Skimming Schemes

1. Why Skimming Schemes Matter for the CFE Exam

Skimming is one of the foundational topics in the Financial Transactions and Fraud Schemes section of the CFE Exam. It sits at the top of the Cash Receipts branch of the ACFE Fraud Tree (Asset Misappropriation → Cash → Theft of Cash Receipts → Skimming). The ACFE tests it heavily because it is conceptually distinct from every other cash scheme: it is an off-book fraud. Because the stolen cash never enters the accounting records, there is no direct audit trail, which forces the examiner to rely on indirect, analytical, and behavioral evidence rather than on reconciling the books. If you understand skimming, you understand why fraud examiners must look beyond the ledger. The exam will test your ability to (a) classify a scenario as skimming versus cash larceny, (b) identify the specific skimming sub-scheme, (c) recognize the concealment technique, and (d) select the best prevention or detection control.

2. What Skimming Is

The ACFE defines skimming as the theft of cash from a victim organization before it is recorded in the accounting system. Because the receipt is never recorded, the organization may not even know the money was ever received. This is what makes it an off-book scheme.

Contrast this with cash larceny, which is the theft of cash after it has been recorded in the books. Larceny is on-book: the records show the money came in, so a shortage will eventually appear in a reconciliation. Skimming leaves no such gap, because the receipt and the record both vanish together.

Who commits skimming? Anyone who handles cash before it is recorded: cashiers, salespersons, waitstaff, receptionists, mailroom clerks, accounts receivable clerks, collectors, independent sales agents, and employees at remote or off-site locations with little supervision.

3. How Skimming Works – The Major Categories

The ACFE organizes skimming into three broad groups: sales skimming, receivables skimming, and refunds and other. Know the sub-schemes within each.

A. Sales Skimming (Unrecorded and Understated Sales)

Unrecorded sales: The employee collects payment from a customer but never rings up the sale. The cash register shows nothing, so a cash count will balance. Common methods include leaving the register drawer open after a prior sale, using the no sale key to open the drawer, entering a void, or simply pocketing cash and giving the customer no receipt or a handwritten receipt. Because the customer walked away with the goods or services, the only trace is missing inventory.

Understated sales (understated sales and receivables): The employee records the sale, but at a lower amount than actually collected. For example, the customer pays $100, the employee records $60 and keeps $40. A variation is recording a fictitious discount on the sale.

Register manipulation: Excessive no-sale transactions, voids, or ringing sales on a personal calculator or a second unauthorized register.

After-hours sales: Employees conduct sales outside normal business hours (or off the books at a remote location) and keep all proceeds.

Skimming by off-site employees: Independent salespersons, route drivers, property managers, and employees at satellite offices who collect cash with little direct oversight. Off-site skimming is a classic exam scenario because the lack of supervision is the key control weakness.

Poor collection procedures: Weak or nonexistent procedures over collecting and recording cash (for example, cash collected at events, donations, or fees) make it easy for receipts to be diverted before any record exists.

Theft in the mailroom – incoming checks: An employee who opens the mail steals customer checks before they are logged. The check is converted (often through a fictitious bank account in a name similar to the company) and the customer is left with an unpaid balance. This bridges into receivables skimming.

Check-for-currency substitution: An employee steals currency from a cash receipt and replaces it with an unrecorded customer check of equal value. The daily total still balances, but the check's customer account is never credited. This is a frequently tested detail.

B. Receivables Skimming

Skimming receivables is harder for the fraudster than skimming sales, because the customer expects a credit to his account. If the payment is stolen and not posted, the customer will receive a past-due notice and complain. Therefore receivables skimming almost always requires an active concealment technique:

Lapping: The most famous receivables skimming concealment. The employee steals Customer A's payment. When Customer B pays, B's payment is posted to A's account. When Customer C pays, C's payment covers B, and so on. It is often described as robbing Peter to pay Paul. Lapping requires continuous attention, frequently involves a second set of records kept by the fraudster, and tends to grow until the employee can no longer keep up. It typically unravels when the employee is absent (hence the value of mandatory vacations and job rotation).

