Preventing and Detecting Financial Institution Fraud

Why This Topic Matters

Financial institutions sit at the center of the economy, and they are a prime target for fraud precisely because that is where the money is. Banks, credit unions, savings institutions, and other deposit-taking organizations handle enormous volumes of cash, loans, wire transfers, and customer data every day. When fraud occurs, the losses are rarely limited to the institution itself: depositors, borrowers, shareholders, insurers, and ultimately taxpayers can all bear the cost. Regulators therefore impose strict expectations on how institutions prevent, detect, and report fraud.

For the CFE exam, this topic appears in the Financial Transactions and Fraud Schemes section. The ACFE expects candidates to know not only the schemes that attack financial institutions (loan fraud, embezzlement, new account fraud, check and wire fraud, ATM fraud, real estate fraud) but also the specific controls and red flags that stop or reveal them. Questions in this area tend to be practical: given a situation, which control would have prevented the loss, or which warning sign should have triggered an investigation? Mastering this material also builds the mindset a fraud examiner needs in any banking engagement.

What Is Prevention and Detection of Financial Institution Fraud?

Prevention refers to the policies, procedures, and internal controls designed to stop fraud before it happens or to make it so difficult and risky that a would-be fraudster is deterred. Detection refers to the mechanisms that identify fraud that has already occurred or is in progress, so that losses can be stopped early and the matter reported to management, the board, and, where required, regulators and law enforcement.

In the financial institution context, both are shaped by three forces working together:

1. Regulatory requirements – such as anti-money laundering (AML) laws, know-your-customer (KYC) and customer due diligence (CDD) rules, suspicious activity reporting, and record-keeping obligations. In the United States these flow from the Bank Secrecy Act and related rules; most jurisdictions have equivalents.
2. Governance and culture – the tone set by the board and senior management, the independence of internal audit and the audit committee, and a code of conduct that is actually enforced.
3. Operational internal controls – the day-to-day procedures over loans, deposits, cash, payments, accounts, and employees that make up the institution's first line of defense.

How It Works: The Prevention Side

1. Governance and Oversight
Fraud prevention starts at the top. The board of directors, or a committee of the board, should approve written fraud and risk policies, review significant loan approvals, monitor insider transactions, and receive regular reports from internal audit and compliance. Many major bank failures involving fraud were traceable to dominant executives operating with weak board oversight. An independent audit committee that can meet privately with internal and external auditors is a key safeguard. A written code of ethics, with annual acknowledgment by all employees, and a conflict-of-interest policy that requires disclosure of outside business interests are standard expectations.

2. Employee Controls
Because insiders have access and knowledge, employee-related controls are heavily emphasized:
• Background checks on new hires, including criminal, credit, and employment history where legally permitted, since financial institutions place employees in positions of trust.
• Segregation of duties so that no single person can initiate, approve, record, and reconcile a transaction. For example, the employee who approves a loan should not also disburse the funds or post payments.
• Dual control over cash vaults, night depositories, dormant accounts, safe deposit areas, wire transfer rooms, and negotiable instrument stock.
• Mandatory vacations and job rotation. Many embezzlements are concealed by employees who refuse to take time off; requiring a continuous absence of one or two weeks, during which someone else performs the duties, allows lapping and other concealment schemes to surface.
• Monitoring of employee accounts and restrictions on employees processing transactions on their own or relatives' accounts.
• Fraud awareness training so that staff can recognize red flags in customers, colleagues, and transactions.

3. Loan Controls
Loan fraud produces the largest losses in financial institutions, so lending controls are a core exam topic:
• Written lending policies with defined approval authorities and limits, and loan committee review for larger credits.
• Independent verification of borrower information: income, employment, tax returns, financial statements, and the existence and value of collateral.
• Independent appraisals ordered by the institution, not the borrower or loan officer, performed by qualified appraisers who are rotated. Appraisal review by someone other than the originating officer is essential.
• Separation of loan origination, approval, disbursement, servicing, and collection functions.
• Limits on insider lending and requirements that loans to directors, officers, and their related interests be approved by the board on terms no more favorable than those offered to the public.
• Independent loan review that periodically re-examines loan files, concentrations, documentation, and payment performance.
• Controls over loan disbursement to ensure proceeds go to the stated purpose, and controls over loan modifications, renewals, and extensions, which are frequently used to hide non-performing or fictitious loans.

4. Deposit, Account, and Cash Controls
• New account procedures: positive identification of the customer, verification of addresses and identification documents, checking against fraud databases and prior account-closure records, and holds on deposited items for new customers. New account fraud is prevented largely at the account-opening desk.
• Know your customer and customer due diligence: understanding the expected nature and volume of a customer's activity so that deviations can be spotted; enhanced due diligence for higher-risk customers such as politically exposed persons, cash-intensive businesses, and correspondent accounts.
• Dormant account controls: flagging accounts with no customer activity, requiring dual authorization for transactions, and sending statements to independently verified addresses, because dormant accounts are a favorite target for employee embezzlement.
• Teller controls: individual cash drawers, cash limits, surprise cash counts, supervisory override requirements, and review of teller cash differences.
• Suspense and general ledger account controls: regular reconciliation and aging of items in suspense, clearing, and inter-branch accounts, since fraudsters use these to park stolen funds.

