Cash Larceny Schemes
5 minutes
5 Questions
Cash larceny is the intentional taking of an employer's cash (currency or checks) after it has been recorded in the organization's books. This distinguishes it from skimming, where cash is stolen before it is recorded ('off-book' fraud). Because the money has already entered the accounting system, cash larceny is an 'on-book' scheme, making it generally easier to detect since the theft creates an imbalance between recorded receipts and actual cash on hand. The ACFE identifies several common forms. Larceny at the point of sale occurs when an employee simply removes cash from a register or cash drawer; the register tape will show more sales than the cash counted, so perpetrators may try to conceal the shortage by altering tapes, destroying records, or recording false voids or refunds. Larceny from the deposit happens when an employee responsible for preparing or transporting the bank deposit removes cash before it reaches the bank; concealment methods include altering the deposit slip, lapping (using later receipts to cover earlier thefts), or claiming a deposit was 'in transit.' Larceny of receivables involves stealing incoming customer payments that have already been posted, then covering the gap through false discounts, write-offs, or by posting entries to suspense or other customer accounts. Perpetrators also exploit weak controls over petty cash, unattended registers, and shared cash drawers that obscure individual accountability. From a CFE perspective, detection focuses on reconciling register tapes to cash counts, comparing validated bank deposit slips to the receipts journal, investigating unusual shortages, reviewing journal entries to cash and receivables, and analyzing patterns of voids, refunds, and write-offs by employee. Prevention relies on segregation of duties (separating receipt, recording, deposit, and reconciliation functions), assigning individual access to cash drawers, requiring independent deposit verification, performing surprise cash counts, mandatory vacations, job rotation, and physical safeguards such as surveillance and secured storage.
Cash Larceny Schemes (ACFE CFE – Asset Misappropriation: Cash Receipts)
1. Why Cash Larceny Matters for the CFE Exam
Cash larceny sits within the Fraud Tree under Asset Misappropriation → Cash → Theft of Cash Receipts. Together with skimming, it is one of the two basic ways an employee steals incoming cash. The ACFE tests this topic heavily in the Financial Transactions and Fraud Schemes section because it forces you to understand the central distinction that underpins the entire cash receipts branch of the Fraud Tree: has the cash been recorded on the books or not? Mastering cash larceny also prepares you for questions about concealment techniques (reversing entries, force balancing, deposit lapping), detection methods (cash counts, deposit reconciliations, analytical review) and internal controls (segregation of duties, independent reconciliations). According to the ACFE Report to the Nations, cash larceny is less frequent than skimming or billing fraud, but it is a favorite exam topic because its concealment mechanics are so distinctive.
2. What Cash Larceny Is
The ACFE defines cash larceny as the intentional taking of an employer's cash (currency and checks) without the consent and against the will of the employer, AFTER the cash has been recorded in the victim organization's accounting system.
Three elements to memorize:
• Intentional taking – it is theft, not an accounting error.
• Cash – includes both currency and checks received by the organization.
• After recording – the receipt has already appeared on a register tape, cash receipts journal, receivables ledger or deposit record.
The last element is what makes cash larceny an on-book scheme. Because the money has been recorded, its disappearance leaves an imbalance somewhere: the cash on hand will not match the register tape, the deposit will not match the receipts journal, or the bank statement will not match the books. This is exactly why cash larceny is considered harder to conceal than skimming, and why so many larceny schemes involve manipulating records after the fact.
Cash Larceny vs. Skimming – the Core Contrast
• Skimming: cash stolen before it is recorded (off-book). No audit trail exists; the organization may never know the sale or payment occurred.
• Cash larceny: cash stolen after it is recorded (on-book). An audit trail exists; the theft shows up as a shortage unless the records are altered.
If an exam question says a sale was rung up, a receipt was issued, a payment was posted to a customer's account, or cash was placed in a deposit bag, and then the money vanished – that is cash larceny, not skimming.
