Social Media Evidence: Privacy and Documentation
5 minutes
5 Questions
Social media has become a critical source of information for Certified Fraud Examiners, but its use raises important privacy and documentation concerns that must be carefully managed. Privacy Considerations: Fraud examiners must distinguish between publicly available content and information protected by privacy settings. Information a user has made public (open profiles, public posts, comments on public pages) can generally be reviewed without consent, as there is no reasonable expectation of privacy. However, examiners should never use deceptive tactics such as creating fake profiles, impersonating others, or 'friending' a subject under false pretenses to access private content—this is called pretexting and may violate laws, platform terms of service, and professional ethics (including the ACFE Code of Professional Ethics). Accessing password-protected accounts without authorization may violate statutes like the U.S. Computer Fraud and Abuse Act, the Stored Communications Act, or data protection laws such as the GDPR in Europe. Employers must also respect employee rights; many jurisdictions prohibit requiring employees or applicants to disclose social media passwords. Documentation Requirements: Social media content is volatile—posts can be edited or deleted at any moment—so proper preservation is essential for evidentiary value. Examiners should capture evidence using screenshots or specialized forensic capture tools that record the full page, URL, date, and time stamp. Metadata should be preserved where possible, and each capture should be hashed (e.g., MD5 or SHA-256) to prove integrity. A detailed log noting who collected the evidence, when, how, and from what source establishes chain of custody. Examiners should also document the context, such as surrounding posts, to avoid claims of selective presentation. For litigation, preservation letters may be sent to social media providers or the opposing party, and authentication under evidentiary rules (such as Federal Rule of Evidence 901) must be anticipated. In sum, social media evidence is valuable but must be gathered lawfully, ethically, and with meticulous documentation to withstand legal scrutiny.
Social Media Evidence: Privacy and Documentation — CFE Exam Guide (Sources of Information)
1. Why This Topic Matters
Social media has become one of the richest open sources of information available to a fraud examiner. Subjects routinely post about their lifestyle, travel, purchases, employment, relationships, and business dealings — often revealing unexplained wealth, undisclosed relationships with vendors, concealed assets, or contradictions to their sworn statements. The Fraud Examiners Manual treats social media within the Investigation section under Sources of Information, and the ACFE emphasizes two risks that go hand in hand with its value:
• Privacy risk — collecting information improperly (through deception, unauthorized access, or coercion) can expose the examiner and the client to civil liability, criminal exposure, ethics violations, and suppression of evidence.
• Documentation risk — social media content is volatile. A post can be edited, deleted, or hidden behind privacy settings within seconds. Evidence that is not captured and preserved correctly may be unusable, unauthenticated, or simply gone.
On the CFE Exam, this topic sits at the intersection of the Investigation section (sources of information, digital evidence) and the Law section (privacy statutes, admissibility) and the ACFE Code of Professional Ethics. Expect scenario-based questions that ask what a CFE may do, what a CFE must not do, and what the best practice is for preserving what is found.
2. What Social Media Evidence Is
Social media evidence is any content or metadata obtained from online platforms where users create and share information, including:
• Profile information (name, photo, employer, location, education, relationship status)
• Posts, status updates, tweets, stories, and comments
• Photographs and videos (including embedded geolocation and timestamp metadata)
• Connections (friends, followers, groups, pages liked, professional contacts on LinkedIn)
• Check-ins and location history
• Marketplace listings, business pages, and reviews
• Direct or private messages (generally not accessible to the examiner without consent or legal process)
Common platforms include Facebook, Instagram, X (Twitter), LinkedIn, TikTok, YouTube, Snapchat, Reddit, blogs, and discussion forums. The ACFE classifies publicly posted social media content as a form of open-source or public information — but the key word is publicly posted.
3. How It Works: The Privacy Dimension
3.1 Public vs. private content
The governing principle is the reasonable expectation of privacy. Information a user deliberately makes available to the general public (a public profile, a public post, a public group) carries little or no reasonable expectation of privacy, and a fraud examiner may generally view, record, and use it without consent. Content restricted by privacy settings (friends-only posts, private groups, direct messages) is different — the user has taken affirmative steps to limit access, and the examiner may not circumvent those restrictions improperly.
