Cash register disbursement schemes are a category of fraudulent disbursements within asset misappropriation in which an employee uses the cash register to conceal the removal of cash. Unlike skimming or cash larceny, where money is taken without a corresponding register entry, register disbursement schemes involve recording a false transaction that makes the removal of cash appear legitimate. Because the register's recorded sales and the cash on hand are expected to reconcile, the fraudster creates a record that justifies the missing funds. The two primary types are false refunds and false voids. In a false refund scheme, the employee processes a fictitious return of merchandise or overstates a legitimate refund, then takes the cash associated with the refund. Since no goods are actually returned, inventory records become overstated relative to physical inventory, creating a shrinkage problem. A credit card refund variation directs the refund to the perpetrator's own card. In a false void scheme, the employee rings up a legitimate sale, collects payment from the customer, then voids the transaction after the customer leaves and pockets the cash. The employee typically retains the customer's receipt to support the void, since supervisors often require a receipt to approve voided sales. Perpetrators may forge supervisor approval or exploit lax oversight. Concealment relies on keeping refunds and voids small enough to avoid attention and may involve destroying records or altering register tapes. Red flags include a high volume of refunds or voids by a particular employee, refunds processed outside business hours, missing register tapes, inventory shrinkage not explained by sales, and refunds that cluster just below approval thresholds. Prevention and detection controls include requiring independent supervisor approval for all refunds and voids, maintaining complete register documentation, analyzing refund and void patterns by employee, reconciling inventory to sales, having customers sign refund slips, and conducting surprise cash counts. These schemes are typically small per incident but can accumulate substantially over time.

Register disbursement schemes occur when an employee makes a fraudulent entry at the cash register that causes cash to be removed, typically through false refunds or false voids. Unlike skimming or cash larceny, these schemes leave a documentary trail, so the register appears to balance even though cash has been stolen. Because of this, prevention and detection focus on controls over the refund and void processes and on analyzing register data for anomalies.

Prevention centers on segregation of duties and supervisory approval. Refunds and voids above a set threshold should require management authorization, and the approving manager should physically verify the returned merchandise and the original receipt before signing off. Voided transactions should be supported by the original receipt, and the register tape should show who processed the void. Organizations should limit which employees have refund privileges, require unique user IDs and passwords so transactions can be traced to specific individuals, and maintain adequate separation between the person processing a refund and the person reconciling the register. Customer receipts should be issued for all returns, and customers should be encouraged to retain them. Surveillance cameras positioned at registers also deter misconduct.

Detection relies heavily on analytical review of register activity. Examiners should look for an unusually high number or dollar value of refunds or voids by a particular employee, register, or shift, and compare these rates across locations and time periods. Refunds just below approval thresholds, multiple refunds to the same customer or credit card, refunds processed when no corresponding sale exists, and voids clustered at particular times may indicate fraud. Inventory shrinkage that correlates with high refund activity is another red flag, since fictitious refunds inflate inventory records without any merchandise being returned. Reviewing refund documentation for missing receipts, forged signatures, or fictitious customer information, and periodically contacting customers to confirm returns, can confirm suspicions. Surprise register counts and rotation of employees further strengthen detection efforts.

Payment tampering schemes (often called check tampering, though they now include electronic payment tampering) are a form of fraudulent disbursement in which an employee physically or electronically alters, forges, intercepts, or improperly issues a payment drawn on the organization's accounts. Unlike billing or expense schemes, where the fraudster relies on others to approve and issue a payment, in payment tampering the perpetrator personally prepares or manipulates the payment instrument itself, making it the most direct form of asset misappropriation involving disbursements.

The ACFE Fraud Tree identifies five main subcategories. First, forged maker schemes occur when an employee without signature authority prepares a check and forges the authorized signer's signature. Second, forged endorsement schemes involve intercepting a check made payable to a third party and endorsing it in that payee's name (or as a dual endorsement) to convert it. Third, altered payee schemes involve changing the payee name on a legitimately signed check, often by inserting a new name, using erasable ink, or exploiting blank checks. Fourth, concealed check schemes occur when a fraudster slips a fraudulent check into a stack of legitimate checks for an authorized signer who does not review them carefully. Fifth, authorized maker schemes are committed by employees who have signature authority and simply write checks to themselves, to accomplices, or to pay personal expenses. Electronic variations include altering ACH or wire payment details, redirecting vendor banking information, or initiating unauthorized online transfers.

