Preventing and Detecting Payment Fraud

Why This Topic Matters

Payment fraud sits at the heart of the ACFE Certified Fraud Examiner (CFE) exam's Financial Transactions and Fraud Schemes section, and it is one of the most practically relevant areas you will study. Every organization moves money, and every method of moving money (checks, credit and debit cards, ACH transfers, wire transfers, mobile wallets and peer-to-peer apps) creates an opportunity for fraudsters. The ACFE's Report to the Nations consistently shows that asset misappropriation schemes involving payments (billing, check and payment tampering, expense reimbursement) are among the most common occupational frauds, and that external payment fraud such as card fraud and business email compromise costs businesses billions each year.

For the exam, this topic matters because it tests whether you can connect a scheme to the control that stops or reveals it. The CFE exam does not reward memorization alone; it rewards your ability to read a scenario and identify the most appropriate preventive or detective measure. Understanding payment fraud prevention and detection also underpins your work as a fraud examiner, because control weaknesses are where investigations begin and where remediation recommendations end.

What Payment Fraud Is

Payment fraud is any scheme in which a perpetrator uses a payment instrument or payment system to obtain funds, goods or services to which they are not entitled, or to divert legitimate payments to an unauthorized recipient. It can be committed by insiders (employees who tamper with checks, manipulate vendor master files or approve fictitious invoices), by outsiders (criminals who counterfeit cards, steal account data or impersonate executives), or by collusion between the two.

The CFE body of knowledge generally organizes payment fraud into these major categories:

1. Check Fraud
Includes forged maker signatures, forged endorsements, altered payees or amounts, counterfeit checks, check kiting (exploiting float between accounts), paperhanging (writing checks on closed accounts) and check washing (chemically removing ink). Internally, check tampering is a form of fraudulent disbursement where an employee prepares a fraudulent check or intercepts and converts a legitimate one.

2. Credit and Debit Card Fraud
Includes stolen or lost cards, counterfeit cards created from skimmed magnetic stripe data, card-not-present (CNP) fraud in online and telephone transactions, account takeover, application fraud using stolen or synthetic identities, and first-party or friendly fraud where a legitimate cardholder disputes a valid purchase. Merchants face chargebacks; issuers face losses on unauthorized transactions.

3. Electronic Funds Transfer (EFT) Fraud
Covers ACH debit and credit fraud, wire transfer fraud and online banking account takeover. ACH fraud often involves unauthorized debits against a victim's account or diverting payroll and vendor payments by changing bank account details. Wire fraud is attractive to criminals because wires settle quickly and are difficult to recall.

4. Business Email Compromise (BEC) and Social Engineering
A criminal impersonates an executive, vendor or attorney to convince an employee to initiate a payment or change remittance instructions. Variants include CEO fraud, vendor impersonation (fake invoice or changed bank details), and payroll diversion. BEC is one of the costliest categories of payment fraud reported to law enforcement.

5. Mobile and Emerging Payment Fraud
Includes fraud involving mobile wallets, peer-to-peer payment apps, prepaid cards and cryptocurrency, where speed and irreversibility of transfers, weak identity verification, and consumer unfamiliarity create exposure.

How Payment Fraud Works and How It Is Prevented

The exam expects you to understand the mechanics of each scheme well enough to match it with the right control. Controls are generally classified as preventive (designed to stop fraud before it occurs) or detective (designed to identify fraud after it has occurred so it can be stopped and investigated). Many controls serve both functions, but exam questions often ask which category a control best fits.

Core Preventive Controls

Segregation of Duties. No single individual should be able to initiate, approve, record and reconcile a payment. The person who prepares checks or enters ACH files should not sign or release them, and neither should reconcile the bank account. Where staffing is limited, compensating controls such as management review of bank statements become essential.

Dual Authorization and Approval Limits. Payments above defined thresholds require two authorized approvers. For wires and large ACH credits, banks can enforce dual control so that one user creates the transfer and a different user releases it.

