Identity Theft: Free CFE Practice Questions

Question 1

Which of the following BEST distinguishes whaling from other forms of spear phishing used by identity thieves?

It sends bulk messages to a large, random audience It aims at senior executives with high authority It relies on cloned voice calls in place of emails It uses research on a victim to tailor each message

Correct Answer: It aims at senior executives with high authority

Whaling is a form of spear phishing that specifically targets senior executives and other high-ranking individuals, such as CEOs and CFOs. Their authority and access to sensitive data, funds, and approvals make them especially valuable targets.
Researching the victim to tailor each message is common to all spear phishing, so it does not set whaling apart. Using cloned voice calls describes vishing or deepfake schemes, not whaling, which is usually email-based. Sending bulk messages to a large, random audience describes ordinary phishing, the opposite of a targeted attack.
Key concept: whaling is defined by its target, senior executives with high authority, rather than by its method.

Question 2

Why do lenders often record losses from synthetic identity fraud as credit losses rather than recognize them as fraud?

The SSN holder files disputes that lenders log as routine billing errors Credit bureaus merge the fabricated file into a real person's report and mask it No true victim disputes the accounts, so defaults look like ordinary bad debt The fraudster repays every account in full, so lenders book no loss at all

Correct Answer: No true victim disputes the accounts, so defaults look like ordinary bad debt

Synthetic identities combine real and fabricated data to create a person who does not exist, so when the fraudster busts out and stops paying, no genuine victim comes forward to dispute the accounts, and the default looks like an ordinary charge-off.
Credit bureaus do not merge the synthetic file into a real person's report. Instead, the fake identity builds its own separate file. Fraudsters do not repay in full. The scheme ends in a bust-out that leaves real losses. SSN holders, often children or the deceased, rarely notice or dispute the accounts, which is exactly why detection fails.
Key concept: synthetic identity fraud lacks a complaining victim, so losses are misclassified as credit losses.

Question 3

A fraud examiner at a credit card issuer reviews an account opened with a valid identification number that had no credit history. The number was paired with an invented name and birth date. The account was paid on time for months and its limit was raised. Then it was maxed out and abandoned. Which party is MOST likely to bear the direct financial loss?

The merchants who accepted the card, through chargeback claims The credit bureau that created a file for the composite identity The person issued the number, held liable for the unpaid balance The issuer that extended credit to the composite identity profile

Correct Answer: The issuer that extended credit to the composite identity profile

This is synthetic identity fraud, where a real identification number is paired with fabricated personal details. Because no real person matches the composite identity, the issuer that extended the credit cannot collect and must write off the balance as a credit loss.
The person issued the number is not the account holder, did not consent, and is not liable for the debt. The credit bureau only reports data and extends no credit. Merchants received authorized transactions on a valid card, so chargeback rights do not apply.
Key concept: synthetic identity fraud and "bust-out" schemes, in which lenders bear the direct loss.

Identity Theft

CFE - Identity Theft Example Questions

Question 1

Question 2

Question 3

Unlock Premium Access