Cash Register Disbursement Schemes

Why Cash Register Disbursement Schemes Matter for the CFE Exam

Cash register disbursement schemes sit on the ACFE Fraud Tree under Asset Misappropriation > Cash > Fraudulent Disbursements, alongside billing schemes, payroll schemes, expense reimbursement schemes, and check and payment tampering. Although register disbursement schemes typically involve smaller dollar amounts than billing or check tampering frauds, they are extremely common in retail, hospitality, and any business that handles point-of-sale cash. For the CFE exam, this topic is heavily tested because it requires you to draw a sharp conceptual line between three ways cash leaves a register: skimming, cash larceny, and register disbursements. Candidates who confuse these categories lose easy points. Understanding register disbursement schemes also sharpens your grasp of the broader principle behind all fraudulent disbursements: the perpetrator causes the organization to record a transaction that makes the removal of cash look legitimate.

What Is a Cash Register Disbursement Scheme?

A register disbursement scheme occurs when an employee makes a false entry on a cash register (or point-of-sale system) to justify removing cash from the drawer. The key feature is that the theft is recorded on the books, but disguised as a legitimate outflow of cash. The two primary types are:

1. False Refunds
2. False Voids

Contrast this with the other two register-related cash schemes on the Fraud Tree:

• Skimming is an off-book scheme. Cash is taken before it is ever recorded in the accounting system (for example, a clerk pockets payment for a sale and never rings it up). There is no audit trail of the sale.
• Cash larceny is an on-book scheme in which cash is stolen after it has been recorded. The sale is rung up correctly, but the cash is simply taken from the drawer, leaving a shortage that is not explained by any transaction.
• Register disbursement schemes are also on-book, but the perpetrator creates a fraudulent transaction (a refund or void) so that the register will appear to balance. The cash is removed, and the books are adjusted to make the drawer reconcile.

In short: skimming hides the receipt, larceny leaves an unexplained shortage, and register disbursements fabricate a reason for the money to be gone.

How False Refund Schemes Work

In a false refund scheme, the employee processes a refund for merchandise that was never actually returned. The register records a disbursement of cash to a (fictitious) customer, and the employee pockets the money. Because the register shows a refund, the drawer balances at the end of the shift.

Common variations include:

• Fictitious refunds: No return occurs at all. The employee enters a refund for a nonexistent transaction and takes the cash.
• Overstated refunds: A legitimate customer returns an item, but the employee records a refund larger than the actual amount paid back to the customer and keeps the difference.
• Credit card refunds: The employee processes a refund to his or her own credit or debit card rather than taking cash. This is increasingly common in card-dominated environments and is sometimes harder to spot without card number analytics.

A critical side effect of false refunds is their impact on inventory. When a refund is processed, the system typically adds the supposedly returned item back into inventory. Since no item was actually returned, the perpetual inventory records become overstated relative to physical stock. Over time, this produces inventory shrinkage, which is one of the most important red flags for detecting this scheme. The fraudster may try to conceal shrinkage by altering inventory counts, writing items off as damaged or obsolete, or waiting for the discrepancy to be absorbed as normal shrink.

How False Void Schemes Work

A false void occurs when an employee rings up a legitimate sale, takes the customer's payment, and then voids the transaction after the customer has left. The register records that no sale took place, so the cash that was collected is not expected to be in the drawer, and the employee removes it.

Because most organizations require a copy of the customer's receipt to support a void, the employee typically needs to retain the receipt. This is why one red flag is an employee who does not hand receipts to customers or who collects discarded receipts. Voids also generally require supervisory approval. Fraudsters defeat this control by forging the supervisor's initials, by exploiting supervisors who approve voids without reviewing them (rubber-stamping), by obtaining a supervisor's authorization code, or by colluding with the supervisor.

Concealment Techniques

Perpetrators use several methods to avoid detection:

• Keeping individual refunds or voids below the review or approval threshold so no manager examines them.
• Processing a high volume of small transactions rather than a few large ones.
• Destroying or altering register tapes and journal records so that the fraudulent transactions cannot be reviewed.
• Forging customer names, addresses, and signatures on refund slips, or using names of real customers from prior transactions.
• Adjusting inventory records or attributing shrinkage to shoplifting or breakage.
• Timing refunds during busy periods or shift changes when oversight is weakest.

