Skimming is an 'off-book' fraud in which cash is stolen before it is recorded in the victim organization's accounting system. Because the funds never enter the books, there is no direct audit trail, which makes skimming one of the hardest asset misappropriation schemes to detect. The ACFE's Fraud Tree places skimming under Asset Misappropriation > Cash > Cash Receipts (Theft of Cash Receipts), distinguishing it from cash larceny, which involves stealing cash that has already been recorded.

Skimming schemes are generally divided into three categories. (1) Sales skimming: an employee receives payment for goods or services but does not record the sale. Common variations include unrecorded sales (ringing 'no sale' or failing to ring up the transaction), understated sales (recording a lower amount than received and pocketing the difference), theft of checks received through the mail, and off-hours or off-site sales by employees or managers. Related inventory shrinkage often accompanies sales skimming because goods leave without a matching recorded sale. (2) Receivables skimming: an employee intercepts a customer's payment on an account. To hide the resulting delinquency, the fraudster may use lapping (applying a later customer's payment to cover the earlier stolen one, creating a rolling cycle), force balances or make unauthorized adjustments, write off the account as bad debt, issue fraudulent discounts or credits, or destroy or alter statements and records. (3) Refund and other skimming: diverting incoming funds such as vendor refunds, rebates, or miscellaneous receipts before recording.

Red flags include declining revenues with stable costs, rising inventory shrinkage, unusual write-offs or credit memos, customer complaints about posted payments, excessive 'no sale' or void transactions, and employees who refuse vacations. Prevention and detection controls include segregation of duties between cash handling and recordkeeping, mandatory receipts and register use, surveillance, lockbox systems, independent reconciliation of deposits to recorded sales, periodic customer account confirmations, ratio analysis (such as gross margin and receivables aging trends), and robust hotlines to encourage tips.

Skimming is the theft of cash before it is recorded in an organization's books, making it an 'off-book' fraud that is especially difficult to detect because no audit trail exists for the missing funds. Within the CFE framework, skimming of cash receipts falls under asset misappropriation and includes unrecorded sales, understated sales, theft of incoming checks, write-off schemes, and lapping of receivables.

Prevention begins with strong internal controls built on segregation of duties. The person who receives cash should not also record transactions, reconcile accounts, or authorize write-offs. Mail should be opened by two employees, and a remittance list prepared independently of the accounts receivable function. Point-of-sale controls matter: cash registers should require a receipt for every sale, management should enforce a 'no sale without a receipt' policy, and register tapes should be reviewed. A lockbox system directs customer payments straight to the bank, bypassing employees entirely. Mandatory vacations and job rotation disrupt lapping schemes, which require continuous attention to conceal. Pre-numbered receipts, restrictive endorsements on incoming checks, and independent authorization for discounts, refunds, and account write-offs further limit opportunity. Visible oversight, including cameras at registers and surprise cash counts, deters would-be skimmers.

Detection relies on analytical and investigative techniques. Fraud examiners perform ratio analysis, comparing gross margin, inventory shrinkage, and sales trends across periods, locations, or employees; unexplained declines in revenue while costs remain steady signal unrecorded sales. Comparing physical inventory to recorded sales can expose goods sold off-book. Reviewing journal entries for unusual write-offs, credits, or adjustments to receivables may reveal concealment. Customer complaints about misapplied payments, or aging reports showing accounts slow to clear, often expose lapping. Confirming balances directly with customers and tracing deposits to the remittance list verify that recorded cash matches what was received. Finally, maintaining an anonymous hotline is one of the most effective detection tools, since tips account for the majority of fraud discoveries.

Cash larceny is the intentional taking of an employer's cash (currency or checks) after it has been recorded in the organization's books. This distinguishes it from skimming, where cash is stolen before it is recorded ('off-book' fraud). Because the money has already entered the accounting system, cash larceny is an 'on-book' scheme, making it generally easier to detect since the theft creates an imbalance between recorded receipts and actual cash on hand.

The ACFE identifies several common forms. Larceny at the point of sale occurs when an employee simply removes cash from a register or cash drawer; the register tape will show more sales than the cash counted, so perpetrators may try to conceal the shortage by altering tapes, destroying records, or recording false voids or refunds. Larceny from the deposit happens when an employee responsible for preparing or transporting the bank deposit removes cash before it reaches the bank; concealment methods include altering the deposit slip, lapping (using later receipts to cover earlier thefts), or claiming a deposit was 'in transit.' Larceny of receivables involves stealing incoming customer payments that have already been posted, then covering the gap through false discounts, write-offs, or by posting entries to suspense or other customer accounts.

Perpetrators also exploit weak controls over petty cash, unattended registers, and shared cash drawers that obscure individual accountability.

From a CFE perspective, detection focuses on reconciling register tapes to cash counts, comparing validated bank deposit slips to the receipts journal, investigating unusual shortages, reviewing journal entries to cash and receivables, and analyzing patterns of voids, refunds, and write-offs by employee. Prevention relies on segregation of duties (separating receipt, recording, deposit, and reconciliation functions), assigning individual access to cash drawers, requiring independent deposit verification, performing surprise cash counts, mandatory vacations, job rotation, and physical safeguards such as surveillance and secured storage.

Cash larceny is the intentional taking of an employer's cash (currency and checks) after it has been recorded in the accounting system. Because the funds are already on the books, larceny leaves an audit trail, which makes prevention and detection more achievable than with skimming.

Prevention centers on strong internal controls. Segregation of duties is essential: the employee who receives cash should not also record receipts, prepare deposits, or reconcile bank statements. Receipts should be deposited daily and intact, with deposit slips compared independently to the cash receipts journal and the authenticated bank receipt. Point-of-sale controls include assigning each employee a unique cash drawer and register login, requiring supervisory approval for voids, refunds, and no-sales, and performing surprise cash counts. Physical safeguards such as locked safes, limited access, surveillance cameras, and security over the deposit route reduce opportunity. Organizations should also enforce mandatory vacations, job rotation, background checks, and a clear anti-fraud policy supported by a hotline, since tips remain the leading detection method.

Detection relies on analytical and reconciliation procedures. Examiners should compare register tapes to cash on hand and to deposits, investigate cash-over-and-short patterns by employee or shift, and review journal entries to cash for unsupported adjustments. Reconciling customer payments to accounts receivable postings helps uncover lapping, where one customer's payment covers a prior theft. Deposit lags, deposits in transit that never clear, altered deposit slips, and frequent reversing entries are red flags. Trend analysis of ratios such as cash sales to total sales and refunds or voids by employee can isolate anomalies. Unexplained inventory shrinkage may also signal false refunds used to conceal larceny.

Together, these measures reduce opportunity, increase perceived detection, and allow a CFE to identify and document cash larceny schemes effectively.