Positive Pay and Payee Positive Pay. The organization transmits a file of issued checks (number, date, amount and, for payee positive pay, the payee name) to its bank. The bank compares presented checks against the file and returns or holds any exceptions. Positive pay is the single most effective anti-check-fraud service and is heavily tested. Reverse positive pay is a weaker variant where the bank sends the organization its list of presented items for approval.

ACH Blocks and Filters. An ACH debit block prevents all ACH debits from posting to an account; an ACH filter permits only debits from pre-authorized originators or within set limits. These stop unauthorized electronic withdrawals.

Vendor Master File Controls. Changes to vendor bank account details must be verified independently by calling a known contact at a phone number already on file (never a number provided in the change request email). Access to the vendor master file should be restricted, logged and periodically reviewed for duplicates, employee-matching addresses or bank accounts, and vendors with missing tax identification numbers.

Callback Verification and Out-of-Band Confirmation. Any request to transfer funds, change remittance instructions or make an urgent payment is confirmed through a separate channel. This is the primary defense against BEC.

Physical Security of Payment Instruments. Blank check stock is locked, sequentially numbered and periodically inventoried. Signature plates, stamps and check-signing software credentials are secured. Voided checks are defaced and retained. Check stock should include security features such as watermarks, microprinting, chemical-sensitive paper and void pantographs.

Card Security Technologies. EMV chip cards generate a unique cryptogram for each transaction, defeating counterfeit cards made from skimmed stripe data. For card-not-present transactions, merchants use the card verification value (CVV2/CVC2), address verification service (AVS), 3-D Secure authentication (Verified by Visa, Mastercard Identity Check), tokenization (replacing card numbers with surrogate values) and device fingerprinting. Payment Card Industry Data Security Standard (PCI DSS) compliance governs how merchants store and transmit card data.

Authentication and Access Controls. Multi-factor authentication for online banking and payment systems, strong password policies, role-based access, prompt deactivation of departed employees, and restrictions on which workstations can initiate payments all reduce account takeover risk.

Employee Training and Fraud Awareness. Staff who handle payments must recognize phishing, pressure tactics and red flags of social engineering. Training is a preventive control that strengthens every other control.

Core Detective Controls

Timely Bank Reconciliation by an Independent Person. Reconciliations should be performed promptly (ideally with daily online review of cleared items) by someone with no access to cash or check preparation. Reviewers examine cleared check images for altered payees, dual endorsements, out-of-sequence numbers, and checks payable to cash, employees or unfamiliar vendors.

Exception and Variance Reporting. Positive pay exceptions, ACH returns, reversed transactions, manual checks outside the normal run, payments just below approval thresholds, and duplicate payments should generate reports that management reviews.

Data Analytics. Fraud examiners use analytics to detect anomalies: duplicate invoice numbers or amounts, vendors sharing addresses or bank accounts with employees, round-dollar payments, payments on weekends or holidays, sequential invoice numbers from a single vendor, Benford's Law analysis of payment amounts, velocity checks (many transactions in a short time), and trend analysis of chargebacks or returns.

Transaction Monitoring and Fraud Scoring. Card issuers and payment processors use real-time systems that score each transaction against the cardholder's normal pattern (geography, merchant type, amount, device) and decline or flag outliers. Banks apply similar monitoring to online banking sessions.

Audit Trails and Log Review. Changes to vendor records, user permissions, payment templates and approval limits should be logged and reviewed. Unusual access times or unauthorized changes are red flags.

Surprise Audits and Mandatory Vacations. Unannounced reviews of payment processes and requiring employees in sensitive roles to take time off (so another person performs their duties) frequently expose ongoing schemes such as kiting or check tampering.

Hotlines and Tips. The ACFE repeatedly finds that tips are the most common method of initial detection for occupational fraud. An anonymous reporting mechanism available to employees, vendors and customers is a critical detective control.

Red Flags of Payment Fraud

For the exam, know the typical warning signs: vendor bank detail changes shortly before a large payment; invoices lacking detail or with sequential numbers; payments to vendors with post office box addresses or no physical presence; checks with dual endorsements or payable to cash; employees who refuse to take vacation or insist on handling specific vendors; urgent and confidential payment requests from executives via email; mismatches between purchase orders, receiving reports and invoices; and spikes in chargebacks, declined transactions or first-time customers placing large orders with rush shipping to a different address.