Forcing account balances (force balancing): The employee has access to both incoming payments and the accounting records, and simply makes an unsupported entry to the cash account or receivables ledger so the books appear to balance.

Stolen or altered statements: To prevent the customer from noticing a missing credit, the employee intercepts or alters the customer's statement, or changes the customer's mailing address so statements go to the fraudster.

Fraudulent write-offs or discounts: The stolen receivable is written off as bad debt, or a fictitious discount or allowance is posted to bring the customer's balance to zero.

Debiting the wrong account: The stolen payment is posted against an aged or fictitious receivable, or against an existing account that will later be written off, so the real customer's account looks correct.

Destroying or altering records: If all else fails, the fraudster destroys transaction records to prevent the trail from being followed.

C. Refunds and Other

Skimming can also occur where cash flows in through non-sales channels, such as refunds from vendors, rebates, deposits, or miscellaneous receipts that are not routinely tracked.

4. How Skimming Is Concealed

Beyond the receivables techniques above, remember two more concealment issues:

Inventory shrinkage: Unrecorded sales leave inventory short. To hide this, fraudsters may alter perpetual inventory records, falsify physical counts, or write off inventory as scrap, damaged, or obsolete. Unexplained shrinkage is therefore a primary red flag of sales skimming.

Converting stolen checks: Stolen checks payable to the company may be converted by opening a bank account in a similar name (for example, ABC Co. versus ABC Company), by forging an endorsement, by double endorsement, or through a bank employee's collusion. Checks marked with a restrictive endorsement (For Deposit Only) are much harder to convert.

5. Red Flags of Skimming

• Unexplained or rising inventory shrinkage
• Declining gross profit margin or declining revenue while costs remain constant
• Increase in bad-debt write-offs, discounts, or adjustments, especially approved by the same employee
• Customer complaints about payments not credited or duplicate billing notices
• Excessive no-sale, void, or refund transactions at a particular register or employee
• Deposits in transit that grow or remain outstanding unusually long
• Employee who refuses to take vacation or allow others to handle his accounts
• Altered, missing, or unnumbered receipt documents
• Lifestyle changes inconsistent with salary
• Cash receipts that do not match sales reports, or decline after a particular employee is hired

6. Detection Methods

Because skimming is off-book, detection depends on analytical procedures and indirect evidence:

• Receipt and sales analysis: Horizontal (trend) and vertical (common-size) analysis of sales, cost of sales, and gross margin; ratio analysis over time and across locations or employees.
• Inventory analysis: Compare physical counts to perpetual records; investigate shrinkage and inventory write-offs.
• Journal entry analysis: Examine entries to cash shortage accounts, bad debt expense, discounts, write-offs, and inventory adjustments for unusual patterns or a single approver.
• Register and point-of-sale analysis: Review frequency of no-sales, voids, and refunds by employee and shift.
• Receivables review: Confirm balances directly with customers, examine aging reports, trace individual payments to deposits (a key lapping test), and compare dates on checks to posting dates.
• Deposit review: Compare the detail of bank deposits (checks vs. currency composition) with the detail of recorded receipts; a shift from currency to checks may indicate check-for-currency substitution.
• Surprise cash counts, surveillance, and undercover shoppers for register-based schemes.
• Tips and complaints: Customer complaints are frequently the first indicator of receivables skimming.

7. Prevention Controls

• Segregation of duties: Separate the receipt of cash, the recording of transactions, and the reconciliation of accounts; the person opening mail should not post receivables.
• Two-person mailroom opening with an immediate remittance log and restrictive endorsement stamped on all incoming checks.
• Use of a bank lockbox so customer payments never pass through employee hands.
• Pre-numbered receipts, sales invoices, and register tapes, with accountability for all numbers.
• Visible cash register displays and a policy that every customer receives a receipt (some businesses offer the purchase free if no receipt is given).
• Mandatory vacations and job rotation to break lapping schemes.
• Independent reconciliation of bank statements, deposits, and receivables by someone not involved in receipts.
• Management review and separate approval of all write-offs, discounts, and account adjustments.
• Physical safeguards: cameras, locked drawers, limited register access with individual log-ins.
• Periodic independent inventory counts and investigation of shrinkage.
• Supervision and surprise audits of off-site locations and independent agents.

