up and shutting down, configuration updates, and system crashes. Application logs record the events regarding access to application data. Such events would include data files being opened or closed; specific actions such as reading, editing, deleting, or printing of application files; or the modification of records in an application file. Security logs track security-related events like logon and logoff times and changes to access rights.

Forensic Accounting

Forensic accounting is the use of professional accounting skills in matters involving potential or actual civil or criminal litigation. The word forensic is defined by Black's Law Dictionary as "used in or suitable to courts of law or public debate." Therefore, forensic accounting is actually litigation support involving accounting. Accordingly, many fraud examinations can be considered forensic accounting, but not all forensic accounting is fraud examination. For example, an individual hired to appraise property in a minority shareholder derivative suit would engage in forensic accounting even if the engagement does not involve fraud.

Credit bureau header searches

Fraud examiners can use credit header data to locate individuals. A credit header is the information in a credit report that gives basic information about the person to whom the credit report applies, and it includes identifying information such as name, name variations, current and former addresses, telephone number, date of birth, and Social Security number. Nearly all individuals have been involved in some credit activity, either under their true names or an assumed ("also known as") name, and if there are no credit records for an individual, it might be because he is very young or very old. The credit bureau headers offer two search mechanisms. First, the fraud examiner can discover a current address, an address history, and Social Security number(s) associated with the target by using a past address up to seven years old. Second, once the fraud examiner has the subject's Social Security number, he can search the credit bureau headers for matches because the Social Security number is a national identity number. Although Social Security numbers are protected from disclosure, they sometimes end up disclosed on public records. Of the searches listed, the only one that typically contains a Social Security number is the credit bureau header search. Although credit headers typically contain Social Security numbers, the fraud examiner should consult the laws and regulations of his jurisdiction to make sure that obtaining Social Security numbers is allowed in that jurisdiction and for his purpose.

Developing fingerprints

Fraud examiners should never try to develop latent fingerprints that have been absorbed into paper or other porous materials by dusting with fingerprint powder or any other means. Such efforts will not only be unsuccessful, but they will prevent additional examinations. Instead, fraud examiners should preserve evidentiary documents that contain latent fingerprints by placing them into labeled protective containers, such as sealable, acid-free paper envelopes. Also, fraud examiners should label the item's container with their initials, the current date, where the document was obtained, and an identifying exhibit number (if any). Experts use various methods to examine fingerprints on porous surfaces, including iodine fuming and brushing or spraying silver nitrate solution or ninhydrin spray, which reacts with the body chemicals and other substances in the latent prints that have soaked into the absorbent surface. Some of these methods will permanently discolor a document.

Indented Writing

Fraud examiners should never try to develop latent fingerprints that have been absorbed into paper or other porous materials by dusting with fingerprint powder or any other means. Such efforts will not only be unsuccessful, but they will prevent additional examinations. Instead, fraud examiners should preserve evidentiary documents that contain latent fingerprints by placing them into labeled protective containers, such as sealable, acid-free paper envelopes. Also, fraud examiners should label the item's container with their initials, the current date, where the document was obtained, and an identifying exhibit number (if any). Experts use various methods to examine fingerprints on porous surfaces, including iodine fuming and brushing or spraying silver nitrate solution or ninhydrin spray, which reacts with the body chemicals and other substances in the latent prints that have soaked into the absorbent surface. Some of these methods will permanently discolor a document.

Letter rogatory

Government officials may be authorized to make a formal government-to-government request for assistance, or letter rogatory, to obtain foreign evidence. Letters rogatory are formal requests that a court in one country makes to seek judicial assistance from a court in another country. Letters rogatory also permit formal communication between the judiciary, a prosecutor, or a law enforcement official of one country and their counterpart in another country. The most common types of assistance sought by letters rogatory are service of process and taking of evidence.

Tracing the disposition of loan proceeds

If a fraud examination involves a loan with proceeds that have been disposed, the fraud examiner should trace the disposition of the loan's proceeds. A fraud examiner can trace loan proceeds to determine if hidden accounts were used for loan payments or if the proceeds were deposited into hidden accounts. Also, because loans might be secured by hidden assets or co-signed by previously unknown cohorts, tracing loan proceeds can uncover hidden assets or unknown witnesses. Moreover, if the subject has taken out a loan for someone else, tracing the disposition of the loan proceeds will uncover those leads.