Concealment is central to these schemes. Common methods include falsifying the check register, forcing bank reconciliations, miscoding payments to expense accounts, destroying or altering cancelled checks, and re-altering checks after they clear. Red flags include missing or out-of-sequence checks, excessive voided checks, payees that match employee names or addresses, unexplained reconciling items, and checks with dual endorsements.

Prevention relies on segregation of duties between check preparation, signing, and reconciliation; secure check stock; positive pay services; dual signatures above thresholds; independent bank reconciliations; and vendor master file controls.

Payment tampering (often called check tampering, though it now includes electronic payments) is a fraudulent disbursement scheme in which an employee prepares a fraudulent payment, intercepts a legitimate payment intended for a third party, or converts an organizational payment to his or her own benefit. Common forms include forged maker schemes, forged endorsements, altered payees, concealed checks, and authorized maker schemes, as well as unauthorized ACH or wire transfers.

Prevention centers on segregation of duties and controlling access. No single employee should be able to request, approve, prepare, sign, and reconcile payments. Blank check stock should be stored in a locked, access-controlled area, pre-numbered, and periodically inventoried. Signature plates, stamps, and online banking credentials must be secured, with multi-factor authentication and dual authorization for electronic transfers above set thresholds. Signatories should never sign blank checks or sign without reviewing supporting documentation, and dual signatures should be required for large amounts. Bank reconciliations must be performed by someone independent of the disbursement function, and bank statements should be delivered unopened to that person. Positive pay and ACH debit blocks/filters allow the bank to reject items that do not match the issued-payment file. Finally, rotating duties, mandatory vacations, and a fraud hotline reduce opportunity and increase perception of detection.

Detection relies on analytical and review procedures. Examiners should scrutinize cancelled checks and images for altered payees, dual endorsements, endorsements by employees, or signatures that differ from authorized ones. Reviewing the check register for out-of-sequence or voided checks, gaps, payments to unfamiliar or cash payees, round-dollar amounts, and duplicate payments is essential. Comparing payees on cleared checks with payees in the disbursement journal reveals altered or substituted names. Data analytics can flag vendor addresses matching employee addresses, unusual approval patterns, or payments just below approval limits. Unexplained reconciling items, stale outstanding checks, and vendor complaints about non-payment are additional red flags warranting investigation.

Billing schemes are a category of fraudulent disbursements within asset misappropriation, as classified in the ACFE Fraud Tree. In a billing scheme, the perpetrator causes the victim organization to issue a payment by submitting invoices for fictitious goods or services, inflated invoices, or invoices for personal purchases. Because the payment is generated through the organization's normal accounts payable process, the disbursement appears legitimate, making these schemes among the most costly fraudulent disbursement frauds.

The ACFE identifies three primary types of billing schemes. First, shell company schemes involve the fraudster creating a fictitious entity, often with a bank account and business registration, and submitting false invoices for goods or services never delivered. Pass-through schemes are a variation in which the shell company actually purchases goods and resells them to the employer at a marked-up price. Second, non-accomplice vendor schemes manipulate legitimate vendors without their knowledge. Common methods include pay-and-return schemes, where an employee intentionally double-pays or overpays a vendor and then intercepts the refund, and overbilling by mischaracterizing legitimate invoices. Third, personal purchase schemes occur when an employee buys items for personal use with company funds, either by running purchases through the accounts payable system with false approvals or by misusing company credit cards and purchasing cards.

Red flags include vendors with addresses matching employee addresses or P.O. boxes, sequentially numbered invoices from the same vendor, round-dollar invoice amounts, vague service descriptions, vendors lacking tax identification numbers or phone listings, and rapid increases in payments to a single vendor. Unusual approval patterns, such as one employee both approving vendors and authorizing payments, are also indicative.

Prevention and detection rely on strong internal controls: segregation of duties among purchasing, receiving, and payment functions; independent vendor master file maintenance; three-way matching of purchase orders, receiving reports, and invoices; and data analytics to identify duplicate payments, vendor-employee matches, and statistical anomalies such as Benford's Law deviations.

