Preventing and Detecting Skimming

Why This Topic Matters
Skimming is the most common cash receipts scheme encountered by fraud examiners, and it is a staple of the ACFE CFE exam in the Financial Transactions and Fraud Schemes section. Because skimming is an off-book fraud, it leaves no direct audit trail in the accounting records, which makes it harder to detect than cash larceny. Examiners must know not just how skimming works, but how controls prevent it and which analytical and investigative techniques reveal it. On the exam, this topic appears in several forms: definitional questions (skimming vs. larceny), scenario-based questions (identifying the scheme from facts), and control-based questions (which control would best prevent or detect a given scheme). Mastering this concept also builds the foundation for understanding related topics such as lapping, receivables fraud, and analytical review.

What Skimming Is
Skimming is the theft of cash from an organization before it has been recorded in the accounting system. This is the single most important distinguishing feature. Because the money is taken before it is entered in the books, there is no record that the cash was ever received, which is why skimming is classified as an off-book scheme. Contrast this with cash larceny, which is the theft of cash after it has been recorded (for example, stealing from the register after the sale is rung up, or stealing from a deposit that has already been entered in the cash receipts journal). Larceny leaves an imbalance between recorded receipts and actual cash, making it easier to detect.

Skimming is most often committed by employees who deal directly with customers or incoming payments: cashiers, sales staff, waiters, tellers, mailroom clerks, accounts receivable clerks, and even salespeople who collect payments in the field. Any position where an employee has first contact with incoming cash is a skimming risk point.

How Skimming Schemes Work
The ACFE Fraud Tree divides skimming into three main categories: sales skimming, receivables skimming, and refund skimming. Understanding each category and its sub-schemes is essential for scenario questions.

1. Sales Skimming
Unrecorded sales: The employee collects payment from a customer but never records the sale. Common methods include ringing a 'no sale' on the register to open the drawer, pocketing the cash, failing to ring up the sale at all, or conducting sales during off-hours when no one is watching. In some cases the employee uses a second register or a personal cash box. Because the sale is never recorded, the only clue may be missing inventory.
Understated sales and receipts: The employee records the sale, but for a smaller amount than actually collected. For example, a customer pays $100 but the employee records $60 and keeps $40. Variations include falsely applying discounts or recording a lower quantity than was sold. Altered receipts or register tapes may be used to hide the difference.
Theft of checks through the mail: Incoming customer checks are intercepted before they are logged, typically by a mailroom employee or whoever opens the mail. The perpetrator may endorse checks to themselves, alter the payee, or deposit them in a bank account with a name similar to the victim organization. This is especially dangerous where one person both opens mail and records receipts.
Check-for-currency substitution: The employee steals incoming cash and replaces it with an incoming check of equal value that would otherwise be recorded. The deposit total matches, but the check was never recorded as a receivable payment, leaving a customer account unpaid.
Skimming by salespeople: Field sales staff or independent agents who collect payments may simply fail to turn them over, or may skim from cash-paying customers who do not receive invoices.

2. Receivables Skimming
This is more complex because the customer has an account and expects to be credited. The thief must conceal the fact that payment was received but not posted. Concealment methods include:
Lapping: The classic scheme. The employee steals Customer A's payment, then applies Customer B's payment to A's account to hide the shortage, then applies Customer C's payment to B's account, and so on. The scheme requires constant maintenance and tends to grow over time. The perpetrator often keeps a second set of records to track which accounts need to be covered.
Force balancing: The employee posts the payment to the customer's account so the customer is satisfied, but does not deposit the cash. To make the books balance, the employee makes an unsupported entry such as overstating the deposit, debiting a different account, or simply forcing the cash account to balance with a journal entry.
Stolen or altered statements: To keep the customer from complaining about an unpaid balance, the employee intercepts the customer's statement, alters it to show the payment, or changes the customer's mailing address so statements go elsewhere.
Fraudulent write-offs and discounts: The skimmed receivable is written off as uncollectible, bad debt, or as a discount or allowance, removing it from the books.
Debiting existing or fictitious accounts: The shortage is moved to a dormant account, an expense account, or a fictitious customer account where it is unlikely to be noticed.
Destroying or altering records: Destroying register tapes, invoices, or remittance advices to remove any documentation of the payment.