Fraud Investigation Confidentiality

In a 2015 decision by the U.S. National Labor Relations Board (NLRB), the entity that enforces the National Labor Relations Act (NLRA), the NLRB ruled that an employer's routine policy or practice of asking employees not to discuss matters that are under investigation violates the NLRA, even where the employer did not threaten to take disciplinary action if employees breach confidentiality. Based on the NLRB's 2015 decision, U.S. employers should not have a blanket policy prohibiting employees from discussing employee investigations. Instead, when conducting an investigation into employee misconduct, U.S. employers must assess whether there is a need for confidentiality on a case-by-case basis.

Verbal confession

In an admission-seeking interview, the interviewer should transition to the verbal confession when the accused provides the first detailed information about the offense. There are three general approaches to obtaining the verbal confession: chronologically, by transaction, or by event. The approach taken should be governed by the circumstances of the case. Once a verbal confession is obtained, the interviewer must probe gently for additional details—preferably details that only the subject knows.

Inferential Confusion

Inferential confusion denotes confusion and inaccuracies resulting from errors of inference. These errors generally fall into two categories: induction or deduction. Induction occurs when the respondent is asked to convert concrete experiences into a higher level of generalization. Deduction occurs when the respondent is asked to give concrete examples of certain categories of experience.

Interview Theory and Application

Interviewers are encouraged to formulate their questions in a way that will not bring about a strong emotional reaction from the respondent, and emotive words of all types should be avoided during the introductory phase. Such words put people on the defensive, making them more reluctant to answer and cooperate. Words such as investigation and audit should be avoided. It is better to use words with a softer meaning, such as inquiry or examination.

Organization in Complex Cases

Keeping track of the amount of paper generated is one of the biggest problems in fraud cases. Effective organization in complex cases includes the following: • Segregating documents by either witness or transaction • Making a key document file for easy access to the most relevant documents • Establishing a database early in the investigation During the evidence-gathering stage of an investigation, organizing the documents chronologically is not recommended because it makes searching for relevant information more difficult. It is generally better to organize the documents by transaction or by party. The fraud examination report often follows a chronological timeline to give a narrative of a fraud scheme, in which case displaying key documents chronologically often makes sense. But in the organization phase, there usually is too much clutter for chronological organization to be effective.

Link analysis

Link analysis software is used by fraud examiners to create visual representations (e.g., charts with lines showing connections) of data from multiple data sources to track the movement of money; demonstrate complex networks; and discover communications, patterns, trends, and relationships. Link analysis is very effective for identifying indirect relationships and relationships with several degrees of separation. For this reason, link analysis is particularly useful when conducting a money laundering investigation, since it can track the placement, layering, and integration of money as it moves around unexpected sources. It could also be used to detect a fictitious vendor (shell company) scheme. For instance, the investigator could map visual connections between a variety of entities that share an address and bank account number to reveal a fictitious vendor created to embezzle funds from a company.

Link-network diagrams

Link-network diagrams show the relationships between people, organizations, and events. In these diagrams, different symbols are used to represent different entities: a square can symbolize an organization; a circle, a person; a triangle, an event; and so forth. It does not matter which symbols are used as long as they are used consistently. In link-network diagrams, confirmed connections between entities can be represented by a solid line or enclosure within another symbol. Speculative or presumed relationships can be indicated by broken lines. To achieve its intended purpose, a graphic should always be clear. Therefore, these diagrams should not contain lines that are crossed, if possible.

Entrapment

Many jurisdictions recognize the legal defense of entrapment. Entrapment occurs when law enforcement officers or government agents induce a person to commit a crime that he is not previously disposed to commit. Entrapment also poses a legal problem in covert operations, particularly in undercover operations, because the defendant might not be found liable if it appears that he was improperly induced to commit the crime. Therefore, it is imperative that adequate predication exists before the operation is commenced. The law enforcement officer or government agent must act based on more than mere suspicion. For example, if the officer received a reliable tip that a suspect committed fraud, then that could serve as adequate predication. Covert operations must not be used for aimless searches for information performed without notions of what might be uncovered.

