Preventing and Detecting Register Disbursement Fraud

Why This Topic Matters

Register disbursement schemes are a sub-category of fraudulent disbursements within the ACFE's Occupational Fraud and Abuse Classification System (the Fraud Tree). While they are typically among the least costly of all fraud schemes in terms of median loss, they occur frequently in retail, hospitality, and any environment with a cash register or point-of-sale (POS) system. For the CFE exam, this topic sits in the Financial Transactions and Fraud Schemes section, and candidates are expected to understand not just how the schemes work, but how organizations can prevent and detect them. Examiners frequently test the distinction between register disbursement schemes and skimming or cash larceny, as well as the specific internal controls and red flags associated with false refunds and false voids.

What Is Register Disbursement Fraud?

A register disbursement scheme occurs when an employee makes a false entry on a cash register to justify the removal of cash. The two main types are:

1. False refunds – The employee processes a refund for merchandise that was never actually returned, then removes the cash from the register. Variations include overstated refunds, where a legitimate return is recorded at a higher amount than the actual refund paid to the customer, and credit card refunds posted to the employee's own card.

2. False voids – The employee rings up a sale, collects the customer's payment, and then voids the transaction after the customer leaves, keeping the cash. The employee typically retains the customer's receipt (or a copy) to attach to the void slip as supporting documentation.

The defining feature that distinguishes register disbursements from skimming and cash larceny is that the removal of cash is recorded on the register. In skimming, the sale is never recorded (off-book). In cash larceny, the sale is recorded but the cash is simply stolen with no corresponding entry to explain it. In a register disbursement scheme, a fraudulent transaction (refund or void) is entered specifically to make the register balance despite the missing cash. Because the register appears to reconcile, these schemes can be difficult to catch through simple cash counts.

How Register Disbursement Schemes Work

False refund mechanics:
- Employee enters a refund transaction for a fictitious return.
- Register shows cash was paid out, so the drawer balances at the end of the shift.
- Inventory records now overstate the merchandise on hand (the system believes an item was returned), creating inventory shrinkage that surfaces during a physical count.
- Fraudsters often keep refunds below the review or authorization threshold to avoid supervisory approval.

False void mechanics:
- A legitimate sale is rung up and cash collected.
- After the customer departs, the employee voids the sale.
- The customer's receipt is used as support for the void.
- Inventory is again overstated, since the item left the store but the sale no longer exists in the records.

Concealment:
- Forging a manager's authorization on refund/void slips.
- Destroying register tapes or detail reports.
- Keeping each transaction small and spreading them over time.
- Processing refunds during busy periods when supervisors are distracted.
- Colluding with a supervisor who approves the fraudulent transactions.

Preventing Register Disbursement Fraud

Prevention rests on segregation of duties, authorization controls, and physical/system controls. Key measures include:

- Separate approval for refunds and voids: Require a supervisor or manager to review and authorize every void or refund, ideally in person and before the transaction is completed. The approver should be someone other than the cashier.
- Supervisor presence during transactions: Managers should verify that the customer is physically present and that returned merchandise is actually received before approving a refund.
- Customer signatures and contact information: Requiring customers to sign refund forms and provide a phone number or address allows follow-up verification and discourages fictitious entries.
- Unique login IDs and access codes: Each employee should have a unique register login. Access to void/refund functions should be restricted to authorized personnel, and passwords should never be shared.
- Limit refund authority: Set dollar thresholds above which higher-level approval is required, and monitor transactions clustered just below those thresholds.
- Refunds paid by the original payment method: Require credit card refunds to go back to the original card, and require checks or store credit for large cash refunds, reducing the opportunity to pocket cash.
- Mandatory receipts for returns: A refund without an original receipt should trigger extra scrutiny or be disallowed.
- Physical security of register tapes and reports: Register detail should be secured so cashiers cannot destroy or alter evidence.
- Video surveillance at register stations acts as both deterrent and investigative tool.
- Mandatory vacations and job rotation for register staff and supervisors, since many schemes rely on the fraudster's constant control.
- Anti-fraud training and a reporting hotline, since tips remain the most common method of detection for all occupational fraud.

Detecting Register Disbursement Fraud

Detection focuses on analytical review of register data, inventory reconciliation, and document examination.

Analytical and data-driven techniques:
- Summarize refunds and voids by employee, by register, by shift, and by supervisor. An employee with a disproportionately high number or dollar amount of refunds or voids compared with peers is a classic red flag.
- Review refunds and voids by time of day, looking for patterns such as transactions processed at opening, closing, or during supervisor absences.
- Identify refunds or voids made just below authorization limits.
- Look for sequential or clustered refund transactions, or multiple refunds to the same customer or credit card number.
- Compare refund rates to industry norms and to the location's historical trends.
- Match credit card refunds to original sales; a refund with no corresponding original purchase is highly suspicious.
- Use Benford's Law or similar digital analysis on refund amounts to spot manufactured figures.