3. Where Cash Larceny Occurs
Cash larceny can happen at any point where recorded cash is accessible, but the ACFE organizes the schemes into three main locations:
A. Larceny at the Point of Sale
The most common form. An employee with access to a cash register or cash drawer simply removes currency. Because the register tape records every sale, the drawer will be short at the end of the shift. Methods and variations include:
• Taking from one's own register – the employee removes cash and hopes the shortage is attributed to error or is too small to investigate (the death by a thousand cuts approach of many small thefts).
• Theft from other employees' registers – shifting blame to colleagues, especially where multiple employees share one drawer.
• Reversing transactions – processing false voids or false refunds so that the register tape balances to the reduced cash count.
• Altering cash counts or register tapes – changing the figures on the reconciliation sheet or physically destroying or altering the tape so no discrepancy appears.
• Substituting personal checks – the thief takes currency and leaves a personal check (often never cashed or postdated) to make the drawer appear balanced.
• Stealing from the register after close – removing cash from the safe or deposit bag after the day's reconciliation is done.
B. Larceny of Incoming Receivables
Here the employee steals a customer payment that has already been posted to the customer's account. Because the account shows as paid, the customer will not complain, but the cash receipts journal and the deposit will not reconcile. Concealment techniques:
• Force balancing – the perpetrator, who both handles cash and keeps the books, simply changes the ledger totals so the records appear to balance even though they do not. The receivables ledger may be made to agree with a deposit that is short.
• Reversing entries – posting fictitious credits (discounts, write-offs, returns and allowances, bad debt) to the receivables account to make the customer balance zero out while the cash is missing.
• Destroying records – shredding or losing the cash receipts journal, remittance advices or deposit records so that no reconciliation can be performed.
C. Larceny from the Deposit (Cash in Transit)
The period between preparing the deposit and the bank receiving it is highly vulnerable. Whoever carries the deposit to the bank (often the same person who prepared it) has an opportunity to remove funds. Methods include:
• Stealing part of the deposit and altering the deposit slip and the office copy so both reflect the lower amount, then altering the cash receipts journal to agree.
• Deposit lapping – stealing from today's deposit and covering the shortage with cash from the next day's deposit, then covering that from the following day, and so on. Similar in mechanics to receivables lapping but performed on deposits rather than customer accounts.
• Deposits in transit – the thief steals the deposit and records it as 'in transit' on the bank reconciliation. Legitimate deposits in transit clear within a day or two; fraudulent ones linger for weeks or are quietly written off.
• Stealing the entire deposit and claiming it was lost, misplaced or stolen by a third party.
• Carbon copy / bank receipt manipulation – altering the bank-validated deposit receipt or substituting a receipt from a different, smaller deposit.
4. How the Scheme Works – A Typical Pattern
Step 1: Cash or checks are received and recorded (rung into the register, posted to receivables, or listed on the deposit slip).
Step 2: The employee with custody removes some or all of the cash.
Step 3: A discrepancy is created between the recorded amount and the physical cash.
Step 4: The employee conceals the discrepancy by (a) hoping it is overlooked, (b) altering records (tapes, counts, slips, ledgers), (c) posting reversing or fictitious entries, (d) destroying documents, or (e) lapping.
Step 5: The scheme continues until the imbalance becomes too large to hide, an independent reconciliation is performed, or a surprise count catches the shortage.
The enabling condition in almost every case is lack of segregation of duties: the same person has custody of cash and the ability to record or reconcile it.
5. Red Flags of Cash Larceny
• Unexplained or frequent cash shortages or overages at a particular register or employee.
• Register tapes that are missing, altered, torn or out of sequence.
• Unusually high numbers of voids, refunds or no-sale transactions for one employee.
• Personal checks in the drawer or deposit.
• Deposits that do not agree with the cash receipts journal or with the bank statement.
• Deposits in transit that persist beyond a few days or are written off.
• Increases in receivables write-offs, discounts or allowances without supporting documentation.
• Customers' accounts showing payments that never reached the bank.
• Employees who refuse vacations, insist on making the deposit personally, or always reconcile their own work.
6. Detection Techniques
• Surprise cash counts compared to register tapes and receipts journals.
• Three-way deposit reconciliation: compare the cash receipts journal, the deposit slip (and bank-validated copy) and the bank statement; investigate every difference.