Metadata

Metadata is a type of computer-generated data that can be helpful in a fraud investigation. Metadata is data about data, and these files contain a tremendous amount of information. Metadata information can help determine who wrote a document; who received, opened, copied, edited, moved, or printed the document; and when these events occurred.

Multi-file processing

Multi-file processing allows the user to relate several files by defining relationships between multiple files, without the use of the Join command. A common data relationship would be to relate an outstanding invoice master file to an accounts receivable file based on the customer number. The relationship can be further extended to include an invoice detail file based on invoice number. This relationship will allow the user to see which customers have outstanding invoices sorted by date.

Mutual Legal Assistance (MLA)

Mutual legal assistance (MLA) is a process by which countries request and provide assistance in law enforcement matters, such as gathering information, obtaining provisional remedies, and enforcing foreign orders and judgments. To obtain assistance from a foreign government, the government seeking assistance makes an MLA request. An MLA request is a written request to the government of a foreign country that is used to obtain assistance in law enforcement matters. Generally, MLA can be used to obtain assistance in matters such as conducting searches, gathering evidence, compelling sworn testimony and the production of documents, issuing search warrants, issuing subpoenas, serving process, exchanging affidavits, obtaining provisional remedies, and providing assistance in forfeiture proceedings.

Non-public records

Nonpublic records—financial or otherwise—might be needed to prove fraud or to provide leads in a fraud examination. Nonpublic records include information about a person or business considered to be private and confidential. Nonpublic records are not available to everyone, and because fraud examiners do not have an absolute right to see these personal records, obtaining access might be difficult or impossible. Some of the most valuable types of personal records include: • Banking records • Tax records • Credit records of individuals • Phone records • Credit card account records • Personal health care records A wronged organization may make a criminal referral so that records can be subpoenaed by the government or obtained by a legal order (e.g., a search warrant). Records obtained while executing a search warrant or similar legal order usually are available only to the government during the underlying investigation, and perhaps thereafter if they are not disclosed at trial. In addition, law enforcement agencies may also subpoena records, but, depending on the jurisdiction, might not disclose the contents of such records with the victim or third parties. There are several ways to obtain nonpublic information. An organization may demand that a supplier, vendor, or agent turn over relevant documents as a condition of continued business. Taking this action is legal, in appropriate circumstances. Of course, management and counsel should be consulted before such demands are made, particularly if the other party has a contractual relationship with the demanding organization. An audit clause allows parties to a contract the right to access another party's books. Often, audit clauses are too narrow to provide useful information. However, if properly constructed, an audit clause can be a powerful method by which on-book information can be obtained.

Admission Seeking Interviews

Once the accused utters a denial in an admission-seeking interview, it becomes extremely difficult for him to change his response because doing so would be an admission that he lied. Therefore, the interviewer must prevent an outright denial, thereby making it easier for the subject to confess at a later time. An innocent person is unlikely to allow the interviewer to prevail in stopping the denial. Fraud examiners can use several techniques to stop or interrupt denials, including delays, repeated interruptions, and reasoning. When conducting an admission-seeking interview, note-taking should be kept to a minimum. In some cases, taking notes should be avoided. Because the admission-seeking interview's ultimate goal is to obtain a signed statement of guilt, it is not necessary to take extensive notes. Such notes can distract the suspect and reveal what points the fraud examiner believes to be important; thus, if the fraud examiner determines that note-taking is necessary, he should do so in a way that does not reveal the information's significance. When accused of wrongdoing, the typical guilty person reacts with silence. If the accused does deny culpability, those denials are usually weak. In some cases, the accused almost mumbles the denial. It is common for culpable individuals to avoid outright denials. Rather, they give reasons why they could not have committed the act in question. Conversely, innocent people sometimes react with genuine shock at being accused. It is not at all unusual for an innocent person who is wrongfully accused to react with anger. In contrast to the guilty person, the typical innocent person will strongly deny committing the act or acts in question. The signed statement should include the confessor's moral excuse, but the fraud examiner should ensure that the wording of the excuse clause does not diminish legal responsibility. Instead of using language like "I didn't mean to do it," which implies lack of intent, the interviewer should focus on an excuse that provides only a moral explanation for the misconduct.

