Loan and mortgage fraud schemes are among the most significant threats facing financial institutions, and the CFE Exam addresses them within the Financial Institution Fraud section of the Financial Transactions and Fraud Schemes domain. These schemes involve the intentional misrepresentation, misstatement, or omission of material facts to obtain a loan or influence a lender's decision.

The ACFE generally categorizes mortgage fraud into two types: fraud for property (housing), where a borrower misrepresents information to obtain a home they intend to occupy and repay, and fraud for profit, where insiders or organized groups manipulate the lending process to extract illicit gains. Fraud for profit is typically more damaging and often involves collusion among appraisers, loan officers, brokers, title agents, and straw buyers.

Common schemes include: (1) Loans to nonexistent borrowers using fictitious identities or stolen identities; (2) Straw buyer schemes, where a nominee with good credit applies on behalf of the true borrower who could not qualify; (3) Falsified applications containing inflated income, fabricated employment, or hidden liabilities (often called 'liar loans'); (4) Appraisal fraud, where property values are artificially inflated to support larger loans; (5) Property flipping, in which a property is purchased and quickly resold at an inflated price using a fraudulent appraisal; (6) Equity skimming, where a perpetrator acquires property, collects rents, and allows the mortgage to default; (7) Double-pledging collateral, pledging the same asset to multiple lenders; (8) Linked financing and reciprocal loan arrangements, where insiders at different institutions swap loans to circumvent lending limits; (9) Daisy chains, cycling bad loans among related entities to disguise their condition; and (10) Nominee or insider loans that evade regulatory restrictions.

Red flags include unusually high appraisals, rapid resale, missing documentation, unverifiable employment, borrowers who never appear in person, and high default rates tied to a particular loan officer or broker. Fraud examiners detect these schemes through document verification, independent appraisals, analysis of loan file patterns, and review of relationships among transaction participants.

In the Certified Fraud Examiner (CFE) body of knowledge, New Account Schemes and Theft from Customer Accounts are two major categories of financial institution fraud that target deposit relationships rather than lending functions.

New Account Schemes occur when a fraudster opens a deposit account with the intent to defraud the institution. Common methods include: (1) False Identification – using stolen, synthetic, or fabricated identities to open accounts that are later used for check kiting, depositing counterfeit or stolen checks, or laundering funds; (2) Business Account Fraud – establishing a shell business account, depositing worthless checks, and withdrawing funds before items are returned; (3) Personal Account Fraud – opening an account with a small legitimate deposit, then depositing fraudulent checks and quickly withdrawing cash or writing checks against uncollected funds. Red flags include customers who are reluctant to provide identification, residences or employment located far from the branch, requests for immediate cash back on large deposits, and new accounts with unusually high early activity. Controls emphasize strong Customer Identification Program (CIP) and Know Your Customer (KYC) procedures, verification of identification documents, holds on new account deposits, and monitoring of early account behavior.

Theft from Customer Accounts involves unauthorized removal of funds from legitimate customers' accounts, often by insiders. Typical schemes include: (1) Employee embezzlement – tellers or account officers skimming from dormant or inactive accounts, forging withdrawal slips, or making unauthorized transfers; (2) Account takeover – external fraudsters using stolen credentials, social engineering, or phishing to redirect funds; (3) Forged signatures or altered checks; and (4) unauthorized electronic (ACH/wire) transfers. Dormant accounts are especially vulnerable because victims rarely review statements. Red flags include address changes followed by withdrawals, employees handling their own family members' accounts, overrides of transaction limits, and customer complaints. Preventive controls include segregation of duties, mandatory vacations, dual authorization for large transfers, dormant account monitoring, and prompt customer statement reconciliation.

Preventing and detecting financial institution fraud is a core topic in the CFE Financial Transactions and Fraud Schemes section. Financial institutions face threats from both insiders (employees, officers, directors) and outsiders (customers, borrowers, organized rings), with common schemes including embezzlement, loan fraud, new account fraud, check kiting, wire fraud, money laundering, and account takeover. Because banks hold liquid assets and process enormous transaction volumes, strong internal controls and proactive monitoring are essential.

Prevention begins with governance and tone at the top. Boards and senior management must establish a written fraud risk management program, a code of conduct, and clear accountability. Key preventive controls include segregation of duties (no single employee should originate, approve, and disburse a loan), dual control over cash, vaults, and dormant accounts, mandatory vacations and job rotation so concealed schemes surface, and rigorous background checks on hires. Know Your Customer (KYC) and Customer Due Diligence procedures, required under the Bank Secrecy Act and Anti-Money Laundering rules, help verify identities and detect suspicious account openings. Lending controls such as independent appraisals, credit committee approval, and limits on insider loans reduce loan fraud.

Detection relies on monitoring and analysis. Institutions should use automated transaction monitoring systems to flag unusual patterns, structuring below reporting thresholds, rapid fund movement, or activity inconsistent with a customer profile. Suspicious Activity Reports (SARs) and Currency Transaction Reports (CTRs) must be filed timely. Regular surprise cash counts, reconciliation of suspense and general ledger accounts, review of employee accounts, and analysis of loan portfolios for delinquency clusters or related-party borrowers are effective. Internal audit should operate independently and test controls. Anonymous hotlines remain the most common way frauds are discovered, so employees and customers need accessible reporting channels. Finally, training staff to recognize red flags—lifestyle changes, reluctance to take leave, altered documents, or customers resisting identification—strengthens the overall anti-fraud culture.