Detection Methods

Fraud examiners should focus on data analytics and trend analysis:

• Compare refunds and voids by employee, by register, by shift, and by time of day. An employee whose refund rate is significantly above peers is a prime suspect.
• Analyze the ratio of refunds to sales over time; an unexplained upward trend is a red flag.
• Look for clusters of transactions just below the approval threshold.
• Identify refunds credited to the same credit card number repeatedly, especially one belonging to an employee.
• Review the time gap between a sale and its void; voids processed long after the sale, or after the customer would have left, are suspicious.
• Investigate inventory shrinkage and compare it against refund activity for the same product lines.
• Check for missing, incomplete, or gapped register tapes and void logs.
• Verify refund documentation by contacting customers listed on refund slips; fictitious names, duplicated addresses, or customers who deny the return are strong evidence.
• Monitor supervisor override codes for excessive or unusual use.

Prevention and Controls

• Require independent supervisory approval of every refund and void, and ensure the supervisor actually examines the merchandise and documentation rather than signing blindly.
• Require the customer's signature, name, and contact information on refund forms, and randomly verify a sample.
• Enforce segregation of duties: the employee who processes a refund should not also count or reconcile the drawer, and ideally should not have inventory adjustment access.
• Assign individual register log-ins so every transaction is traceable to a specific employee.
• Maintain and secure complete register tapes or electronic journals and reconcile them to cash and inventory.
• Conduct surprise cash counts and periodic physical inventory counts compared to perpetual records.
• Require that receipts be given to every customer and post signage encouraging customers to ask for them.
• Use exception reporting that flags unusual refund or void patterns automatically.

Exam Tips: Answering Questions on Cash Register Disbursement Schemes

Tip 1: Classify by whether a fraudulent transaction was recorded. If the question describes an employee who rings up a refund or void to justify taking cash, the answer is a register disbursement scheme. If cash is taken before any record is made, it is skimming. If recorded cash is simply stolen with no covering entry, it is cash larceny. The exam loves to present a scenario and ask you to name the scheme; the presence of a false refund or void is your signal.

Tip 2: Remember register disbursements are fraudulent disbursements, not receipts schemes. Even though they occur at the register, they belong under Fraudulent Disbursements on the Fraud Tree because the organization is tricked into paying out money. Do not place them under Theft of Cash Receipts.

Tip 3: Know the two types and their distinguishing features. False refunds involve fictitious or overstated returns and cause inventory to be overstated (leading to shrinkage). False voids involve cancelling a real sale after collecting payment and typically require the employee to retain the customer's receipt.

Tip 4: Link false refunds to inventory shrinkage. If a question asks about the accounting effect of a fictitious refund, the answer involves inflated perpetual inventory and resulting shrinkage. This is a frequently tested consequence.

Tip 5: Recognize concealment red flags. Questions may describe many small refunds just under an approval limit, missing register tapes, or an employee who holds onto customer receipts. These are classic indicators of register disbursement fraud.

Tip 6: For detection questions, think analytics by employee. The best detection answer usually involves comparing refund and void activity by individual cashier, register, or shift, and investigating outliers. Also consider matching refunds to credit card numbers and verifying returns with customers.

Tip 7: For prevention questions, think independent approval and segregation. The strongest control answers emphasize genuine (not rubber-stamp) supervisory review of refunds and voids, customer documentation, unique employee log-ins, and separating refund processing from cash reconciliation and inventory adjustment.

Tip 8: Watch for the credit card twist. Modern exam questions may describe refunds issued to a card rather than in cash. This is still a false refund scheme; the detection method shifts toward analyzing repeated card numbers rather than cash drawer counts.

Tip 9: Eliminate answers that confuse the drawer balancing. A hallmark of register disbursement schemes is that the drawer balances because the fraudulent transaction accounts for the missing cash. If an answer choice says the scheme produces an unexplained cash shortage, that describes larceny, not a register disbursement.

Summary

Cash register disbursement schemes are on-book frauds in which an employee creates a false refund or false void to justify removing cash from the register. False refunds cause inventory overstatement and shrinkage; false voids require retained receipts and often forged or rubber-stamped approvals. Detection relies on analyzing refund and void patterns by employee and investigating shrinkage, while prevention depends on meaningful supervisory approval, customer documentation, segregation of duties, and secure transaction records. On the CFE exam, your first job in any register scenario is to decide whether the cash was never recorded (skimming), recorded then stolen (larceny), or removed under cover of a fabricated transaction (register disbursement).