3.2 Pretexting and fake profiles
The single most heavily tested privacy issue is deceptive access. Creating a fictitious profile, posing as a friend or colleague, or sending a friend request under false pretenses to see restricted content is:
• A violation of nearly every platform's terms of service
• Potentially a violation of computer misuse statutes such as the U.S. Computer Fraud and Abuse Act (CFAA) and state analogues
• Prohibited for attorneys (and their agents) under bar ethics opinions in many jurisdictions
• Inconsistent with the ACFE Code of Professional Ethics, which requires CFEs to conduct themselves with the highest level of integrity and to avoid illegal or unethical conduct
The exam answer is consistent: a CFE should not use pretexting or fictitious identities to obtain private social media content.
3.3 Unauthorized account access
Logging into a subject's account with a guessed, stolen, or shared password — or accessing a device left unlocked — is unauthorized access to stored electronic communications. In the United States this implicates the Stored Communications Act (SCA) and the CFAA; many other countries have equivalent unauthorized-access laws. Evidence obtained this way is tainted and the examiner faces personal exposure.
3.4 Employer requests for passwords
Many U.S. states and other jurisdictions prohibit employers from requiring or requesting that employees or applicants disclose social media usernames or passwords, or that they log in in the employer's presence. Even where not expressly prohibited, such demands are poor practice and may violate labor protections (for example, protected concerted activity under the National Labor Relations Act in the U.S.).
3.5 Obtaining non-public content lawfully
Legitimate routes to restricted content include:
• Consent of the account holder (often the simplest route for an employee under a well-drafted policy or a cooperating party)
• Discovery in civil litigation — courts have repeatedly held that relevant social media content is discoverable from the party, even if marked private, because privacy settings do not create a privilege
• Legal process to the provider — but note the SCA generally bars providers from disclosing the contents of communications in response to a civil subpoena; content typically requires the user's consent or a government warrant, while basic subscriber information may be available through subpoena
• Platform self-service exports (for example, 'Download Your Information') obtained from the user with consent or by court order
• Information voluntarily shared by a witness who is a legitimate connection of the subject (the examiner did not deceive anyone to obtain it)
3.6 Other privacy considerations
• Avoid leaving footprints: viewing a LinkedIn profile may notify the subject; liking or commenting on a post tips off the target. Use dedicated, truthful investigative accounts and do not interact with the subject's content.
• Do not communicate with a person known to be represented by counsel about the subject of the representation.
• International investigations must consider data protection regimes such as the EU General Data Protection Regulation (GDPR), which treats social media data about identifiable individuals as personal data requiring a lawful basis for processing.
• Limit collection to what is relevant to the examination; avoid gathering sensitive data (health, religion, sexual orientation) that is unrelated to the allegation.
4. How It Works: The Documentation Dimension
4.1 Why documentation is critical
Social media is ephemeral. Users delete incriminating posts, platforms change interfaces, accounts are deactivated, and privacy settings are tightened the moment a subject learns of an inquiry. The fraud examiner must therefore capture evidence at the moment it is discovered and preserve it in a form that can later be authenticated.
4.2 Capture best practices
• Capture immediately — do not wait to come back later.
• Record the URL of every page and post captured.
• Record the date and time of capture (with time zone) and the identity of the person capturing it.
• Capture the full context: the entire page, the user's profile identifying information, surrounding comments, and the post's own timestamp — not just a cropped image.
• Use forensically sound tools where feasible: web-capture or archiving software that records the page's source code, metadata, and a hash value (e.g., MD5/SHA-256) to prove the capture has not been altered.
• Preserve original files in native format (e.g., downloaded video and image files with embedded metadata such as EXIF data and geolocation) rather than relying solely on screenshots.
• Consider using third-party archiving services or a neutral party to capture content so the examiner is not the only witness.
• Send a preservation (litigation hold) letter to the subject, the organization, and — where appropriate — the platform, demanding that content not be deleted.
4.3 Chain of custody and the investigative log
Treat social media captures like any other digital evidence:
• Maintain a chain of custody log showing who collected, handled, and stored the evidence and when.
• Keep a contemporaneous investigative log documenting search terms used, platforms searched, accounts reviewed, and results (including negative results).
• Store captures on write-protected or access-controlled media; work from copies, never the original capture.
• Never alter, annotate over, or 'clean up' a capture; annotations belong in a separate working document.
