Assessing Behavior and Cues

Overview
Within the ACFE Fraud Examiners Manual, the section on Assessing Behavior and Cues falls under the Investigation section's "Interview Theory and Application" area. It deals with how a fraud examiner observes, interprets, and responds to the verbal and nonverbal behavior of an interview subject in order to assess the credibility of what the subject is saying. This is one of the most heavily tested areas of interviewing because it is where theory (how deception manifests) meets practice (what the examiner should actually do with what they observe).

Why Assessing Behavior and Cues Is Important
1. Interviews are the primary evidence-gathering tool. Most fraud examinations rely heavily on witness and subject interviews. Documents show what happened; interviews explain why and who. The examiner's ability to judge whether a subject is being truthful directly affects the direction and outcome of the examination.
2. Deception creates stress, and stress leaks out. When a person lies, the fear of being caught produces psychological stress. That stress is often expressed in observable ways: changes in speech, posture, gestures, and physiological reactions. Recognizing these leakages helps the examiner decide when to probe further and when to move toward admission-seeking questions.
3. It protects the innocent as well as exposes the guilty. Proper assessment helps an examiner avoid wrongly accusing a nervous but honest person. The Fraud Examiners Manual stresses that behavioral cues are indicators, not proof, and that misreading them can damage reputations and expose the organization to liability (defamation, false imprisonment, etc.).
4. It guides interview strategy. Observing behavior tells the examiner whether rapport has been established, whether the subject is becoming more or less cooperative, and whether the time is right to transition from informational questions to assessment and admission-seeking questions.

What It Is: Core Concepts
Credibility assessment, not lie detection. The examiner does not "detect lies" with certainty; the examiner assesses the likelihood of deception based on clusters of behavior. No single verbal or nonverbal cue is a reliable indicator of lying on its own.

Baseline (norming or calibrating). Before asking sensitive questions, the examiner should observe the subject's normal behavior during non-threatening, introductory questions. This establishes a baseline. Deception is suggested by a change from that baseline when sensitive topics arise, not by any behavior in isolation. A person who always fidgets is not lying simply because they fidget.

Clusters and timing. Examiners look for several cues occurring together (clusters) and occurring in response to specific, relevant questions (timing). A cue that appears consistently only when a particular subject is raised is far more meaningful than one scattered randomly.

Honest versus dishonest tendencies. According to the Manual, truthful people generally: answer directly, offer details, make spontaneous denials, show appropriate concern, and are willing to implicate others when warranted. Deceptive people generally: avoid direct answers, qualify their statements, delay, deflect, and resist clear denials.

How It Works: Verbal Cues of Deception
The Fraud Examiners Manual identifies a series of verbal clues that, especially when clustered, may indicate deception:
• Changes in speech patterns – Speaking faster or slower, higher pitch, stammering, or clearing the throat when a sensitive topic arises.
• Repetition of the question – Restating the question to buy time to fabricate an answer ("Did I ever take money from petty cash?").
• Comments regarding the interview – Remarks such as "I'm glad you asked that" or "That's a good question" used to stall.
• Selective memory – Claiming good recall of innocent matters but "not remembering" incriminating ones.
• Making excuses – Explaining why something happened before being accused ("I'm not good with numbers").
• Oaths – Phrases such as "I swear to God," "honestly," "frankly," or "to tell the truth" used to bolster credibility.
• Character testimony – "Ask anyone who knows me" or "I'm a churchgoer" rather than directly answering.
• Answering with a question – "Why would I do something like that?"
• Overuse of respect – Excessive "yes sir" or "ma'am," or flattery toward the interviewer.
• Increasingly weaker denials – An honest person's denials tend to stay firm or grow stronger; a deceptive person's denials often weaken over time.
• Failure to deny – Avoiding a direct denial through equivocation ("I can't believe you'd ask me that") rather than saying "I didn't do it."
• Avoidance of emotive words – Using softer language such as "borrow" or "take" instead of "steal," or "misplaced" instead of "lost."
• Refusal to implicate other suspects – Protecting others to avoid drawing attention to their own involvement.
• Tolerant attitudes – Expressing understanding of why someone might commit fraud ("Well, the company doesn't pay enough").
• Reluctance to terminate the interview – A guilty person may want to linger to learn what the examiner knows, whereas honest people usually want to leave once finished.
• Feigned unconcern – Acting casual or indifferent about a serious matter, sometimes with inappropriate humor.