Interviewing Subjects

One of the basic rules of interviewing is to question only one person at a time. When two subjects are questioned simultaneously, the testimony of one respondent invariably influences the testimony of another. There are few absolute rules of interviewing, but this is one of them. Another basic rule is to conduct interviews under conditions of privacy. The interview is best conducted out of the sight and sound of friends, relatives, or fellow employees, as people are very reluctant to furnish information if others might be able to hear the conversation. Ideally, an interview should take place in an environment that can be controlled by the interviewer.

Real Property Records

Real property records are extremely important, and in many jurisdictions, they are relatively easy to access and contain a vast amount of information. It is common for real property records to be found at the local level of government, but some jurisdictions might keep them at a centralized location. In the United States, records of real property transactions are usually maintained at the county level, but, depending on the state, the records might be at the state level. When an individual purchases real estate, he becomes a registrant in real property records, property tax records, and tax assessor records (if applicable). Most jurisdictions have a land registry office that maintains various information on real property and its owner(s). Both the level of government where these records are found and the information they contain will vary by jurisdiction, but the following information is often present: • Documents pertaining to real estate transactions—including deeds, grants, transfers and mortgages of real estate, releases of mortgages, powers of attorney, and leases that have been acknowledged or approved • Mortgages on real property • Security interests or liens on property • Wills admitted to probate • Official bonds • Notices of mechanic's liens • Transcripts of judgments that are made liens on real estate • Notices of attachment on real estate • Land cadastre (a registry of land surveys that specifically detail each plot of real estate in an area and may contain information about value, ownership rights, and other details) • Papers in connection with bankruptcy • Certified copies of decrees and judgments of courts of record • Other documents permitted by law to be recorded • Historical sale prices • Residences and addresses of the buyer and seller • Identity of the party financing the property, if applicable • Improvements to a property The increased awareness of identity theft has led to most jurisdictions taking measures to prevent the publication of a person's government identification number in public real estate records.

Records of secured transactions

Records of secured transactions in which the debtor(s) owes a stated value to a secured party or parties can provide valuable information. They can help identify personal property that an individual or business has financed. These records typically include the debtor's name and address, the name and address of the secured party, the filing date, the filing number, the filing type, and the type of collateral pledged as security. Moreover, these records might include documents such as tax liens, notices of secured interest in personal property, bank notes and drafts (including funds transfers between banks), letters of credit, and securities exchanges.

Fraud Examination Reporting Documents

Reporting formats vary widely. Some organizations, especially governmental investigative bodies, use report forms so that case information is provided in a consistent manner. The basic reporting documents are: • Memoranda • Cover page • Exhibits, documents, or enclosures • Forms • Indexes • Transmittal letter

Matrix

Reporting the results of fraud examinations is often facilitated through the use of visual aids. A matrix is a type of visual aid, in the form of a grid, that shows the relationship (or points of contacts) between a number of entities.

U.S. Corporations

Some U.S. states, but not all, require that foreign corporations (corporations which were incorporated in another state) be registered with the state corporation office if the foreign corporations transact business in that state. For example, if a corporation that was chartered in Delaware wishes to transact business in Texas, it must file an Application for Registration of a Foreign For-Profit Corporation.

Steganography

Steganography is the process of hiding one piece of information within an apparently innocent file. For example, a user can use the least significant bits of a bitmap image to hide a message. By hiding the message in the least significant bits of an image, there is almost no perceivable change in the bitmap image itself. And without directly comparing the altered image to the original, it is practically impossible to tell that the image was altered. Some common methods of detecting the use of steganography are: • Visual detection by looking for visual anomalies in jpeg, bmp, gif, and other image files • Audible detection by looking for audible anomalies in wav, mp3, mpeg, and other media files • Statistical detection by determining whether the statistical properties of files deviate from the expected norm • Structural detection by looking for structural oddities that suggest manipulation (e.g., size differences, date differences, time differences, or content modification)