• Review of voids and refunds by employee, register and time of day, looking for patterns.
• Analytical review: compare receipts to sales, deposits to receipts, and month-over-month cash ratios; a rising gap between recorded receipts and bank deposits suggests larceny.
• Journal entry review: examine credits to receivables not supported by cash, particularly write-offs, discounts and adjustments posted by cash handlers.
• Aging of deposits in transit on bank reconciliations.
• Reviewing register tape sequence numbers for gaps.
• Surveillance (cameras at registers and cash offices).
7. Prevention and Internal Controls
• Segregation of duties: the person who receives cash should not record it, reconcile it, or make the deposit; the bank reconciliation should be performed by someone independent of cash handling.
• One employee per register and individual log-in codes so shortages can be traced.
• Independent deposit verification: a second person compares the deposit slip to the receipts journal before the deposit leaves, and the bank-validated receipt is returned to someone other than the depositor.
• Dual control over cash counts and deposit preparation.
• Supervisory approval required for voids and refunds, with customer signatures or receipts retained.
• Mandatory vacations and job rotation so lapping schemes collapse.
• Daily deposits to minimize cash on hand and the in-transit window.
• Physical controls: locked drawers, safes, drop boxes, cameras.
• Prompt follow-up on every shortage, however small, to signal that discrepancies are noticed.
8. Exam Tips: Answering Questions on Cash Larceny Schemes
Tip 1 – Decide 'recorded or not recorded' first. Nearly every cash receipts question hinges on this. Recorded then stolen = cash larceny. Stolen before recording = skimming. Look for cue words: 'rang up the sale', 'issued a receipt', 'posted the payment', 'prepared the deposit' → larceny. 'Did not ring up', 'pocketed before recording', 'unrecorded sale' → skimming.
Tip 2 – Know the three locations. If asked where cash larceny occurs, the answers are the point of sale, incoming receivables, and the deposit (cash in transit). Remember that larceny of receivables differs from receivables skimming only by timing: the payment was posted before the theft.
Tip 3 – Match the concealment technique to the scheme. Reversing transactions (false voids/refunds) and altering tapes → register larceny. Force balancing, reversing entries and destroying records → receivables larceny. Deposit lapping, deposits in transit, altered deposit slips → deposit larceny.
Tip 4 – Understand 'force balancing'. The exam likes this term. It means the perpetrator falsifies the ledger totals so records appear balanced despite the shortage. It is possible only when one person both handles cash and controls the books.
Tip 5 – Recognize 'deposits in transit' as a red flag. A legitimate deposit in transit clears within a couple of days. If a question describes an item on the bank reconciliation that has stayed in transit for weeks, the correct answer involves deposit larceny.
Tip 6 – Remember that larceny is harder to conceal than skimming. If a question asks which scheme leaves an audit trail or produces an imbalance in the books, the answer is cash larceny. If it asks which is harder to detect because no record exists, the answer is skimming.
Tip 7 – For control questions, choose segregation of duties and independent reconciliation. When asked for the best preventive control, favor answers that separate custody from recording and reconciliation, or that insert an independent person into the deposit process. Surveillance and surprise counts are good detective controls but are rarely the 'most effective preventive' answer.
Tip 8 – Do not confuse with non-cash schemes. Theft of inventory, supplies or equipment is non-cash misappropriation, not larceny of cash. Likewise, theft of cash on hand that was never a receipt (e.g., from petty cash) is classified under cash on hand misappropriation. Cash larceny in this concept concerns cash receipts.
Tip 9 – Watch for personal checks in the drawer. An employee substituting a personal check for currency is a classic larceny concealment and a frequently tested fact pattern.
Tip 10 – Read for the 'most likely' or 'best' qualifier. Many choices may be partially correct; select the one that most directly addresses the scheme described. Eliminate answers describing skimming, billing fraud or check tampering when the facts clearly show recorded cash disappearing.
Quick Recall Summary
• Definition: theft of cash after it is recorded (on-book).
• Locations: point of sale, receivables, deposit.
