Lesson 04 of 25
Asset Misappropriation I: Cash Receipts (Skimming & Larceny)
5 min read · CFE
Nail the exam's favorite distinction — skimming (off-book theft before recording) versus cash larceny (on-book theft after) — plus lapping and the controls that break it. Learn to read a scenario for the timing tell.
Stealing cash on the way in
- Cash receipt schemes — theft at the point money arrives
- Two big categories: skimming and cash larceny
- The timing of the theft is the whole distinction
We start the asset-misappropriation tour with cash receipt schemes — theft that happens as money comes into the organization, at the point of sale, the mailroom, or the cashier's window. The exam draws a sharp line between two categories here, and the line is all about timing relative to the records: was the cash stolen before it hit the books, or after? Get that timing straight and a whole cluster of questions becomes easy, because almost every cash-receipt question is secretly testing whether you can place the theft on the right side of the recording moment.
The two categories are skimming and cash larceny. They can look identical to a casual observer — money's missing either way, and the victim feels the same loss — but to an examiner they are fundamentally different, because they leave different evidence and require completely different detection methods. One leaves a gap in the records you can measure; the other leaves no record at all.
That single difference drives everything that follows in this lecture, so anchor on it now.
Skimming: off-book theft
- Cash stolen BEFORE it's recorded
- An 'off-book' scheme — no entry to find
- Unrecorded sales, understated sales, theft of receivables
Skimming is theft of cash before it ever enters the books. Because nothing was recorded, it's called an off-book scheme — and that's what makes it so hard to catch, since there's no entry sitting in the ledger pointing to the missing money. There's nothing to reconcile against, because as far as the records are concerned, that sale never happened.
Picture a clerk who pockets a customer's cash and simply never rings up the sale, or an employee who rings the sale for less than was actually paid and keeps the difference — that's understated sales. Skimming also hits incoming receivables: a customer pays an old invoice, the employee takes the cash, and the account is never credited. That receivables variety is the most dangerous, because the customer expects credit for a payment they made, and that tension is what eventually forces a cover-up.
The defining feature for the exam: skimming happens before recording, so it's off-book, and the loss must be detected through indirect signs — declining cash sales, inventory that shrinks faster than recorded sales explain, or a customer who insists they already paid — not by finding a fraudulent entry, because there isn't one.
Cash larceny: on-book theft
- Cash stolen AFTER it's recorded
- An 'on-book' scheme — the records show what should be there
- The theft creates a discrepancy you can find
Cash larceny is the opposite. Here the sale was recorded properly, the cash was logged into the system, and then someone steals it after the fact — from the register, from the day's deposit, or out of the safe. Because the receipt was already on the books, this is an on-book scheme, and that's actually good news for the examiner: the records say a certain amount should be present, and it isn't, so the theft automatically creates a discrepancy you can detect by comparing what the records claim to the actual cash on hand.
A classic version is the larceny from the deposit — the cashier records the full sales total but skims cash out of the bag before it reaches the bank, so the deposit slip and the receipts no longer agree. The exam contrast to drill until it's automatic: skimming is before recording and off-book; cash larceny is after recording and on-book. The same dollar stolen, the same victim, but a completely different evidence trail — and the trail is exactly what the question is really asking about.
Lapping: hiding the hole
- Crediting customer A's account with customer B's payment
- A rolling cover-up — needs constant new payments to feed it
- Often used to conceal receivables skimming
Now a technique you must recognize by name: lapping. When an employee skims a customer's payment, the customer's account goes unpaid and will eventually complain. To hide that, the thief applies the next customer's payment to the first customer's account, then a third payment to the second, and so on.
It's a rolling cover-up that has to be fed constantly with new receipts, which is why it tends to grow and eventually collapse — especially when the employee is sick or on vacation and can't keep the plates spinning. A mandatory-vacation policy is a classic control precisely because it breaks lapping. If you see delayed posting of payments, customers complaining their payments weren't credited on time, and an employee who guards the receivables and never takes time off, think lapping.
The exam loves to pair that vacation detail with the scheme, because the control and the fraud are two sides of the same coin.
Detecting cash-receipt fraud
- Segregate receiving cash from recording it
- Reconcile, surprise-count, rotate duties, force vacations
- Customer complaints about credited payments — a quiet alarm
How do you catch these? Because skimming is off-book, you lean on indirect methods: trend analysis on declining cash sales, inventory shrinkage that doesn't match recorded sales, and — crucially — customer complaints that they paid an invoice the company still shows as open. For cash larceny, reconciliation does the work, since the records tell you what should be in the drawer.
And across the board, the structural fix is segregation of duties — the person who handles cash should not also record it — backed by surprise cash counts, job rotation, and mandatory vacations. On the exam, when a scenario gives you an off-book clue like missing sales with no entry, reach for skimming; when the books say money should be there and it's gone, reach for larceny. Next, we follow the cash out the door — fraudulent disbursements.
Sources
- ACFE Report to the Nations — asset misappropriation cash schemes (skimming, cash larceny, lapping)
- occupational fraud taxonomy
Test your knowledge
A few CFE questions on this material — pick an answer to see the explanation.
Q1. The fraud triangle identifies three conditions generally present when fraud occurs. They are:
Q2. Which of the following is one of the five components of the COSO Internal Control–Integrated Framework?
Q3. A well-designed organizational fraud risk assessment should primarily:
Q4. Under the ACFE Fraud Tree, occupational fraud is divided into three primary categories. Which of the following correctly lists all three?