Billing schemes are the most costly form of fraudulent disbursement because they allow a perpetrator to extract funds by submitting false or inflated invoices that the organization pays through its normal accounts payable process. The three main varieties are shell company schemes, non-accomplice vendor schemes (pay-and-return or overbilling), and personal purchases charged to the company. Effective prevention and detection rest on strong internal controls, data analysis, and employee awareness.

Prevention begins with segregation of duties: the functions of vendor approval, purchase authorization, receiving, invoice approval, and check signing should be performed by different people. No single employee should be able to add a vendor to the master file and also approve payments to it. An approved vendor list should be maintained, with new vendors independently verified for a physical address, tax identification number, and legitimate business existence. Purchases should be supported by purchase orders, receiving reports, and invoices that are matched before payment (three-way match). Competitive bidding, spending limits, and periodic rotation of purchasing staff further reduce opportunity.

Detection relies heavily on analytical review. Fraud examiners look for red flags such as vendors with post office box addresses or addresses matching employee records, vendors lacking phone numbers or tax IDs, invoices that are sequentially numbered from a single vendor, rounded or just-below-approval-threshold amounts, invoices for services rather than tangible goods, unusual spikes in a vendor's volume, and duplicate payments. Comparing vendor master data against the employee master file, reviewing manual or rush checks, and analyzing expense trends by account and department are standard procedures. Reviewing canceled checks for suspicious endorsements and confirming receipt of goods with end users also helps.

Finally, hotlines and anti-fraud training are critical, since tips remain the most common way billing schemes are uncovered. Management should also perform surprise audits and enforce mandatory vacations so that ongoing schemes are exposed.

Payroll fraud schemes are a category of fraudulent disbursements under asset misappropriation in which an employee causes the organization to issue a payment by making false claims for compensation. According to the ACFE's Fraud Tree, payroll schemes fall into four main types: ghost employee schemes, falsified hours and salary schemes, commission schemes, and false workers' compensation claims. Ghost employee schemes involve placing a fictitious or terminated person on the payroll so that paychecks are generated and diverted to the fraudster; this requires adding the ghost to payroll records, collecting timekeeping data, issuing the check, and delivering it to the perpetrator or an accomplice. Falsified hours and salary schemes are the most common payroll fraud, where hourly employees inflate hours worked by overstating time on timecards, forging supervisor approval, or colluding with supervisors, while salaried employees may fraudulently increase their rate of pay in the payroll system. Commission schemes occur when employees inflate sales figures through fictitious sales, altered prices, or claiming credit for others' sales, or when they fraudulently increase their commission rate. False workers' compensation claims involve employees faking or exaggerating injuries to collect benefits. Red flags include employees without deductions, taxes, or benefits elections, duplicate addresses or bank accounts, excessive overtime, payroll expenses exceeding budget, and employees who never take vacation. Prevention and detection controls include segregating duties among hiring, timekeeping, payroll preparation, and check distribution; requiring independent authorization for payroll changes; periodically reconciling personnel files to payroll registers; conducting surprise payroll distributions where employees must present identification; analyzing payroll for duplicate Social Security numbers, addresses, or direct deposit accounts; and comparing actual payroll to budgeted figures. CFEs investigating payroll fraud typically review personnel records, timecards, payroll registers, and canceled checks, and use data analytics to identify anomalies indicating ghost employees or inflated compensation.