8. Exam Tips: Answering Questions on Skimming Schemes

Tip 1 – Nail the timing test. The single most tested concept is skimming versus cash larceny. Ask: Was the cash recorded before it was stolen? If the money was taken before entry in the books, it is skimming (off-book). If it was taken after it was recorded, it is cash larceny (on-book). Watch for phrases such as 'never rang up the sale', 'did not log the check', 'pocketed the payment and recorded nothing' (skimming) versus 'removed cash from the register after the sale was recorded' or 'stole from the deposit' (larceny).

Tip 2 – Classify the sub-scheme, not just the scheme. Many questions ask which type of skimming is described. Memorize the signatures: no record at all = unrecorded sales; recorded at a lower amount = understated sales; stealing one customer's payment and covering with the next = lapping; swapping stolen currency for an unrecorded check = check-for-currency substitution; stealing mailed checks = mailroom/incoming check theft.

Tip 3 – Distinguish the scheme from the concealment. The exam often asks for the concealment method rather than the theft. Lapping, forced balances, fraudulent write-offs, stolen statements, debiting the wrong account, and falsified inventory records are concealment techniques, not thefts. If the question says 'how did the employee hide the fraud', pick the concealment, not the skimming category.

Tip 4 – Remember the audit trail logic. Any question stating that a scheme 'leaves no direct audit trail', is 'difficult to detect through reconciliation', or 'is detected mainly through analytical review' is pointing to skimming. Conversely, if detection came from a reconciliation or deposit discrepancy, think larceny.

Tip 5 – Link the red flag to the scheme. Unexplained inventory shrinkage and falling gross margins point to sales skimming. Customer complaints about uncredited payments, rising write-offs, and an employee who never takes vacation point to receivables skimming (especially lapping).

Tip 6 – Choose the strongest control. When asked for the best prevention, prefer structural controls over detective ones: segregation of duties, lockbox, two-person mail opening with remittance log, restrictive endorsements, and mandatory vacations/job rotation. When asked for the best detection of lapping specifically, select tracing individual customer payments to specific bank deposits or confirming balances directly with customers.

Tip 7 – Watch for the off-site employee cue. If the scenario involves a route salesperson, independent agent, remote office, or any employee collecting cash without supervision, the examiners want you to recognize off-site skimming and the control weakness of lack of oversight.

Tip 8 – Do not confuse skimming with other Fraud Tree branches. Stealing company checks and altering the payee is a fraudulent disbursement (check tampering), not skimming. Creating a fake refund to pull cash from the register is a register disbursement scheme. Skimming is always about incoming cash receipts that were never recorded.

Tip 9 – Read the whole scenario before answering. CFE questions frequently include two or more steps (a theft, then a concealment, then a conversion). Identify which step the question is actually asking about, and eliminate answers that describe a different step.

Tip 10 – Use elimination on 'all of the following EXCEPT' questions. Typical correct EXCEPT answers include an on-book act (larceny) listed among off-book skimming methods, or a disbursement scheme listed among receipts schemes.

9. Quick Review Summary

• Skimming = theft of cash before it is recorded; off-book; no direct audit trail.
• Cash larceny = theft of cash after it is recorded; on-book.
• Sales skimming: unrecorded sales, understated sales, register manipulation, after-hours sales, off-site employees, mailroom check theft, check-for-currency substitution.
• Receivables skimming: requires concealment – lapping, forced balances, stolen/altered statements, fraudulent write-offs/discounts, debiting wrong account, destroying records.
• Key red flags: inventory shrinkage, declining margins, rising write-offs, customer complaints, employee who avoids vacation.
• Detection: analytical review of sales/inventory/receivables, journal entry review, deposit composition analysis, customer confirmations, surprise counts, surveillance.
• Prevention: segregation of duties, lockbox, two-person mail opening, remittance logs, restrictive endorsements, pre-numbered documents, mandatory vacations and job rotation, independent reconciliations, approval of adjustments.

Master the timing test, memorize the sub-scheme signatures, and keep theft, concealment, and conversion as separate mental steps, and you will handle any skimming question the CFE Exam presents.