Textual Analysis

Textual analytics is a method of using software to extract usable information from unstructured text data. Through the application of linguistic technologies and statistical techniques—including weighted fraud indicators (e.g., fraud keywords) and scoring algorithms—textual analytics software can categorize data to reveal patterns, sentiments, and relationships indicative of fraud. For example, an analysis of email communications might help fraud examiners to gauge the pressures/incentives, opportunities, and rationalizations to commit fraud that exist in an organization. Textual analytics provides the ability to uncover additional warning signs of potentially fraudulent employee behavior. Depending on the type of fraud risk present in a fraud examiner's investigation, he will want to come up with a list of fraud keywords that are likely to point to suspicious activity. This list will depend on the industry, fraud schemes, and the data set the fraud examiner has available. In other words, if he is running a search through journal entry details, he will likely search for different fraud keywords than if he were running a search of emails. Additionally, it can be helpful to consider the three factors identified in the Fraud Triangle when coming up with a keyword list.

National Futures Association

The National Futures Association (NFA) is an industry-wide, self-regulatory organization authorized by the U.S. Commodity Exchange Act; it operates under the supervision of the Commodity Futures Trading Commission (CFTC). The NFA oversees the commodities markets, and it is a one-stop information source for all types of registration and disciplinary information regarding firms and individuals in the futures industry. This information includes registration status and employment history; disciplinary actions filed by the NFA, the CFTC, and the commodity exchanges; and customer complaints filed under the CFTC's Reparations Program.

U.S. Fair Credit Reporting Act

The U.S. Fair Credit Reporting Act (FCRA) generally requires a party to obtain the consent of an individual before accessing that person's consumer or credit report. However, there are some exceptions to this rule. The Fair Credit Reporting Act (FCRA) governs, among other things, the circumstances under which employers may request consumer credit reports and consumer investigative reports on prospective or active employees. The Fair and Accurate Credit Transactions Act of 2003 amended the FCRA to exempt certain reports involving employee misconduct investigations. As a result of these amendments, an employer who uses a third party to conduct a workplace investigation no longer has to obtain the prior consent of an employee if the investigation involves suspected misconduct, violation of laws or regulations, or violation of any preexisting policy of the employer. To qualify for this exception, the report from the third party must not be communicated to anyone other than the employer, an agent of the employer, or the government. It is also important to note that this exception is for internal investigations, and it will not justify access to an external party's credit report without consent simply because that party is being investigated for fraud. In this case, Bianca may not access the suspect's credit report because the individual works for a separate company. One of the primary U.S. statutes limiting access to information is the federal Fair Credit Reporting Act (FCRA). This statute regulates the dissemination of consumer information to third parties by consumer reporting agencies. Historically, the FCRA only applied to consumer credit reports, but, due to amendments in 1997, the FCRA now applies to the gathering of many types of information about an individual that is collected through third parties.

U.S. Right to Financial Privacy Act

The U.S. Right to Financial Privacy Act prohibits financial institutions from disclosing financial information about individual customers to governmental agencies without the customers' consent, a court order, a subpoena, a search warrant, or other formal demand. There are, however, limited exceptions to this rule. Although the Act applies only to demands by governmental agencies, most banks and other financial institutions also will not release such information to private parties absent legal process, such as a subpoena issued in a civil lawsuit. The Act does not, however, make it a crime for them to do so.

Asset Method

The asset method, the expenditures method, and the bank deposits method can all be used to establish a subject's sources of income using circumstantial proof. The asset method allows the fraud examiner to prove income circumstantially by showing that the subject's assets for a given period exceed those that can be accounted for from known or admitted sources of income. Fraud examiners should use the asset method when it is suspected that the subject has accumulated wealth and acquired assets with illicit proceeds, which causes the subject's net worth—the difference between a person's assets and liabilities at a particular point in time—to increase.

Bank Deposits Method

The bank deposits method of tracing illicit funds is recommended as a primary method of proof when most of the subject's income is deposited and the subject's books and records are unavailable, withheld, incomplete, or maintained on a cash basis.