5. Payment and Transfer Controls
• Check fraud: positive pay and payee positive pay services, check stock security features, signature verification, and holds on large or unusual deposits.
• Wire transfer controls: written authorization procedures, callback verification to a pre-established phone number for customer-initiated wires, dual authorization for wires above a threshold, separation of wire initiation from verification and release, daily reconciliation of wire activity, and restricted physical and system access to the wire room.
• ATM and card controls: PIN security, transaction limits, monitoring for unusual patterns, chip technology, and inspection of machines for skimming devices.
• Electronic banking: multi-factor authentication, transaction monitoring, and customer education about phishing and account takeover.

6. Information Technology Controls
Logical access controls, user ID and password management, prompt removal of terminated employees' access, audit trails of system changes, and review of exception and override reports all support fraud prevention. Access should be granted on a need-to-know basis, and system administrators should not be able to process financial transactions.

How It Works: The Detection Side

No prevention program is perfect, so institutions must actively look for fraud. Detection relies on knowing red flags, using analytical tools, and having reporting channels.

1. Red Flags of Loan Fraud
• Loans with inadequate or missing documentation, unsigned notes, or missing appraisals and title work.
• Frequent renewals, extensions, or restructuring without additional collateral or principal reduction (evergreening).
• Loan proceeds disbursed to parties other than the borrower, or used for a purpose different from the stated one.
• A high concentration of loans originated by one officer, especially to a small group of borrowers or related parties.
• Borrowers who always deal with the same officer and resist contact with anyone else.
• Appraisals from the same appraiser repeatedly, or appraisals that seem inflated relative to comparable properties.
• Loans to out-of-area borrowers with no logical connection to the institution.
• Payments made in cash, or payments made from the proceeds of other loans at the institution (a sign of nominee or linked loans).
• Loan officers living beyond their means, or an officer who is a dominant personality that others are reluctant to question.

2. Red Flags of Embezzlement
• Employees who never take vacation, work unusual hours, or refuse promotions or transfers.
• Unexplained shortages or overages in teller cash, suspense accounts, or general ledger accounts.
• Customer complaints about missing deposits or unauthorized transactions, particularly from elderly customers or dormant account holders.
• Unusual activity in dormant accounts, or changes of address immediately followed by withdrawals.
• Frequent supervisory overrides, forced balancing, or manual adjustments by the same employee.
• Employee lifestyle inconsistent with compensation.
• Missing or altered documents, or reconciliations performed late or by the person who controls the asset.

3. Red Flags of New Account and Deposit Fraud
• Identification that appears altered, is inconsistent, or cannot be verified.
• A customer who opens an account with a small deposit, then deposits large checks and immediately requests withdrawals or wires.
• Reluctance to provide information, or information that conflicts with public records.
• Deposits of checks drawn on new or out-of-area accounts, or multiple accounts opened by the same person at different branches.
• Kiting patterns: frequent deposits of checks drawn on other banks followed by withdrawals before the checks clear, with balances that swing dramatically.

4. Red Flags of Money Laundering and Suspicious Activity
• Structuring cash transactions just under reporting thresholds.
• Activity inconsistent with the customer's stated business or profile.
• Rapid movement of funds in and out of accounts with no apparent business purpose.
• Reluctance to provide information required for reporting, or requests to be exempted from reporting.
• Numerous wire transfers to or from high-risk jurisdictions.

5. Detection Tools and Techniques
• Data analytics and exception reports: reports of loans past due, loans with frequent renewals, address changes, dormant account activity, employee account activity, overrides, large cash transactions, and kiting suspect reports. Reviewing these reports regularly, by someone independent of the activity, is a primary detection method.
• Reconciliations of all general ledger, suspense, correspondent, and inter-branch accounts, with aged items investigated.
• Surprise audits and cash counts at branches, vaults, and ATMs.
• Internal audit with direct reporting to the audit committee and a risk-based plan that covers lending, deposits, wire transfers, and IT.
• Loan review that samples files, confirms collateral, and tests payment sources.
• Confirmation of loan and deposit balances directly with customers, which can reveal fictitious loans or unauthorized withdrawals.
• Hotlines and whistleblower channels, since tips remain the most common way fraud is detected across all industries, including financial services.
• Transaction monitoring systems that flag patterns of structuring, unusual wires, and account takeover.
• Suspicious activity reporting: institutions must file reports with the appropriate financial intelligence unit when they detect known or suspected fraud, insider abuse, money laundering, or other suspicious transactions. In the United States this is the Suspicious Activity Report (SAR); other countries have equivalent suspicious transaction reports. Insider abuse by employees typically must be reported regardless of amount, while non-insider suspicious activity is reported above set thresholds. Institutions must not inform the subject that a report has been filed.