• Concealment: altered tapes/counts, false voids/refunds, personal checks, force balancing, reversing entries, destroyed records, deposit lapping, deposits in transit.
• Detection: surprise counts, three-way deposit reconciliation, void/refund analysis, aging of deposits in transit, analytical review.
• Prevention: segregation of duties, independent reconciliation, one person per register, dual control, mandatory vacations, daily deposits.
• Key contrast: skimming is off-book and harder to detect; larceny is on-book and harder to conceal.
Cash larceny sits within the Fraud Tree under Asset Misappropriation → Cash → Theft of Cash Receipts. Together with skimming, it is one of the two basic ways an employee steals incoming cash. The ACFE tests this topic heavily in the Financial Transactions and Fraud Schemes section because it forces you to understand the central distinction that underpins the entire cash receipts branch of the Fraud Tree: has the cash been recorded on the books or not? Mastering cash larceny also prepares you for questions about concealment techniques (reversing entries, force balancing, deposit lapping), detection methods (cash counts, deposit reconciliations, analytical review) and internal controls (segregation of duties, independent reconciliations). According to the ACFE Report to the Nations, cash larceny is less frequent than skimming or billing fraud, but it is a favorite exam topic because its concealment mechanics are so distinctive.
2. What Cash Larceny Is
The ACFE defines cash larceny as the intentional taking of an employer's cash (currency and checks) without the consent and against the will of the employer, AFTER the cash has been recorded in the victim organization's accounting system.
Three elements to memorize:
• Intentional taking – it is theft, not an accounting error.
• Cash – includes both currency and checks received by the organization.
• After recording – the receipt has already appeared on a register tape, cash receipts journal, receivables ledger or deposit record.
The last element is what makes cash larceny an on-book scheme. Because the money has been recorded, its disappearance leaves an imbalance somewhere: the cash on hand will not match the register tape, the deposit will not match the receipts journal, or the bank statement will not match the books. This is exactly why cash larceny is considered harder to conceal than skimming, and why so many larceny schemes involve manipulating records after the fact.
Cash Larceny vs. Skimming – the Core Contrast
• Skimming: cash stolen before it is recorded (off-book). No audit trail exists; the organization may never know the sale or payment occurred.
• Cash larceny: cash stolen after it is recorded (on-book). An audit trail exists; the theft shows up as a shortage unless the records are altered.
If an exam question says a sale was rung up, a receipt was issued, a payment was posted to a customer's account, or cash was placed in a deposit bag, and then the money vanished – that is cash larceny, not skimming.
3. Where Cash Larceny Occurs
Cash larceny can happen at any point where recorded cash is accessible, but the ACFE organizes the schemes into three main locations:
A. Larceny at the Point of Sale
The most common form. An employee with access to a cash register or cash drawer simply removes currency. Because the register tape records every sale, the drawer will be short at the end of the shift. Methods and variations include:
• Taking from one's own register – the employee removes cash and hopes the shortage is attributed to error or is too small to investigate (the death by a thousand cuts approach of many small thefts).
• Theft from other employees' registers – shifting blame to colleagues, especially where multiple employees share one drawer.
• Reversing transactions – processing false voids or false refunds so that the register tape balances to the reduced cash count.
• Altering cash counts or register tapes – changing the figures on the reconciliation sheet or physically destroying or altering the tape so no discrepancy appears.
• Substituting personal checks – the thief takes currency and leaves a personal check (often never cashed or postdated) to make the drawer appear balanced.
• Stealing from the register after close – removing cash from the safe or deposit bag after the day's reconciliation is done.
B. Larceny of Incoming Receivables
Here the employee steals a customer payment that has already been posted to the customer's account. Because the account shows as paid, the customer will not complain, but the cash receipts journal and the deposit will not reconcile. Concealment techniques:
• Force balancing – the perpetrator, who both handles cash and keeps the books, simply changes the ledger totals so the records appear to balance even though they do not. The receivables ledger may be made to agree with a deposit that is short.
• Reversing entries – posting fictitious credits (discounts, write-offs, returns and allowances, bad debt) to the receivables account to make the customer balance zero out while the cash is missing.
