Payment Fraud: Free CFE Practice Questions

Question 1

A municipal parking operator lets drivers pay by scanning a code posted on each meter with their phones. Several drivers dispute parking fines and show debits from their mobile payment apps, yet the operator never received those funds. A fraud examiner finds that the operator's merchant account profile and settlement details are unchanged. On the affected meters, adhesive labels have been placed over the original codes and lead to a look-alike payment site. Which scheme do these facts BEST describe?

QR code tampering scheme SIM-swapping payment fraud Merchant account takeover Triangulation fraud scheme

Correct Answer: QR code tampering scheme

This is a QR code tampering scheme. Fraudsters placed adhesive labels over the legitimate codes on the meters, so drivers who scanned them were sent to a look-alike payment site, and their money went to the fraudsters instead of the operator.
Merchant account takeover is ruled out because the operator's account profile and settlement details are unchanged. SIM-swapping payment fraud requires hijacking a victim's phone number to intercept authentication codes, which did not happen here. Triangulation fraud uses stolen card data to fill orders from a fake storefront, not to redirect point-of-payment codes.
Key concept: physical tampering with payment QR codes to redirect funds through spoofed sites.

Question 2

A bank's fraud team flags a new customer who deposits several checks drawn on her own account at another bank. Each time, she withdraws most of the funds before the deposited items clear, and the checks are later returned unpaid. A fraud examiner's working theory is check kiting. Which finding would MOST weaken that theory and point instead to paper hanging?

Deposit amounts rose steadily over the weeks under review Each shortfall at one bank was covered by a deposit from the other The customer controlled accounts at both of the banks involved The other-bank account was closed before the checks were written

Correct Answer: The other-bank account was closed before the checks were written

A closed account means the checks could never be covered. There is no float being rotated between live accounts, only worthless paper passed to obtain cash, which is the hallmark of paper hanging.
Shortfalls covered by deposits from the other bank describe the circular float that defines kiting. Control of accounts at both banks is exactly the setup a kiter needs, so it supports kiting. Steadily rising deposit amounts reflect the inflating balances typical of a growing kite.
Key concept: distinguishing check kiting, which exploits float between open accounts, from paper hanging, which uses checks on closed or nonexistent accounts.

Question 3

Which of the following BEST distinguishes an account takeover scheme from a business email compromise scheme?

The stolen proceeds pass through money mule accounts to obscure the audit trail The fraudster, posing as the holder, initiates payments from the victim's own account The fraudster uses social engineering to obtain the victim's personal information The fraudster deceives an employee into sending a payment to a new bank account

Correct Answer: The fraudster, posing as the holder, initiates payments from the victim's own account

In an account takeover, the fraudster gains unauthorized access to the victim's existing account and, impersonating the legitimate holder, initiates transfers or payments directly from that account. The victim never knowingly acts.
Deceiving an employee into paying a new bank account describes business email compromise, where the victim is tricked into sending the money themselves. Using social engineering to obtain personal information is common to both schemes, so it does not distinguish them. Moving proceeds through money mule accounts is a laundering step shared by both.
Key concept: who initiates the payment. In account takeover, the fraudster does it by posing as the holder. In business email compromise, a deceived victim does it.

Payment Fraud

CFE - Payment Fraud Example Questions

Question 1

Question 2

Question 3

Unlock Premium Access