Response When Fraud Is Detected

Immediate steps include contacting the bank to attempt a recall or reversal (speed is critical for wires and ACH), freezing affected accounts, preserving evidence such as emails and logs, notifying law enforcement where appropriate, filing a complaint with relevant authorities, reviewing insurance coverage (crime or cyber policies), and conducting a root-cause analysis to remediate the control failure. Fraud examiners should document the chain of custody for all evidence.

Exam Tips: Answering Questions on Preventing and Detecting Payment Fraud

Tip 1: Match the scheme to its best control. Many questions describe a fraud and ask which control would most effectively prevent it. Think about the exact mechanism. Check with altered payee: payee positive pay. Unauthorized ACH debits: ACH debit block or filter. Vendor bank detail change via email: independent callback verification. Counterfeit card at point of sale: EMV chip. Online purchase with stolen card number: CVV, AVS, 3-D Secure. Employee preparing and signing checks: segregation of duties.

Tip 2: Distinguish preventive from detective. If a question asks for a preventive control, eliminate options such as bank reconciliation, exception reports and surprise audits, which are detective. If it asks for a detective control, eliminate segregation of duties, dual authorization and access restrictions, which are preventive. Positive pay is generally treated as preventive because it stops payment before funds leave the account.

Tip 3: Look for the words most effective, best or primary. Several answer choices may be reasonable controls, but the exam wants the one that most directly addresses the stated risk. Choose the specific control over the general one. For example, employee training helps with BEC, but out-of-band verification of payment instructions is the most direct defense.

Tip 4: Remember independence. When a question involves reconciliation or review, the correct answer almost always emphasizes that it is performed by someone independent of the payment process. An option where the check preparer also reconciles the bank statement is a deliberate wrong answer.

Tip 5: Know the terminology precisely. Be able to define positive pay, reverse positive pay, payee positive pay, ACH block versus ACH filter, check kiting versus paperhanging, card-not-present fraud, skimming, tokenization, chargeback, EMV, CVV2, AVS, 3-D Secure, PCI DSS, business email compromise and account takeover. Questions frequently hinge on one term.

Tip 6: Understand kiting mechanics. Kiting exploits the float between deposit and clearing. Red flags include frequent deposits and withdrawals of similar amounts between accounts at different banks, a high volume of checks drawn on the same accounts, and account balances that are high at the end of the day but low in collected funds. Banks detect kiting through velocity reports and by placing holds on uncollected funds.

Tip 7: Remember that speed matters in response. If a question asks about the first action after discovering a fraudulent wire or ACH, the answer is to contact the financial institution immediately to attempt recall, not to begin interviews or write a report.

Tip 8: Do not confuse the roles of parties. Understand who bears the loss and who has what duty: the drawer, drawee bank, payee and depositary bank for checks; the cardholder, issuer, merchant and acquirer for cards. Questions on liability shifts (such as the EMV liability shift to the party with the weaker technology) appear periodically.

Tip 9: Use the Fraud Triangle and ACFE statistics when relevant. If a question asks how most frauds are initially detected, the answer is tips. If it asks about the role of internal controls in prevention, connect them to reducing opportunity.

Tip 10: Read the whole scenario and eliminate systematically. CFE questions often contain distractors describing controls that address a different risk. Identify the risk first, then eliminate answers that do not touch it, and choose the most specific remaining control. Avoid absolute answers that claim a control eliminates fraud entirely; the exam favors language about reducing or mitigating risk.

Quick Review Summary

Payment fraud includes check, card, ACH, wire, BEC and mobile payment schemes committed by insiders, outsiders or both. Prevention relies on segregation of duties, dual authorization, positive pay, ACH blocks and filters, vendor master file controls, callback verification, physical security of check stock, EMV and CNP security tools, strong authentication and training. Detection relies on independent and timely reconciliation, exception reporting, data analytics, transaction monitoring, audit logs, surprise audits, mandatory vacations and hotlines. On the exam, identify the risk, decide whether a preventive or detective control is requested, select the most specific control that directly addresses that risk, and insist on independence in any review function.