• Destroying records – shredding or losing the cash receipts journal, remittance advices or deposit records so that no reconciliation can be performed.
C. Larceny from the Deposit (Cash in Transit)
The period between preparing the deposit and the bank receiving it is highly vulnerable. Whoever carries the deposit to the bank (often the same person who prepared it) has an opportunity to remove funds. Methods include:
• Stealing part of the deposit and altering the deposit slip and the office copy so both reflect the lower amount, then altering the cash receipts journal to agree.
• Deposit lapping – stealing from today's deposit and covering the shortage with cash from the next day's deposit, then covering that from the following day, and so on. Similar in mechanics to receivables lapping but performed on deposits rather than customer accounts.
• Deposits in transit – the thief steals the deposit and records it as 'in transit' on the bank reconciliation. Legitimate deposits in transit clear within a day or two; fraudulent ones linger for weeks or are quietly written off.
• Stealing the entire deposit and claiming it was lost, misplaced or stolen by a third party.
• Carbon copy / bank receipt manipulation – altering the bank-validated deposit receipt or substituting a receipt from a different, smaller deposit.
4. How the Scheme Works – A Typical Pattern
Step 1: Cash or checks are received and recorded (rung into the register, posted to receivables, or listed on the deposit slip).
Step 2: The employee with custody removes some or all of the cash.
Step 3: A discrepancy is created between the recorded amount and the physical cash.
Step 4: The employee conceals the discrepancy by (a) hoping it is overlooked, (b) altering records (tapes, counts, slips, ledgers), (c) posting reversing or fictitious entries, (d) destroying documents, or (e) lapping.
Step 5: The scheme continues until the imbalance becomes too large to hide, an independent reconciliation is performed, or a surprise count catches the shortage.
The enabling condition in almost every case is lack of segregation of duties: the same person has custody of cash and the ability to record or reconcile it.
5. Red Flags of Cash Larceny
• Unexplained or frequent cash shortages or overages at a particular register or employee.
• Register tapes that are missing, altered, torn or out of sequence.
• Unusually high numbers of voids, refunds or no-sale transactions for one employee.
• Personal checks in the drawer or deposit.
• Deposits that do not agree with the cash receipts journal or with the bank statement.
• Deposits in transit that persist beyond a few days or are written off.
• Increases in receivables write-offs, discounts or allowances without supporting documentation.
• Customers' accounts showing payments that never reached the bank.
• Employees who refuse vacations, insist on making the deposit personally, or always reconcile their own work.
6. Detection Techniques
• Surprise cash counts compared to register tapes and receipts journals.
• Three-way deposit reconciliation: compare the cash receipts journal, the deposit slip (and bank-validated copy) and the bank statement; investigate every difference.
• Review of voids and refunds by employee, register and time of day, looking for patterns.
• Analytical review: compare receipts to sales, deposits to receipts, and month-over-month cash ratios; a rising gap between recorded receipts and bank deposits suggests larceny.
• Journal entry review: examine credits to receivables not supported by cash, particularly write-offs, discounts and adjustments posted by cash handlers.
• Aging of deposits in transit on bank reconciliations.
• Reviewing register tape sequence numbers for gaps.
• Surveillance (cameras at registers and cash offices).
7. Prevention and Internal Controls
• Segregation of duties: the person who receives cash should not record it, reconcile it, or make the deposit; the bank reconciliation should be performed by someone independent of cash handling.
• One employee per register and individual log-in codes so shortages can be traced.
• Independent deposit verification: a second person compares the deposit slip to the receipts journal before the deposit leaves, and the bank-validated receipt is returned to someone other than the depositor.
• Dual control over cash counts and deposit preparation.
• Supervisory approval required for voids and refunds, with customer signatures or receipts retained.
• Mandatory vacations and job rotation so lapping schemes collapse.
• Daily deposits to minimize cash on hand and the in-transit window.
• Physical controls: locked drawers, safes, drop boxes, cameras.
• Prompt follow-up on every shortage, however small, to signal that discrepancies are noticed.