4.4 Authentication and admissibility
For social media evidence to be admitted in court, the proponent must show it is what it purports to be (in the U.S., Federal Rule of Evidence 901). Courts have excluded social media printouts where no one could link the account to the subject. Methods of authentication include:
• Testimony of the examiner who personally viewed and captured the content, describing the process
• Distinctive characteristics: photos of the subject, references to facts only the subject would know, consistent writing style, linkage to known email addresses or phone numbers
• Metadata and hash values from forensic capture tools
• Admissions by the subject (in interview or deposition) that the account and posts are theirs
• Records from the platform obtained through proper legal process, with a records custodian certification
• Testimony of a witness who received or saw the communication
Examiners should also anticipate hearsay objections and be prepared to show the statement is a party admission, is offered for a non-hearsay purpose (e.g., to show the subject was in Las Vegas on a date he claimed to be at work), or falls within an exception.
4.5 Corroboration
Social media evidence is rarely conclusive on its own. Photos can be old or staged, profiles can be impersonations, and posts can be exaggerations. Best practice is to corroborate social media findings with independent sources — public records, financial records, travel records, witness interviews — before relying on them in a report or as the basis for an admission-seeking interview.
5. Putting It Together: A Practical Workflow
1. Define the objective and the relevance of social media to the allegation.
2. Use truthful, dedicated investigative accounts; never impersonate anyone.
3. Search only publicly available content; do not circumvent privacy settings.
4. Do not interact with the subject's content (no likes, comments, follows, or messages).
5. Capture each relevant item immediately with URL, date/time, full context, and metadata or hash where possible.
6. Log the activity and maintain chain of custody.
7. Issue preservation letters and, where necessary, pursue consent, discovery, or legal process for non-public content.
8. Corroborate findings through independent sources.
9. Report findings objectively, distinguishing facts from inferences.
6. Exam Tips: Answering Questions on Social Media Evidence: Privacy and Documentation
Tip 1 — Public means usable; private means hands off (unless lawful process or consent). If a question describes content on a public profile or public post, the examiner may view and document it. If it describes friends-only content, private groups, or direct messages, the correct answer will involve consent, discovery, or legal process — never self-help.
Tip 2 — Any answer involving a fake profile, false pretenses, or pretexting is wrong. The ACFE consistently treats deceptive friending and fictitious identities as unethical and legally risky. When you see words like 'poses as', 'creates a profile under a different name', or 'sends a friend request pretending to be', eliminate that option.
Tip 3 — Unauthorized login is never acceptable. Using a password found on a sticky note, a shared company password, or an unlocked device to open the subject's personal account violates the Stored Communications Act and computer misuse laws. Watch for distractors that justify this because 'the device belonged to the company' — the account is still the employee's personal account.
Tip 4 — Employers generally cannot demand social media passwords. If a question asks whether a company may require an employee to provide login credentials or log in in front of HR, the best answer recognizes legal prohibitions and best practice against it.
Tip 5 — Know what the SCA does to subpoenas. Service providers generally may not disclose the content of communications in response to a civil subpoena; basic subscriber/account information may be available. For content, the routes are user consent, discovery directed to the party, or (for government) a warrant.
Tip 6 — Volatility drives the documentation answer. If a question asks what the examiner should do first upon finding relevant content, the answer is to capture and preserve it immediately (with URL, date, time, and full context), because it may be deleted. 'Come back later with a subpoena' or 'bookmark the page' are distractors.
Tip 7 — A bare screenshot is a weak answer; a documented, hashed, full-context capture is the strong answer. When options differ in thoroughness, choose the one that includes URL, timestamp, metadata, native files, hash values, and chain of custody.
Tip 8 — Authentication requires linking the account to the person. Questions on admissibility turn on whether the proponent can show the account and post belong to the subject — through distinctive characteristics, metadata, witness testimony, or the subject's admission. Mere possession of a printout is not enough.
Tip 9 — Do not tip off the subject. Options that involve liking, commenting, following, or messaging the subject are wrong because they compromise the investigation and may constitute improper contact.
Tip 10 — Corroborate before concluding. If a question asks whether a photo of the subject with a luxury car proves embezzlement, the answer is no — it is a lead to be corroborated with financial and public records, not proof.
Tip 11 — Think ethics plus law. Even where a tactic might be technically legal in some jurisdiction, the CFE Exam expects you to apply the ACFE Code of Professional Ethics. When in doubt, choose the option that is truthful, non-deceptive, proportionate, and well documented.
7. Quick Review Checklist
• Publicly posted content: may be viewed and used.
• Privacy-restricted content: consent, discovery, or legal process only.
• No fake profiles, no pretexting, no unauthorized logins, no password demands.
• Use dedicated truthful accounts; do not interact with the subject.
• Capture immediately: URL, date/time, full context, native files, metadata, hash.