3. Refund Skimming
Occurs when an organization is owed money from a third party, such as a tax refund, vendor rebate, insurance payment, or overpayment refund. Because these inflows are often irregular and not tracked as receivables, an employee can divert them without the organization ever expecting the funds.

Red Flags of Skimming
Since skimming is off-book, detection depends heavily on indirect indicators: declining gross profit margin or increasing cost of goods sold as a percentage of sales (sales fall but costs remain), inventory shrinkage that cannot be explained (goods sold but never recorded), decreasing cash sales relative to credit card sales, an unusual number of 'no sale' or void transactions on a register, gaps in sequentially numbered receipts, customer complaints about payments not credited or incorrect balances, increasing receivables write-offs, delays in posting payments to accounts, an employee who refuses vacations or insists on handling certain customers personally, an employee whose lifestyle exceeds their income, and discrepancies between remittance advices and recorded receipts.

Preventing Skimming
Prevention centers on controlling the point where cash first enters the organization and on separating duties.
Segregation of duties: No single employee should receive cash, record it, post to receivables, reconcile the bank account, and authorize write-offs. The person who opens mail should not be the person who posts receipts; the person who posts receipts should not reconcile the bank account or approve adjustments.
Mail handling controls: Mail should be opened by two people or in a monitored area, and a remittance list (a log of all checks received) should be prepared immediately and sent independently to accounting for later comparison with the deposit. A bank lockbox arrangement removes employees from the receipt process entirely.
Cash register controls: Every sale must be rung on a register that generates a receipt; signs encouraging customers to request receipts turn customers into monitors; register access should be restricted by unique login codes; 'no sale' and void transactions should require supervisory approval or be reviewed daily; register tapes should be secured and reviewed by someone other than the cashier.
Physical controls: Cash should be secured, deposits made daily and intact, and access to cash areas restricted. Video surveillance at registers and cash handling areas acts as both a deterrent and a detection tool.
Receivables controls: Independent reconciliation of the accounts receivable subsidiary ledger to the general ledger, mandatory approval for all write-offs, discounts, and account adjustments by someone outside the receivables function, and periodic mailing of statements by an independent party.
Personnel controls: Mandatory vacations and job rotation are especially effective against lapping, which collapses when the perpetrator is absent. Background checks on employees in cash-handling roles, a fraud hotline, and a strong tone at the top complete the preventive framework.
Management oversight and customer service: Managers should be visibly present; complaints about billing errors should be routed to someone independent of the receivables clerk, since customers are often the first to notice unposted payments.

Detecting Skimming
Detection combines analytical procedures, document examination, and investigative techniques.
Analytical review: Compare gross margin, sales, and inventory trends across periods, locations, shifts, or employees. Horizontal and vertical analysis of the income statement can reveal declining sales with stable costs. Compare the ratio of cash to credit sales over time, and compare sales by cashier or shift to isolate anomalies. Unexplained inventory shrinkage paired with declining recorded sales is a classic skimming indicator.
Receivables testing: Review the aging schedule for accounts that are consistently late or that show unusual payment patterns. Examine all write-offs, discounts, credit memos, and adjustments for proper authorization and supporting documentation. Send confirmations to customers directly, bypassing the receivables clerk. Compare remittance advices and customer check copies to the posting dates and amounts in the receivables ledger; in a lapping scheme, payments will be posted days later than received and the check from one customer will be applied to another customer's account.
Deposit testing: Compare the remittance list prepared at mail opening with the deposit slip and the cash receipts journal. Review deposits for composition changes (fewer checks, less currency). Trace individual checks from bank deposit records back to customer accounts to detect check-for-currency substitution.
Register and document review: Examine register tapes for excessive 'no sale,' void, or refund entries, missing sequence numbers, and gaps in time stamps. Compare register totals to physical cash counts via surprise cash counts.
Investigative techniques: Surveillance (physical or video), test purchases by investigators (integrity shopping) to see whether sales are rung up, interviews of customers who complain about balances, and review of the suspect's personal financial situation when a scheme is suspected.