8. Exam Tips: Answering Questions on Cash Larceny Schemes
Tip 1 – Decide 'recorded or not recorded' first. Nearly every cash receipts question hinges on this. Recorded then stolen = cash larceny. Stolen before recording = skimming. Look for cue words: 'rang up the sale', 'issued a receipt', 'posted the payment', 'prepared the deposit' → larceny. 'Did not ring up', 'pocketed before recording', 'unrecorded sale' → skimming.
Tip 2 – Know the three locations. If asked where cash larceny occurs, the answers are the point of sale, incoming receivables, and the deposit (cash in transit). Remember that larceny of receivables differs from receivables skimming only by timing: the payment was posted before the theft.
Tip 3 – Match the concealment technique to the scheme. Reversing transactions (false voids/refunds) and altering tapes → register larceny. Force balancing, reversing entries and destroying records → receivables larceny. Deposit lapping, deposits in transit, altered deposit slips → deposit larceny.
Tip 4 – Understand 'force balancing'. The exam likes this term. It means the perpetrator falsifies the ledger totals so records appear balanced despite the shortage. It is possible only when one person both handles cash and controls the books.
Tip 5 – Recognize 'deposits in transit' as a red flag. A legitimate deposit in transit clears within a couple of days. If a question describes an item on the bank reconciliation that has stayed in transit for weeks, the correct answer involves deposit larceny.
Tip 6 – Remember that larceny is harder to conceal than skimming. If a question asks which scheme leaves an audit trail or produces an imbalance in the books, the answer is cash larceny. If it asks which is harder to detect because no record exists, the answer is skimming.
Tip 7 – For control questions, choose segregation of duties and independent reconciliation. When asked for the best preventive control, favor answers that separate custody from recording and reconciliation, or that insert an independent person into the deposit process. Surveillance and surprise counts are good detective controls but are rarely the 'most effective preventive' answer.
Tip 8 – Do not confuse with non-cash schemes. Theft of inventory, supplies or equipment is non-cash misappropriation, not larceny of cash. Likewise, theft of cash on hand that was never a receipt (e.g., from petty cash) is classified under cash on hand misappropriation. Cash larceny in this concept concerns cash receipts.
Tip 9 – Watch for personal checks in the drawer. An employee substituting a personal check for currency is a classic larceny concealment and a frequently tested fact pattern.
Tip 10 – Read for the 'most likely' or 'best' qualifier. Many choices may be partially correct; select the one that most directly addresses the scheme described. Eliminate answers describing skimming, billing fraud or check tampering when the facts clearly show recorded cash disappearing.
Quick Recall Summary
• Definition: theft of cash after it is recorded (on-book).
• Locations: point of sale, receivables, deposit.
• Concealment: altered tapes/counts, false voids/refunds, personal checks, force balancing, reversing entries, destroyed records, deposit lapping, deposits in transit.
• Detection: surprise counts, three-way deposit reconciliation, void/refund analysis, aging of deposits in transit, analytical review.
• Prevention: segregation of duties, independent reconciliation, one person per register, dual control, mandatory vacations, daily deposits.
• Key contrast: skimming is off-book and harder to detect; larceny is on-book and harder to conceal.
Test mode:
CFE - Cash Larceny Schemes Example Questions
Test your knowledge of Cash Larceny Schemes
Question 1
An accounting clerk posts each day's customer payments to the cash receipts journal and the customer accounts, then prepares the bank deposit. For several months she has removed currency from the deposit after posting. Each month-end, she lists the missing amount as a deposit in transit on the bank reconciliation she prepares, and the amount grows each month. Which condition is MOST likely to expose this scheme over time?
Question 2
Cash larceny is generally more difficult to detect than skimming because the stolen funds have already been entered in the victim organization's accounting records when they are taken.
Question 3
An office manager opens the mail, posts each customer payment to the receivables ledger, and prepares the daily bank deposit. Each day she keeps part of the posted receipts. She then uses the next day's receipts to make up the prior day's deposit. As a result, every customer account shows as paid, but each deposit reaches the bank a day late. Which scheme BEST describes this conduct?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Cash Larceny Schemes questions
17 questions (total)