Deep Web

The deep Web (also known as the invisible Web) refers to Web content that is not indexed by standard search engines. There are a number of reasons why the deep Web exists. For instance, there are websites where Web crawlers (search engine robots or spiders) cannot enter. Web crawlers are scripts that create copies of visited Web pages that are indexed by a search engine to provide faster searches. These deep Web resources include websites without any links pointing to them, certain file formats that search engines cannot handle, websites that have been blocked from Web crawler access, password-protected websites, and information stored in databases. Also, search engines limit the depth of their crawl on a website. Moreover, Web crawlers cannot crawl as quickly as pages are added or updated. Alternatively, the term Internet archives refers to archived versions of Web pages that have since been updated or are no longer available online. The most popular tool for searching the Internet archives is the Wayback Machine, located at https://archive.org. The Wayback Machine allows users to see archived versions of Web pages throughout time. Fraud examiners can use the Wayback Machine to find historical information, such as: • A photo posted on a website that has been removed • Content, views, writing, and opinions rescinded by an author • A company's old job ads, statements, affiliations, or product lines

Expenditures Method

The expenditures method (also known as the sources and application of funds method) compares the suspect's known expenditures and known sources of funds during a given period of time. That is, this analysis seeks to quantify the cost of the subject's lifestyle and determine whether the subject's reported income is sufficient to support his lifestyle. The expenditures method is best used when the subject spends illicit income on consumables (e.g., travel and entertainment) that would not cause an increase in net worth.

Data Analysis on Asset Accounts

The following are examples of data analysis queries that can be performed by data analysis software on asset accounts to help detect fraud: • Generate depreciation to cost reports. • Compare book and tax depreciation and indicate variances. • Sort asset values by asset type or monetary amount. • Select samples for asset existence verification. • Recalculate expense and reserve/provision amounts using replacement costs.

Data Analysis on Payroll Accounts

The following are examples of data analysis queries that can be performed by data analysis software on payroll accounts to help detect fraud: • Summarize payroll activity by specific criteria for review. • Identify changes to payroll or employee files. • Compare timecard and payroll rates for possible discrepancies. • Prepare check amount reports for amounts over a certain limit. • Check proper supervisory authorization on payroll disbursements.

AP Data Analysis

The following are typical examples of data analysis queries that can be performed by data analysis software on accounts payable: • Audit paid invoices for manual comparison with actual invoices. • Summarize large invoices by amount, vendor, etc. • Identify debits to expense accounts outside of set default accounts. • Reconcile check registers to disbursements by vendor invoice. • Verify vendor tax forms (e.g., U.S. Form 1099 or Value Added Tax (VAT) forms). • Create vendor detail and summary analysis reports. • Review recurring monthly expenses and compare to posted/paid invoices. • Generate a report on specified vouchers for manual audit or investigation.

Data Analysis on General Ledger

The following are typical examples of data analysis queries that can be performed by data analysis software on the general ledger: • Select specific journal entries for analysis. • Create actual-to-budget comparison reports. • Analyze and confirm specific ledger accounts for legitimate transaction activity. • Speed account reconciliation through specialized account queries. • Calculate financial ratios. • Calculate percentage comparison ratio between accounts. • Prepare custom reports, cash flow, profit/loss, and asset and liability total reports. • Compare summaries by major account in any order (low-high, high-low). • Create reports in any format by account, division, department, etc.

Public Records

The following items are basic types of public records that can commonly be accessed at the local level of government: • Building inspector records • Building permit records • Health and fire department records • Birth and death records • Public school records • Coroner's register • Voter registration records • Utility records • Marriage records Public records are documents that a governmental agency is required to keep by law or that are necessary to discharge the duties imposed by law. Public records, which can generally be accessed by the public and are thus available to anyone who wishes to use them, can be helpful to fraud examiners for a number of reasons. They can supply invaluable background information on entities, employees, suspects, and witnesses. They can also be used to corroborate or refute witness statements, help investigators track the flow of stolen money or other assets, and aid efforts to recover losses. Individual tax records and consumer credit records are typically nonpublic information. In most jurisdictions, many of the papers filed in civil suits are accessible as public records; however, criminal and juvenile actions might not be as open to review. In addition, criminal conviction records are generally available to the public.

Free Narrative

The free narrative is an orderly, continuous account of an event or incident, given with minimal or no prompting. It is used to get a quick synopsis of what is known about a matter. But when seeking to obtain a free narrative, be sure to designate specifically the occurrence that you wish to discuss. Sometimes the respondent must be controlled to prevent unnecessary digression. Otherwise, avoid interrupting the respondent, and do not stop the narrative without good reason. The respondent will sometimes provide valuable clues when talking about things that are only partially related to the matter under inquiry.