Inventory-based detection:
- Unexplained inventory shrinkage is the primary accounting consequence of register disbursement fraud. Physical counts that fall short of perpetual inventory records, especially in departments linked to high refund volume, warrant investigation.
- Reconcile returned merchandise physically received against refund records; refunds with no corresponding returned goods indicate false refunds.

Document examination:
- Review void and refund slips for missing, forged, or photocopied manager signatures.
- Check that a customer receipt supporting a void actually matches the voided transaction and has not been reused.
- Look for missing or altered register tapes, gaps in transaction numbering, or an unusual number of "no sale" entries.
- Verify customer information on refund forms by contacting a sample of customers.

Behavioral red flags:
- Employee who resists taking vacations or insists on handling closing alone.
- Employee living beyond apparent means.
- Cashier frequently processes refunds when the supervisor is not on the floor.
- Customer complaints about receipts, charges, or refunds that do not match their experience.

How Register Disbursements Fit Within Fraudulent Disbursements

The CFE exam expects you to place register disbursements alongside the other fraudulent disbursement categories: billing schemes, payroll schemes, expense reimbursement schemes, and check and payment tampering. All fraudulent disbursements share the characteristic that the organization's own records show a payment going out, making them on-book frauds. Register disbursements are unique in that they occur at the point of sale rather than through accounts payable or payroll, and they almost always involve cash rather than checks or electronic transfers.

Exam Tips: Answering Questions on Preventing and Detecting Register Disbursement Fraud

1. Know the two schemes cold. If a question describes a refund for merchandise never returned, the answer is a false refund. If it describes a sale being rung up, cash collected, and then the transaction cancelled, it is a false void. Overstated refunds (recording a larger refund than actually given to the customer) are a variation of false refunds.

2. Distinguish from skimming and cash larceny. Many questions test this boundary. Ask yourself: Was the removal of cash recorded on the register? If yes, through a false refund or void, it is a register disbursement. If the sale was never recorded at all, it is skimming. If the sale was recorded and the cash simply disappeared with no cover transaction, it is cash larceny. Remember that register disbursement schemes cause the register to balance, while larceny causes a shortage.

3. Remember the inventory connection. A frequent exam point is that register disbursement schemes cause inventory shrinkage because the records show merchandise returned (or never sold) when it actually left the store. When a question asks which account or record is affected, think inventory.

4. Prevention equals segregation and authorization. If asked for the most effective preventive control, favor answers involving independent supervisory approval of each refund or void, with the supervisor verifying the customer and merchandise. Answers that rely on a single employee's honesty or on after-the-fact review are weaker.

5. Detection equals analytics by employee. If asked for the best detective procedure, look for answers involving summarizing refunds and voids by employee, register, or shift, and comparing the results to peers. Also recognize review of refund documentation, matching refunds to returned goods, and investigating inventory shrinkage.

6. Watch for the "just below the threshold" clue. A scenario describing numerous refunds slightly under the approval limit is pointing toward a register disbursement scheme designed to evade supervisory review.

7. Credit card refunds are still register disbursements. The scheme does not have to involve physical cash; a refund posted to the employee's own card is a false refund.

8. Pay attention to the word "recorded." Exam writers use phrases like "a transaction was entered to account for the missing cash" to signal a register disbursement rather than larceny.

9. Eliminate distractors systematically. If an answer choice refers to vendors, invoices, or purchase orders, it belongs to billing schemes. If it refers to ghost employees or falsified hours, it is payroll. If it refers to altering payee names on checks, it is check tampering. Register disbursements involve the point of sale only.

10. Expect scenario-based questions. The exam often presents a short story about a cashier and asks you to name the scheme, identify the best control, or spot the red flag. Read for who handled the cash, whether a transaction was recorded, whether a customer was actually present, and whether a supervisor approved anything.

Quick Review Summary

- Register disbursement schemes: false refunds (including overstated refunds) and false voids.
- Key feature: cash removal is recorded on the register, so the drawer balances.
- Main side effect: inventory shrinkage.
- Best prevention: independent supervisor approval of all refunds and voids, verification of customer and merchandise, unique logins, refund thresholds, refunds returned to original payment method.
- Best detection: analyze refunds/voids by employee, register, shift, and time; investigate inventory shortages; examine refund and void documentation for forged approvals or missing support; follow up with customers.
- Remember the classification: register disbursements are a fraudulent disbursement scheme, which falls under asset misappropriation on the Fraud Tree.

Master these points, practice distinguishing the scheme types in scenario form, and you will be well prepared for any CFE question on preventing and detecting register disbursement fraud.