Methods of Obtaining Evidence

1. Why This Topic Matters

Every fraud examination ultimately rests on evidence. A brilliant theory of how a fraud occurred is worthless if the examiner cannot lawfully obtain, preserve and present proof of it. The ACFE CFE Exam (Investigation section) tests whether you understand how evidence may be gathered, which method fits which situation, and what legal and procedural limits apply. In practice, improperly obtained evidence can be excluded from court, expose the examiner or employer to civil liability (invasion of privacy, trespass, defamation) and destroy the credibility of an otherwise sound case. For the exam, this topic appears repeatedly in scenario-based questions, so mastering it earns reliable marks.

2. What "Methods of Obtaining Evidence" Means

Evidence is anything legally presented to prove or disprove a fact at issue. Methods of obtaining evidence are the techniques and legal processes a fraud examiner uses to acquire documents, data, physical items and testimony. The ACFE framework generally groups these into:

• Voluntary production – obtaining records or statements with the consent of the owner or custodian.
• Compulsory legal process – subpoenas, search warrants and court orders that force production.
• Examination of documents and records – internal books, electronic files, correspondence.
• Public records and open-source searches – government filings, court records, property records, online information.
• Interviews and admission-seeking interviews – obtaining testimonial evidence from witnesses, co-workers and suspects.
• Observation, surveillance and covert operations – watching behaviour, fixed/moving surveillance, undercover work.
• Digital forensics and data analysis – imaging devices, recovering deleted files, mining transaction data.
• Informants and confidential sources – tips from insiders or third parties.
• Physical evidence collection – seizing items, trash pulls, fingerprints, forensic document examination.

3. How Each Method Works and Its Key Rules

a) Voluntary Consent
The simplest method. An employer may generally examine company-owned records, computers and workspaces, especially where a written policy puts employees on notice that there is no expectation of privacy. Third parties (banks, vendors) may hand over records voluntarily, but many are prohibited by privacy law (e.g., financial privacy statutes) from doing so without the customer's consent or legal process. Exam point: consent must be given by someone with authority over the item; a roommate cannot consent to a search of a locked box belonging to someone else.

b) Subpoenas
A subpoena is a legal order to appear and/or produce documents. A subpoena duces tecum compels production of records; a subpoena ad testificandum compels testimony. Subpoenas are issued by courts, grand juries or authorised agencies and are the normal way to obtain records from banks, telephone companies and other third parties. Civil litigants may obtain them through discovery. Exam point: a private fraud examiner has no subpoena power on their own; they must work through counsel, a court or law enforcement.

c) Search Warrants
Issued by a judge upon a showing of probable cause, a search warrant authorises law enforcement to search a specified place and seize specified items. Warrants are used in criminal matters, are typically executed without advance notice, and must describe the place and things to be searched with particularity. Evidence outside the scope of the warrant may still be seized if it is in plain view. Exam point: warrants apply to government actors; purely private searches are generally not subject to constitutional search-and-seizure limits, but can still breach privacy and employment laws.

d) Documentary Evidence
Documents are the backbone of most fraud cases. Examiners obtain originals where possible, make copies, and maintain a chain of custody. Key practices: do not mark or alter originals, use a document log, note date, source and description of each item, and consider forensic document examination for altered or forged items. Electronic documents require forensically sound copying (bit-stream imaging) rather than simple file copying so metadata is preserved.

e) Public Records and Open Sources
Court filings, bankruptcy records, UCC filings, corporate registrations, real property records, licensing boards and social media can reveal hidden assets, undisclosed relationships, prior litigation or lifestyle inconsistent with income. These sources are lawful to access without consent because they are public, but some databases restrict use (e.g., driver and credit information). Exam point: credit reports usually require a permissible purpose and often the subject's consent.

f) Interviews
Testimonial evidence is obtained through structured interviews that move from neutral third parties, to corroborative witnesses, to co-conspirators and finally to the suspect. Interviews should be voluntary and conducted without coercion; private employers may require cooperation as a condition of employment but should avoid false imprisonment or threats. Admissions should be reduced to a signed written statement.

g) Observation, Surveillance and Covert Operations
Surveillance may be fixed (stationary), moving (tailing), or electronic. Covert operations and undercover work should be a last resort, used only when other methods have failed or are impracticable, with written authorisation from management and legal counsel, a defined objective, and strict control of informants. Entrapment, trespass and illegal recording (particularly where all-party consent is required for recording conversations) are major risks.

h) Digital Forensics and Data Analysis
Devices should be seized by trained personnel, documented, and imaged with write-blocking tools; analysis is performed on the copy, and hash values verify integrity. Data analytics (Benford's Law, duplicate testing, gap analysis, trend analysis) can identify anomalies in large data sets that point to where additional evidence should be sought.

i) Informants and Confidential Sources
Sources may be motivated by revenge, money, ego or genuine concern. Information must be independently corroborated. Protect the source's identity, document contacts, and never promise rewards without authorisation.

j) Physical Evidence and Trash Pulls
Items placed in trash for collection in a public area are generally considered abandoned and may be retrieved, but trash still on private property or in a locked container is protected. Physical items must be bagged, labelled and logged to preserve chain of custody.