• Maintain investigative log and chain of custody; never alter captures.
• Send preservation letters; understand SCA limits on provider subpoenas.
• Authenticate by linking account to subject; anticipate hearsay objections.
• Corroborate with independent sources before drawing conclusions.
• Consider GDPR and other data-protection laws in cross-border matters.
Social media has become one of the richest open sources of information available to a fraud examiner. Subjects routinely post about their lifestyle, travel, purchases, employment, relationships, and business dealings — often revealing unexplained wealth, undisclosed relationships with vendors, concealed assets, or contradictions to their sworn statements. The Fraud Examiners Manual treats social media within the Investigation section under Sources of Information, and the ACFE emphasizes two risks that go hand in hand with its value:
• Privacy risk — collecting information improperly (through deception, unauthorized access, or coercion) can expose the examiner and the client to civil liability, criminal exposure, ethics violations, and suppression of evidence.
• Documentation risk — social media content is volatile. A post can be edited, deleted, or hidden behind privacy settings within seconds. Evidence that is not captured and preserved correctly may be unusable, unauthenticated, or simply gone.
On the CFE Exam, this topic sits at the intersection of the Investigation section (sources of information, digital evidence) and the Law section (privacy statutes, admissibility) and the ACFE Code of Professional Ethics. Expect scenario-based questions that ask what a CFE may do, what a CFE must not do, and what the best practice is for preserving what is found.
2. What Social Media Evidence Is
Social media evidence is any content or metadata obtained from online platforms where users create and share information, including:
• Profile information (name, photo, employer, location, education, relationship status)
• Posts, status updates, tweets, stories, and comments
• Photographs and videos (including embedded geolocation and timestamp metadata)
• Connections (friends, followers, groups, pages liked, professional contacts on LinkedIn)
• Check-ins and location history
• Marketplace listings, business pages, and reviews
• Direct or private messages (generally not accessible to the examiner without consent or legal process)
Common platforms include Facebook, Instagram, X (Twitter), LinkedIn, TikTok, YouTube, Snapchat, Reddit, blogs, and discussion forums. The ACFE classifies publicly posted social media content as a form of open-source or public information — but the key word is publicly posted.
3. How It Works: The Privacy Dimension
3.1 Public vs. private content
The governing principle is the reasonable expectation of privacy. Information a user deliberately makes available to the general public (a public profile, a public post, a public group) carries little or no reasonable expectation of privacy, and a fraud examiner may generally view, record, and use it without consent. Content restricted by privacy settings (friends-only posts, private groups, direct messages) is different — the user has taken affirmative steps to limit access, and the examiner may not circumvent those restrictions improperly.
3.2 Pretexting and fake profiles
The single most heavily tested privacy issue is deceptive access. Creating a fictitious profile, posing as a friend or colleague, or sending a friend request under false pretenses to see restricted content is:
• A violation of nearly every platform's terms of service
• Potentially a violation of computer misuse statutes such as the U.S. Computer Fraud and Abuse Act (CFAA) and state analogues
• Prohibited for attorneys (and their agents) under bar ethics opinions in many jurisdictions
• Inconsistent with the ACFE Code of Professional Ethics, which requires CFEs to conduct themselves with the highest level of integrity and to avoid illegal or unethical conduct
The exam answer is consistent: a CFE should not use pretexting or fictitious identities to obtain private social media content.
3.3 Unauthorized account access
Logging into a subject's account with a guessed, stolen, or shared password — or accessing a device left unlocked — is unauthorized access to stored electronic communications. In the United States this implicates the Stored Communications Act (SCA) and the CFAA; many other countries have equivalent unauthorized-access laws. Evidence obtained this way is tainted and the examiner faces personal exposure.
3.4 Employer requests for passwords
Many U.S. states and other jurisdictions prohibit employers from requiring or requesting that employees or applicants disclose social media usernames or passwords, or that they log in in the employer's presence. Even where not expressly prohibited, such demands are poor practice and may violate labor protections (for example, protected concerted activity under the National Labor Relations Act in the U.S.).
