In the Certified Fraud Examiner (CFE) body of knowledge, covert operations are investigative techniques in which the fraud examiner conceals his or her true identity, purpose, or presence in order to gather evidence that could not be obtained through open inquiry. The ACFE defines covert operations as activities such as undercover work, surveillance (physical, electronic, or moving), and the use of informants or confidential sources, all conducted without the knowledge of the subject. Because the subject is unaware, these methods can reveal behavior, conversations, and documents that would otherwise be hidden or destroyed. Covert operations are considered a last resort, used only when other, less intrusive methods are impractical or have failed, and when the potential benefit clearly outweighs the legal, ethical, and reputational risks. Documentation is a cornerstone of any covert operation. Before beginning, the examiner should prepare a written memorandum, often called an operational plan or predication memo, that records the information upon which the operation is predicated, the specific objectives, the identity of the subject(s), the methods to be used, the personnel involved, the estimated duration, and the anticipated costs. The plan should also identify legal counsel consulted and management or client approval obtained, which protects the examiner against later claims of entrapment, invasion of privacy, or improper conduct. During the operation, every contact, observation, and piece of evidence must be logged contemporaneously with date, time, location, participants, and a factual description, avoiding opinions or speculation. Surveillance logs, photographs, recordings, and expense records should be preserved and maintained in a secure chain of custody. After the operation concludes, a comprehensive report summarizes findings and ties each conclusion to documented evidence. Proper definition and documentation ensure that covert operations remain lawful, defensible in court, consistent with the CFE Code of Professional Ethics, and credible to management, prosecutors, and judges.

Covert operations in fraud examination refer to investigative techniques conducted without the knowledge of the subject, such as undercover work, surveillance, and the use of informants or confidential sources. Because these methods intrude on privacy and operate in secrecy, Certified Fraud Examiners must understand the legal issues that govern them to avoid civil liability, criminal exposure, and the suppression of evidence.

First, entrapment is a central concern. Investigators may provide an opportunity for a subject to commit a wrongful act, but they may not induce or persuade someone who was not otherwise predisposed to commit it. Evidence gathered through entrapment may be inadmissible and can damage the credibility of the examination.

Second, privacy laws and surveillance restrictions apply. Electronic surveillance, wiretapping, and recording conversations are regulated by federal and state statutes, such as the Electronic Communications Privacy Act in the United States. Many jurisdictions require consent of one or all parties before recording. Unauthorized interception can result in criminal penalties and civil damages.

Third, trespass and unlawful searches must be avoided. Covert operatives cannot enter private property without authorization or search private areas, lockers, or vehicles without consent, a warrant, or clear employer policy. In private-sector cases, the examiner should confirm that company policies and employment agreements authorize such searches.

Fourth, pretexting and misrepresentation carry legal limits. Obtaining financial records, phone records, or personal information by posing as someone else is prohibited under laws such as the Gramm-Leach-Bliley Act. Impersonating law enforcement is universally illegal.

Fifth, defamation, invasion of privacy, and intentional infliction of emotional distress claims may arise if the operation is mishandled or disclosed improperly.

Finally, documentation and legal counsel involvement are essential. The CFE should establish a written operation plan, define objectives and limits, obtain management and legal approval, and ensure all evidence is collected lawfully to preserve its admissibility and protect the organization and the examiner.

In Certified Fraud Examiner (CFE) practice, covert operations may involve using sources and informants to gather intelligence that cannot be obtained through open or direct means. The CFE Exam materials distinguish between the two terms. A source is a person who provides information openly, often because of their position, expertise, or public role, and typically without expectation of concealment or compensation. An informant, by contrast, provides information confidentially, usually about illicit activity, and often seeks something in return—money, leniency, revenge, or a sense of moral duty. Because informants frequently have ulterior motives, fraud examiners must carefully evaluate their reliability and corroborate information independently before acting on it.

Motivations commonly cited for informants include financial reward, fear of punishment, desire for revenge, egotism, a wish to feel important, or genuine civic concern. Understanding motive helps the examiner judge credibility and anticipate bias or fabrication. Information should be assessed for consistency, detail, and verifiability, and the examiner should avoid becoming dependent on a single informant.

Several safeguards govern the use of informants. Their identity should be protected and kept confidential, usually through codes or numbers rather than names in reports and files, to prevent retaliation and preserve future cooperation. Payments to informants should be documented, approved, and made against receipts or written acknowledgments, with controls to prevent misuse of funds. Examiners must never promise immunity or outcomes they cannot deliver, and they must avoid entrapment, inducing illegal acts, or allowing informants to commit crimes. Informant contacts should be documented in memoranda, including the date, substance of information, and any compensation, while keeping these records separate from the main case file.

Legal and ethical considerations are critical: in some jurisdictions, informant identities may be subject to disclosure in court, and improperly obtained information may be inadmissible. Properly managed, sources and informants are valuable tools that help CFEs develop leads, confirm suspicions, and penetrate otherwise closed fraud schemes.

Covert operations—such as undercover investigations, surveillance, and the use of confidential informants—are among the most powerful tools available to a Certified Fraud Examiner, but they also carry significant risks that must be weighed before deployment. The ACFE emphasizes that covert operations should be used only when conventional methods are impractical, because the potential downsides are substantial.

Legal risk is the foremost concern. Undercover operatives may be accused of entrapment if they induce a subject to commit a crime he or she would not otherwise have committed. Improper surveillance can violate privacy laws, wiretapping statutes, or employee rights, exposing the organization to civil liability, suppression of evidence, or criminal charges against investigators. Any evidence gathered illegally may become inadmissible, undermining the entire case.

Physical risk to the operative is real, particularly when investigating organized crime, violent subjects, or situations involving drugs or weapons. If an undercover identity is compromised, the investigator and informants may face retaliation.

Operational risk includes the possibility that the subject discovers the operation, destroys evidence, warns co-conspirators, or alters behavior, rendering months of effort useless. Operatives may also 'go native,' becoming sympathetic to subjects, or may themselves participate in wrongdoing, compromising credibility and the case.

Reputational and organizational risk arises if the operation becomes public. Employees may perceive it as spying, damaging morale, trust, and labor relations, and potentially triggering union grievances or wrongful-termination claims. Media exposure can harm the company's image even when the investigation is justified.

Financial risk is considerable because covert operations are expensive, lengthy, and may yield no actionable evidence.

To mitigate these risks, CFEs should obtain written authorization from management and legal counsel, document the predication thoroughly, use trained and licensed personnel, maintain strict confidentiality, and establish clear objectives and termination criteria. A cost-benefit analysis should always precede any covert operation to confirm that the expected benefits justify the inherent dangers.