4. The Golden Rules Across All Methods

• Legality first – evidence must be obtained in a manner that does not violate statutes, constitutional protections or privacy rights.
• Least intrusive method – start with documents, public records and voluntary cooperation before escalating to surveillance or covert work.
• Chain of custody – record who collected, handled and stored each item and when; any gap can render evidence inadmissible.
• Preserve originals – work from copies; keep originals secure and unaltered.
• Document everything – memoranda of interviews, evidence logs, photographs of scenes and items.
• Coordinate with counsel – especially before subpoenas, warrants, covert operations or any action that could create liability.
• Corroborate – no single source should be relied upon; testimonial evidence should be tied to documents.

5. Exam Tips: Answering Questions on Methods of Obtaining Evidence

Tip 1 – Identify who the actor is. Many questions hinge on whether the person gathering evidence is a government agent or a private examiner. Constitutional search-and-seizure rules bind government actors; private employers are governed mainly by employment policy, privacy and tort law. If the stem says the examiner is working with or at the direction of law enforcement, treat them as a government agent.

Tip 2 – Match the method to the custodian. Company records → examine directly under company authority. Third-party records (bank, phone company) → subpoena or customer consent. Suspect's home → search warrant (criminal) or consent. Public filings → free access. Choose the answer that reflects the correct legal pathway.

Tip 3 – Know your definitions precisely. Be able to distinguish subpoena duces tecum (documents) from subpoena ad testificandum (testimony), search warrant (probable cause, criminal) from court order in a civil case, and fixed from moving surveillance. Definitional questions are common and quick to answer if you know the terms.

Tip 4 – Remember "last resort" and "authorisation" language. When a question asks when undercover or covert operations are appropriate, the correct answer almost always includes: other methods have been exhausted or are impracticable, there is a clear objective, and written approval from management and legal counsel has been obtained.

Tip 5 – Chain of custody is the default answer to "what went wrong". If a scenario describes evidence being handled by several people without a log, or an original document being written on, the examiner's error relates to preservation and chain of custody.

Tip 6 – Expectation of privacy decides many search questions. Ask: did the person have a reasonable expectation of privacy? Company email on company servers with a published policy → low expectation. Personal locker with a personal lock and no policy → higher expectation. Trash at the curb → abandoned, no expectation.

Tip 7 – Eliminate answers that are illegal or unethical. Any option involving pretexting a bank for someone's financial information, recording a call where all-party consent is required and not obtained, or detaining an employee against their will is wrong, no matter how useful the evidence would be.

Tip 8 – Watch for sequence questions. The ACFE methodology moves from the general to the specific and from least intrusive to most intrusive: documents and public records first, then neutral witnesses, then corroborating witnesses, then suspects. If asked what to do "first", choose document review or public-records search rather than confronting the suspect.

Tip 9 – Favour copies in the field, originals in the vault. Questions on handling documents expect you to know that the examiner works from copies, keeps originals secure, and notes the source of every document.

Tip 10 – Read the qualifier. Words like "most appropriate", "least intrusive", "generally", "without legal process" change the correct answer. Underline them mentally before reviewing options.

6. Worked Example

Question: A fraud examiner employed by a private company suspects an accounts payable clerk of directing payments to a shell vendor. Which is the MOST appropriate first step to obtain evidence?
A. Obtain a search warrant for the clerk's home.
B. Place the clerk under moving surveillance.
C. Review the company's vendor master file and payment records.
D. Conduct an admission-seeking interview of the clerk.

Answer: C. A private examiner cannot obtain a warrant (A), surveillance is intrusive and premature (B), and the suspect is interviewed last, only after documentary evidence is assembled (D). Reviewing the company's own records is lawful, non-intrusive and the correct starting point.

7. Quick Revision Checklist

• Consent, subpoena, warrant – know who can use each and when.
• Probable cause and particularity for warrants; plain view exception.
• Private vs. government actor distinction.
• Chain of custody and evidence logs.
• Forensic imaging and hash verification for digital evidence.
• Public records as a low-risk, high-value source.
• Covert operations: last resort, written authorisation, defined goals.
• Interview order: neutral → corroborative → co-conspirator → suspect.
• Trash is abandoned only once it is outside the curtilage/in a public area.
• Always corroborate informant information.

Master these principles and you will be able to analyse almost any CFE scenario on obtaining evidence by asking three questions: Who is collecting it? Who controls it? What is the least intrusive lawful way to get it?