3.5 Obtaining non-public content lawfully
Legitimate routes to restricted content include:
• Consent of the account holder (often the simplest route for an employee under a well-drafted policy or a cooperating party)
• Discovery in civil litigation — courts have repeatedly held that relevant social media content is discoverable from the party, even if marked private, because privacy settings do not create a privilege
• Legal process to the provider — but note the SCA generally bars providers from disclosing the contents of communications in response to a civil subpoena; content typically requires the user's consent or a government warrant, while basic subscriber information may be available through subpoena
• Platform self-service exports (for example, 'Download Your Information') obtained from the user with consent or by court order
• Information voluntarily shared by a witness who is a legitimate connection of the subject (the examiner did not deceive anyone to obtain it)
3.6 Other privacy considerations
• Avoid leaving footprints: viewing a LinkedIn profile may notify the subject; liking or commenting on a post tips off the target. Use dedicated, truthful investigative accounts and do not interact with the subject's content.
• Do not communicate with a person known to be represented by counsel about the subject of the representation.
• International investigations must consider data protection regimes such as the EU General Data Protection Regulation (GDPR), which treats social media data about identifiable individuals as personal data requiring a lawful basis for processing.
• Limit collection to what is relevant to the examination; avoid gathering sensitive data (health, religion, sexual orientation) that is unrelated to the allegation.
4. How It Works: The Documentation Dimension
4.1 Why documentation is critical
Social media is ephemeral. Users delete incriminating posts, platforms change interfaces, accounts are deactivated, and privacy settings are tightened the moment a subject learns of an inquiry. The fraud examiner must therefore capture evidence at the moment it is discovered and preserve it in a form that can later be authenticated.
4.2 Capture best practices
• Capture immediately — do not wait to come back later.
• Record the URL of every page and post captured.
• Record the date and time of capture (with time zone) and the identity of the person capturing it.
• Capture the full context: the entire page, the user's profile identifying information, surrounding comments, and the post's own timestamp — not just a cropped image.
• Use forensically sound tools where feasible: web-capture or archiving software that records the page's source code, metadata, and a hash value (e.g., MD5/SHA-256) to prove the capture has not been altered.
• Preserve original files in native format (e.g., downloaded video and image files with embedded metadata such as EXIF data and geolocation) rather than relying solely on screenshots.
• Consider using third-party archiving services or a neutral party to capture content so the examiner is not the only witness.
• Send a preservation (litigation hold) letter to the subject, the organization, and — where appropriate — the platform, demanding that content not be deleted.
4.3 Chain of custody and the investigative log
Treat social media captures like any other digital evidence:
• Maintain a chain of custody log showing who collected, handled, and stored the evidence and when.
• Keep a contemporaneous investigative log documenting search terms used, platforms searched, accounts reviewed, and results (including negative results).
• Store captures on write-protected or access-controlled media; work from copies, never the original capture.
• Never alter, annotate over, or 'clean up' a capture; annotations belong in a separate working document.
4.4 Authentication and admissibility
For social media evidence to be admitted in court, the proponent must show it is what it purports to be (in the U.S., Federal Rule of Evidence 901). Courts have excluded social media printouts where no one could link the account to the subject. Methods of authentication include:
• Testimony of the examiner who personally viewed and captured the content, describing the process
• Distinctive characteristics: photos of the subject, references to facts only the subject would know, consistent writing style, linkage to known email addresses or phone numbers
• Metadata and hash values from forensic capture tools
• Admissions by the subject (in interview or deposition) that the account and posts are theirs
• Records from the platform obtained through proper legal process, with a records custodian certification
• Testimony of a witness who received or saw the communication
Examiners should also anticipate hearsay objections and be prepared to show the statement is a party admission, is offered for a non-hearsay purpose (e.g., to show the subject was in Las Vegas on a date he claimed to be at work), or falls within an exception.
4.5 Corroboration
Social media evidence is rarely conclusive on its own. Photos can be old or staged, profiles can be impersonations, and posts can be exaggerations. Best practice is to corroborate social media findings with independent sources — public records, financial records, travel records, witness interviews — before relying on them in a report or as the basis for an admission-seeking interview.
5. Putting It Together: A Practical Workflow
1. Define the objective and the relevance of social media to the allegation.
2. Use truthful, dedicated investigative accounts; never impersonate anyone.
3. Search only publicly available content; do not circumvent privacy settings.
4. Do not interact with the subject's content (no likes, comments, follows, or messages).
5. Capture each relevant item immediately with URL, date/time, full context, and metadata or hash where possible.
6. Log the activity and maintain chain of custody.
7. Issue preservation letters and, where necessary, pursue consent, discovery, or legal process for non-public content.
8. Corroborate findings through independent sources.
9. Report findings objectively, distinguishing facts from inferences.
6. Exam Tips: Answering Questions on Social Media Evidence: Privacy and Documentation
Tip 1 — Public means usable; private means hands off (unless lawful process or consent). If a question describes content on a public profile or public post, the examiner may view and document it. If it describes friends-only content, private groups, or direct messages, the correct answer will involve consent, discovery, or legal process — never self-help.