Net-Worth Method

The net-worth method (or comparative net-worth analysis) is used to prove illicit income circumstantially by showing that a person's assets or expenditures for a given period exceed that which can be accounted for from known or admitted legitimate sources of income. Fraud examiners should use the net-worth method when several of the subject's assets or liabilities have changed during the period under examination and when the target's financial records are not available.

Data Analysis - Preparation

The second phase of the data analysis process is the preparation phase. The results of a data analysis test will only be as good as the data used for the analysis. Thus, before running tests on the data, the fraud examiner must make certain the data being analyzed are relevant and reliable for the objective of the engagement. During the preparation phase of the data analysis process, the fraud examiner must complete several important steps, including: • Identifying the relevant data • Obtaining the requested data • Verifying the data • Cleansing and normalizing the data

Altruism

There seems to be a need for humans to identify with some higher value or cause beyond immediate self-interest. This might take the form of identification with the objectives of some larger group. Altruistic deeds usually increase self-esteem whether or not the deeds have been made public. This distinguishes altruism from publicity. Altruism is of major importance in motivating many respondents. Interviewers who understand the respondent's value system can use strategies and techniques that appeal to altruism.

Bankruptcy Court Records

U.S. bankruptcy proceedings are conducted in federal bankruptcy courts. In these courts, all documents filed with the court are public record and can be examined by anyone without charge. These on-site federal court records might include the case number, debtor's name(s), Social Security number, address, filing date, chapter designation, and closure date. The search is available for all federal jurisdictions, usually covering a seven-year span that starts from the present and moves backward. Bankruptcy documents are usually located in the federal bankruptcy court for the district where the debtor resided or had his principal place of business. A bankruptcy file typically contains a number of files, including the bankruptcy petition.

Correlation analysis

Using the correlation analysis function, fraud examiners can determine the relationships among different variables in the raw data. Fraud examiners can learn a lot about data files by learning the relationship between two variables. For example, we should expect a strong correlation between the following independent and dependent variables because a direct relationship exists between the two variables. Hotel costs should increase as the number of days traveled increases. Gallons of paint used should increase as the number of houses painted increases.

Fraud Theory Approach

When conducting fraud examinations, fraud examiners should adhere to the fraud theory approach. The fraud theory approach is an investigative tool designed to help fraud examiners organize and direct examinations based on the information available at the time. According to the fraud theory approach, when conducting investigations into allegations or signs of fraud, the fraud examiner should: • Analyze the available data. • Create a hypothesis. • Test the hypothesis. • Refine and amend the hypothesis.

Conducting a Fraud Examination

When responding to a sign or allegation of fraud, those responsible must work to avoid alerting those suspected of fraud. The following are some basic measures that organizations and fraud examiners can take to avoid notifying suspected perpetrators who are under investigation: • Know who is being investigated and what they can access. • Limit the extent of any discussions. • Inform only those who need to know. • Inform employees of the consequences of a confidentiality breach. • Work discreetly without disrupting the office's normal course of business so that employees do not know that an investigation is being performed. • Work fast. • Investigate during nonbusiness hours.

Seizing a running computer

When seizing a computer that is running, the party seizing the system should not, in most situations, search the computer for evidence because doing so might damage and taint relevant evidence. But in some situations, it might be appropriate to perform live evidence collection (i.e., collect evidence from a suspect system while the system is open and running via its normal interface). Generally, live evidence collection is appropriate when a formally trained computer investigator is seizing the system, and the evidence that the investigator needs to collect exists only in the form of volatile data.

Interview Note Taking

When taking notes during an interview, fraud examiners should follow a few basic rules. First, they should take accurate, but not necessarily verbatim, notes during the interview. Taking too many notes will make the interview process cumbersome, and it might inhibit the respondent. Fraud examiners should also avoid slowing down the interview process for note-taking. Instead, they should write down key words or phrases and then go back over the details at the end of the interview. In general, it is better to err on the side of taking too few notes rather than too many. These notes should be expounded upon as soon as possible following the interview to ensure accuracy. Finally, fraud examiners should avoid making notes regarding their overall opinions or impressions of the subject. Such notes can cause credibility problems if they are later produced in court.