Exam Tips: Answering Questions on Preventing and Detecting Skimming
1. Anchor on the timing test. The exam repeatedly tests whether you can distinguish skimming from cash larceny. Ask one question: was the cash recorded before it was taken? If no, it is skimming (off-book). If yes, it is larceny (on-book). Any answer describing theft from a recorded deposit, a rung-up sale, or booked receipts is larceny, not skimming.
2. Know that skimming leaves no direct audit trail. If a question asks why skimming is harder to detect than larceny, the answer is that the funds are never recorded, so there is no discrepancy between the books and cash on hand. Detection must therefore rely on indirect evidence such as inventory shrinkage, margin analysis, or customer complaints.
3. Match the red flag to the scheme. Unexplained inventory shrinkage plus declining sales points to unrecorded sales skimming. Customer complaints about unposted payments or delayed posting points to receivables skimming, especially lapping. Rising write-offs or discounts point to concealment of skimmed receivables. A growing gap between recorded deposits and the remittance list points to theft of incoming checks.
4. Lapping questions are predictable. Lapping is concealed by applying later payments to earlier accounts. It is prevented by segregation of duties and mandatory vacations, and detected by comparing the dates and amounts of customer payments (remittance advices, check copies) to posting dates in the receivables ledger, and by confirming balances directly with customers. If an answer option says the scheme 'collapses when the employee takes a vacation,' it is describing lapping.
5. 'Best control' questions favor independence. When asked for the single most effective control, choose the option that removes the employee's sole control over the cash receipt point: a lockbox, two people opening mail, an independent remittance list, independent reconciliation, or segregation of receiving from recording. Options that rely on the suspect employee's own records are weak.
6. Distinguish prevention from detection. Read whether the question asks how to prevent or how to detect. Prevention answers involve controls applied before or at the point of receipt (segregation of duties, registers, receipts, lockboxes, approvals). Detection answers involve after-the-fact procedures (analytical review, confirmations, surprise counts, comparing remittance lists to deposits, reviewing write-offs).
7. Watch for check-for-currency substitution. If a scenario says the deposit total matches the receipts journal but a customer's account was never credited, the employee likely swapped cash for an incoming check. The detection method is tracing individual deposited items to customer accounts.
8. Remember the three categories. Be able to list sales skimming, receivables skimming, and refund skimming, and place a scenario in the correct category. Unrecorded sales, understated sales, and mail theft fall under sales skimming; lapping, force balancing, and fraudulent write-offs fall under receivables skimming.
9. Eliminate answers that confuse schemes. Distractors often describe billing schemes, register disbursement schemes (false voids and refunds that take money out after recording), or check tampering. Skimming always involves incoming funds taken before recording. A false refund that removes cash from a register is a fraudulent disbursement, not skimming.
10. Use the customer as a control. Many correct answers involve the customer: encouraging receipt requests, mailing statements independently, routing complaints to someone outside receivables, and sending confirmations. The exam rewards recognizing that customers are a natural check on cash receipts.

Quick Reference Summary
Skimming = cash stolen before being recorded (off-book). Larceny = cash stolen after being recorded (on-book). Main types: sales skimming (unrecorded sales, understated sales, mail theft, check-for-currency substitution), receivables skimming (lapping, force balancing, stolen statements, write-offs, debiting other accounts), refund skimming. Key prevention: segregation of duties, dual mail opening with remittance lists, lockbox, register controls, approval of adjustments, mandatory vacations, job rotation. Key detection: gross margin and inventory shrinkage analysis, review of write-offs and adjustments, comparison of remittance lists to deposits, receivables confirmations, posting-date analysis for lapping, surprise cash counts, surveillance, and customer complaint follow-up.