Tip 2 — Any answer involving a fake profile, false pretenses, or pretexting is wrong. The ACFE consistently treats deceptive friending and fictitious identities as unethical and legally risky. When you see words like 'poses as', 'creates a profile under a different name', or 'sends a friend request pretending to be', eliminate that option.
Tip 3 — Unauthorized login is never acceptable. Using a password found on a sticky note, a shared company password, or an unlocked device to open the subject's personal account violates the Stored Communications Act and computer misuse laws. Watch for distractors that justify this because 'the device belonged to the company' — the account is still the employee's personal account.
Tip 4 — Employers generally cannot demand social media passwords. If a question asks whether a company may require an employee to provide login credentials or log in in front of HR, the best answer recognizes legal prohibitions and best practice against it.
Tip 5 — Know what the SCA does to subpoenas. Service providers generally may not disclose the content of communications in response to a civil subpoena; basic subscriber/account information may be available. For content, the routes are user consent, discovery directed to the party, or (for government) a warrant.
Tip 6 — Volatility drives the documentation answer. If a question asks what the examiner should do first upon finding relevant content, the answer is to capture and preserve it immediately (with URL, date, time, and full context), because it may be deleted. 'Come back later with a subpoena' or 'bookmark the page' are distractors.
Tip 7 — A bare screenshot is a weak answer; a documented, hashed, full-context capture is the strong answer. When options differ in thoroughness, choose the one that includes URL, timestamp, metadata, native files, hash values, and chain of custody.
Tip 8 — Authentication requires linking the account to the person. Questions on admissibility turn on whether the proponent can show the account and post belong to the subject — through distinctive characteristics, metadata, witness testimony, or the subject's admission. Mere possession of a printout is not enough.
Tip 9 — Do not tip off the subject. Options that involve liking, commenting, following, or messaging the subject are wrong because they compromise the investigation and may constitute improper contact.
Tip 10 — Corroborate before concluding. If a question asks whether a photo of the subject with a luxury car proves embezzlement, the answer is no — it is a lead to be corroborated with financial and public records, not proof.
Tip 11 — Think ethics plus law. Even where a tactic might be technically legal in some jurisdiction, the CFE Exam expects you to apply the ACFE Code of Professional Ethics. When in doubt, choose the option that is truthful, non-deceptive, proportionate, and well documented.
7. Quick Review Checklist
• Publicly posted content: may be viewed and used.
• Privacy-restricted content: consent, discovery, or legal process only.
• No fake profiles, no pretexting, no unauthorized logins, no password demands.
• Use dedicated truthful accounts; do not interact with the subject.
• Capture immediately: URL, date/time, full context, native files, metadata, hash.
• Maintain investigative log and chain of custody; never alter captures.
• Send preservation letters; understand SCA limits on provider subpoenas.
• Authenticate by linking account to subject; anticipate hearsay objections.
• Corroborate with independent sources before drawing conclusions.
• Consider GDPR and other data-protection laws in cross-border matters.
Test mode:
CFE - Social Media Evidence: Privacy and Documentation Example Questions
Test your knowledge of Social Media Evidence: Privacy and Documentation
Question 1
When a legitimate connection of the subject voluntarily shares the subject's privacy-restricted social media posts with a fraud examiner, using that content is generally lawful.
Question 2
During a predicated examination of an accounts payable clerk suspected of a shell company scheme, a co-worker who is a friends-only connection of the clerk volunteers a screenshot of one of the clerk's posts. The fraud examiner then considers asking the co-worker to keep watching the clerk's friends-only posts and to forward any new ones. Which privacy issue does this plan raise?
Question 3
Which of the following BEST describes the privacy principle that governs a fraud examiner's collection of evidence from social media sites?
Unlock Premium Access
Certified Fraud Examiner (CFE)
- Access to ALL Certifications: Study for any certification on our platform with one subscription
- 3404 Superior-grade Certified Fraud Examiner (CFE) practice questions
- Unlimited practice tests across all certifications
- Detailed explanations for every question
- CFE: 5 full exams plus all other certification exams
- 30-Day Money-Back Guarantee: Full refund within 30 days if unsatisfied
- Risk-Free: 7-day free trial with all premium features!
More Social Media Evidence: Privacy and Documentation questions
19 questions (total)