Putting It Together

A strong program follows a logical chain: tone at the top and policy set expectations; hiring controls keep high-risk individuals out; segregation of duties, dual control, and authorization limits make fraud hard to commit alone; KYC and verification stop outsiders at the door; mandatory vacations, reconciliations, exception reports, audits, and hotlines reveal what gets through; and suspicious activity reporting ensures regulators and law enforcement are informed. On the exam, you are frequently asked to identify which link in this chain was missing or which one would be the most effective fix.

Exam Tips: Answering Questions on Preventing and Detecting Financial Institution Fraud

Tip 1 – Match the control to the scheme. Many questions describe a scheme and ask for the best control. Build mental pairings: loan fraud to independent appraisals, loan review, and separation of origination from disbursement; embezzlement to mandatory vacations, job rotation, dual control, and surprise counts; new account fraud to identity verification and holds on new-customer deposits; check kiting to monitoring of uncollected funds and kiting suspect reports; wire fraud to callback verification and dual authorization; dormant account theft to dual authorization and address-change controls.

Tip 2 – Know the difference between preventive and detective controls. If the question asks how to prevent something, choose controls that act before the transaction: approval limits, segregation of duties, verification, dual control, access restrictions. If it asks how to detect, choose controls that act afterward: reconciliations, exception reports, audits, confirmations, hotlines, surprise cash counts. Mandatory vacation is interesting because it functions as both a deterrent and a detection mechanism; the ACFE generally frames it as a way to uncover concealed schemes.

Tip 3 – Remember that independence is the key word. When several answers seem plausible, the one that introduces an independent party (independent appraiser, independent loan review, internal audit reporting to the audit committee, reconciliation by someone who does not handle the asset) is usually correct.

Tip 4 – Memorize the classic red flags. Expect questions that describe a loan officer who refuses to take vacation, handles a concentrated portfolio, and renews loans repeatedly, then ask what is indicated. Recognize evergreening, nominee loans, linked financing, and lifestyle red flags immediately.

Tip 5 – Understand suspicious activity reporting rules in principle. Know that institutions are required to report known or suspected criminal activity and insider abuse, that insider abuse by an employee is generally reportable regardless of amount, that the subject must not be tipped off, and that filing institutions are typically protected from liability for good-faith reports. Exam questions may be framed generically rather than by a specific country's law, so focus on the concepts.

Tip 6 – Think like the fraud examiner, not the auditor. The CFE exam wants the answer that most directly addresses fraud risk. A general accounting control might be acceptable but a fraud-specific control (such as verifying collateral exists, or confirming balances directly with customers) will often be the better answer.

Tip 7 – Watch for absolutes and best-answer wording. Questions often ask for the most effective or best control. Eliminate options that address only part of the problem or that rely on the same person who could commit the fraud. Be careful with statements that say a control eliminates fraud; no control eliminates fraud, it reduces risk.

Tip 8 – Connect to the broader manual. The financial institution chapter builds on general internal control concepts from the Fraud Prevention and Deterrence section and on the embezzlement and loan fraud schemes covered earlier in the Financial Transactions section. If a question mixes topics, apply the general principle (segregation, dual control, independent review) in the banking context.

Sample Question Walkthrough

A loan officer at a community bank has originated 40 percent of the institution's commercial real estate loans. Several of these loans have been renewed multiple times without principal reduction, and all appraisals were performed by the same appraiser chosen by the officer. Which of the following controls would most effectively address this risk?

Options might include increasing the officer's lending authority, requiring the officer to attend ethics training, implementing independent loan review with appraisals ordered by a separate department, or increasing the frequency of teller cash counts. The correct choice is independent loan review with institution-ordered appraisals, because it introduces independent verification of both the credit quality and the collateral value, directly targeting the red flags of concentration, evergreening, and appraiser capture. Teller counts address a different risk, ethics training does not change the officer's unchecked control, and increasing authority worsens the problem.

Final Review Checklist

Before the exam, make sure you can:
• List the key preventive controls for lending, deposits, cash, wires, and employees.
• Explain why mandatory vacations, job rotation, dual control, and segregation of duties matter in a bank.
• Recite red flags of loan fraud, embezzlement, new account fraud, kiting, and money laundering.
• Describe the role of the board, audit committee, internal audit, and loan review.
• State the basic obligations and protections around suspicious activity reporting.
• Distinguish preventive from detective controls and choose the most independent option in scenario questions.

If you can do each of these confidently, you are well prepared for the Preventing and Detecting Financial Institution Fraud questions on the CFE exam.