How It Works: Nonverbal Cues of Deception
• Full-body motions – Shifting posture, turning the body away, or moving the chair back when a sensitive question is asked (a "fleeing position").
• Anatomical physical responses – Involuntary reactions such as increased heart rate, shallow breathing, sweating, flushing, or dry mouth (frequent swallowing or licking lips).
• Illustrators – Hand and arm gestures that normally accompany speech. Deceptive people often decrease illustrators because their cognitive load is high.
• Manipulators (adaptors) – Self-touching or object-touching behaviors like picking lint, playing with a pen, or rubbing hands, which increase with stress.
• Hands over the mouth – Covering the mouth or touching the face while speaking, sometimes interpreted as symbolically holding back the truth.
• Crossing arms or legs – Defensive, closed postures that may indicate discomfort.
• Grooming gestures – Straightening clothing, adjusting hair, or dusting imaginary lint.
• Genuine versus false smiles – A fake smile typically involves only the mouth; a genuine smile also engages the eyes.
• Eye contact – Changes from the baseline level of eye contact can be meaningful, but the Manual cautions that eye contact alone is an unreliable indicator and is strongly affected by culture.

Important Cautions the Exam Expects You to Know
• Nonverbal behavior must always be interpreted against the subject's own baseline and in the context of the questions being asked.
• Cultural and individual differences affect behavior. In some cultures avoiding eye contact signals respect, not deceit. Some individuals are naturally anxious, have medical conditions, or are affected by medication.
• Nervousness is not deception. Honest people are often nervous during a fraud interview simply because of the situation.
• Behavioral cues are not evidence and should never be documented or presented as proof of guilt. They are tools that help the examiner decide where to direct further questioning and when to seek admissions.
• An examiner should never accuse someone of lying solely on the basis of nonverbal behavior.
• Assessment questions are designed to provoke behavioral responses; the examiner should observe both the verbal content and the nonverbal reaction to each.

How It Fits Into the Interview Structure
The Manual's interview sequence moves from introductory questions (establishing rapport and a baseline) to informational questions, then assessment questions, closing questions, and, if appropriate, admission-seeking questions. Behavioral assessment is most active during the assessment question phase, where hypothetical and non-accusatory questions ("Why do you think someone would do this?") are used specifically to elicit verbal and nonverbal cues. The examiner's reading of these cues determines whether to proceed to the admission-seeking phase, which should only begin when there is a reasonable probability that the subject committed the act.

Exam Tips: Answering Questions on Assessing Behavior and Cues
1. Remember the golden rule: no single cue proves deception. If an answer choice says any behavior "indicates," "proves," or "establishes" that a person is lying, it is almost certainly wrong. Correct choices use language like "may indicate," "is consistent with," or "suggests."
2. Baseline first. Questions often test whether you know the examiner should observe normal behavior during non-threatening questions before interpreting changes. The key words are norming, calibrating, and baseline.
3. Know the direction of each cue. Illustrators typically decrease during deception; manipulators and grooming gestures typically increase. Denials of honest people stay strong or grow stronger; denials of deceptive people grow weaker. Honest people usually want to end the interview; deceptive people may be reluctant to leave.
4. Distinguish verbal from nonverbal. Expect questions asking you to classify a cue. Oaths, character testimony, selective memory, repetition of the question, and avoidance of emotive words are verbal. Fleeing positions, crossed arms, hands over the mouth, and anatomical responses are nonverbal.
5. Watch for "honest person" traps. A question may describe a subject who directly denies the act, provides details, and shows concern, then ask whether this suggests deception. Those are traits of truthfulness.
6. Culture and context matter. If a question involves eye contact or physical distance, the correct answer usually acknowledges cultural variation and warns against relying on eye contact alone.
7. Behavioral cues are not evidence. Any answer suggesting that the examiner should write up behavioral observations as proof, accuse the subject based on body language, or terminate the examination because of nonverbal cues is incorrect. Cues guide questioning strategy only.
8. Link cues to interview phases. Know that assessment questions are intended to provoke behavioral responses, and that admission-seeking questions should only follow when the examiner has a reasonable probability of the subject's culpability based on evidence plus behavioral assessment.
9. Read true/false items literally. Statements such as "Deceptive people tend to use emotive words like 'steal'" are false (they avoid them). Statements such as "Failure to deny can be an indicator of deception" are true.
10. Eliminate absolutes. Words like "always," "never," and "all liars" in an answer choice are red flags, because the entire premise of this topic is probabilistic assessment.

Quick Review Summary
• Credibility is assessed, not determined; cues are indicators, not proof.
• Establish a baseline, then look for clusters of changes timed to sensitive questions.
• Verbal cues: speech changes, repeating questions, comments about the interview, selective memory, excuses, oaths, character testimony, answering with questions, overuse of respect, weaker denials, failure to deny, avoiding emotive words, refusing to implicate others, tolerant attitudes, reluctance to leave, feigned unconcern.
• Nonverbal cues: full-body shifts and fleeing positions, physiological responses, fewer illustrators, more manipulators, hands over mouth, crossed arms/legs, grooming, false smiles, eye contact changes (interpreted cautiously).
• Account for culture, medical factors, and ordinary nervousness.
• Use cues to shape follow-up questions and decide when to move to admission-seeking, never as evidence of guilt.