Payroll fraud is a form of fraudulent disbursement in which an employee causes the organization to issue payments based on false compensation claims. The main schemes are ghost employees (fictitious or terminated workers kept on the payroll), falsified hours and salary (overstating time worked or improperly raising pay rates), and commission schemes (inflating sales or commission rates). Prevention relies on strong internal controls built on segregation of duties: the functions of hiring and maintaining personnel records, approving timekeeping, preparing payroll, authorizing payroll disbursements, and distributing paychecks should be separated so no single person controls the entire process. Human resources, not payroll staff, should add or remove employees and change pay rates, with all changes documented and approved by management. Supervisors should review and sign timecards, and overtime should require independent authorization. Direct deposit records should be verified so that no two employees share a bank account, and commission payments should be reconciled to actual recorded sales and verified customer accounts. Detection involves both analytical and investigative techniques. Auditors should periodically compare the payroll register to personnel files to identify employees with no Social Security number, no withholding, no benefits deductions, missing addresses, or duplicate addresses and bank accounts, all of which are red flags for ghost employees. Payroll expenses and overtime should be analyzed against budgets and prior periods, with unusual trends investigated. Surprise payroll distributions, in which employees must appear in person with identification to receive paychecks, are effective at uncovering ghosts. Data analysis can flag employees with excessive hours, pay rates outside their job grade, or payments after termination dates. Finally, tips remain the most common detection method, so an anonymous reporting hotline, mandatory vacations, and job rotation for payroll personnel strengthen the anti-fraud environment and increase the perception of detection, which itself deters payroll fraud.

Expense reimbursement schemes are a category of fraudulent disbursement within asset misappropriation, as defined in the ACFE Fraud Tree. In these schemes, an employee manipulates the organization's expense reimbursement process to obtain payment for expenses that are fictitious, inflated, personal, or already reimbursed. Because expense reports are often reviewed quickly and involve relatively small individual amounts, these schemes can persist for years and accumulate significant losses.

The ACFE identifies four principal types. First, mischaracterized expenses occur when an employee submits a personal expense as a legitimate business cost, such as claiming a family dinner as a client entertainment meal or a vacation flight as business travel. Second, overstated expenses involve inflating the cost of legitimate business expenses, for example altering receipts, claiming first-class fares while flying coach, or overstating mileage. Third, fictitious expenses are entirely fabricated claims supported by false documentation, such as counterfeit receipts created on a computer, blank receipts obtained from vendors, or claims for expenses paid by others. Fourth, multiple reimbursements involve submitting the same expense more than once, often using different forms of support, such as a credit card statement for one claim and the original receipt for another, or submitting duplicates in different periods.

Red flags include expenses consistently just below approval thresholds, photocopied or altered receipts, round-dollar amounts, claims lacking detail, expenses submitted long after the fact, patterns of weekend or holiday expenses, and employees whose reimbursements significantly exceed peers in similar roles.

Prevention and detection controls include a clear written expense policy, requiring original itemized receipts, mandatory supervisory review with documented approval, independent verification against travel records and corporate card statements, data analytics to detect duplicates and outliers, periodic audits of expense reports, and setting a tone at the top that reinforces ethical conduct. CFEs investigating these schemes typically compare reports across periods, trace receipts to vendors, and interview approvers and claimants.

Expense reimbursement fraud occurs when employees seek payment for fictitious, inflated, mischaracterized, or duplicated business expenses. Within the CFE framework, it is a form of fraudulent disbursement under asset misappropriation. Prevention and detection require a combination of strong policies, controls, and analytical review.

Prevention begins with a clear, written expense policy that defines allowable expenses, spending limits, required documentation, and submission deadlines. Employees should sign acknowledgments of the policy. Original, itemized receipts (not just credit card slips) should be required for all expenses above a low threshold. Expense reports must include the business purpose, date, location, and attendees for meals and entertainment. Supervisors should personally review and approve reports, and no one should approve their own expenses or those of someone who approves theirs. Company-issued credit cards with direct billing reduce cash-based claims. Segregation of duties between approval, processing, and payment is essential, and travel should be booked through centralized systems where possible.

Detection relies on both manual review and data analytics. Red flags include expenses just below approval thresholds, round-dollar amounts, claims filed late or in clusters, duplicate receipts submitted in different periods, receipts that are altered, sequential, or from the same vendor, and expenses incurred on weekends, holidays, or during vacation. Analysts should compare expense trends by employee and department, benchmark against peers, and match claimed travel dates against time and attendance records. Duplicate payment testing should search for the same amount, date, and vendor across reports and across corporate card and cash reimbursements. Periodic surprise audits of expense reports, verification of receipts with vendors, and reviewing mischaracterized personal items (family travel, personal purchases coded as supplies) are effective. A hotline encouraging anonymous tips remains among the most productive detection methods. Finally, consistent enforcement and disciplinary action reinforce deterrence and signal that management actively monitors reimbursements.