Skip to main content

Lesson 10 of 25

Industry-Specific & Emerging Schemes

5 min read · CFE

Recognize the same fraud logic dressed up in banking, insurance, healthcare, and consumer settings, plus cyber and payment fraud. Learn to classify any cyber scheme back to a branch of the fraud tree.

Where the schemes live: industries

  • Same fraud logic, different industry dress
  • Financial institution, insurance, healthcare, consumer, cyber
  • The exam wants you to recognize sector-specific schemes

We close the schemes section by putting the fraud tree into specific industries, because the exam expects you to recognize how the same underlying logic dresses up differently in banking, insurance, healthcare, and the consumer space — plus the fast-moving world of cyber and payment fraud. Don't overthink this material, and don't try to memorize a thousand scheme names. Here's the reasoning shortcut: every scheme still reduces to one of three branches you already know — asset misappropriation, corruption, or financial-statement misstatement.

The industry just supplies the props and the jargon. A 'phantom claim' in insurance is the same logic as a 'ghost employee' in payroll — a payment going out for something that doesn't exist. So when a question buries a scheme in industry vocabulary, your job is to strip the costume off and name the familiar pattern underneath.

That single habit answers most of the questions in this section.

Financial institution fraud

  • Loan fraud — false applications, straw borrowers, flipping
  • Embezzlement and false accounting by insiders
  • New-account, check, and wire-transfer fraud

In financial institutions, the marquee category is loan fraud — false statements on applications, straw borrowers who front for the real party so the lender never sees who's actually behind the loan, and property flipping with inflated appraisals to support oversized loans. A classic tell: the appraisal jumps far above comparable sales, or the same property resells two or three times in quick succession at rising prices. Add insider embezzlement and false accounting, where bank employees misuse their access to manipulate accounts, lap deposits, or hide shortfalls.

And there's a whole family of transaction fraud: new-account fraud opened with stolen or synthetic identities, check fraud including kiting and counterfeit checks, and unauthorized wire transfers. Many of these intersect directly with anti-money-laundering work, so if you've studied that world, the red flags — structuring deposits just under reporting thresholds, unusual wire patterns, accounts with rapid in-and-out movement and no economic purpose — will feel familiar. The exam rewards you for connecting the fraud scheme to the laundering of its proceeds, because in real cases they travel together.

Insurance and healthcare fraud

  • Insurance: staged losses, inflated claims, premium diversion
  • Healthcare: upcoding, unbundling, phantom billing, kickbacks
  • Provider-side and consumer-side variants

Insurance fraud runs in two directions. On the claimant side: staged accidents, exaggerated or entirely fabricated losses, and false injury claims. On the insider and agent side: premium diversion, where an agent pockets premiums instead of remitting them, and fictitious policies.

Healthcare fraud is a major exam topic in its own right, mostly provider-driven: upcoding, billing for a more expensive service than was provided; unbundling, billing separately for procedures that should be billed together; phantom billing for services never rendered; and kickbacks for patient referrals. The same words recur — false claim, inflated billing, kickback — which is your cue that you're really looking at misappropriation or corruption in a healthcare wrapper. Watch for the buzzwords: upcoding and unbundling both inflate the bill, while phantom billing and medically unnecessary services bill for things that never should have happened at all.

Kickbacks for referrals are pure corruption.

Consumer fraud and identity theft

  • Ponzi and pyramid schemes; advance-fee fraud
  • Identity theft — using another's data for gain
  • Synthetic identity — fabricated, not just stolen

Consumer fraud targets individuals, and the exam loves the fine distinctions here. Know cold the difference between a Ponzi scheme — paying earlier investors with later investors' money around a fake or non-performing investment, with no real underlying business generating returns — and a pyramid scheme, which pays primarily for recruiting new members rather than selling a real product. The tell for a pyramid is that the money comes from recruitment, not sales.

Both collapse the moment new money stops coming in, which is why they're inherently unsustainable. Advance-fee fraud promises a big payout — a loan, a prize, an inheritance — in exchange for an upfront fee that's simply stolen, and the promised payout never arrives. And identity theft underpins much of modern fraud: using someone else's personal data to open accounts or make charges.

Here's a distinction the exam tests directly. Classic identity theft uses a real victim's data, so there's a real person who notices the damage. Synthetic identity fraud stitches together real and fabricated information — a real Social Security number, perhaps a child's, paired with a made-up name and birthdate — to create a person who doesn't exist.

That's harder to detect because no single victim raises the alarm, and it's increasingly the bigger problem for lenders.

Cyber, payment, and social engineering

  • Phishing, business email compromise, account takeover
  • Social engineering exploits people, not just systems
  • On the exam: classify the cyber scheme to a tree branch

Finally, the cyber and payment layer, which is increasingly woven through every other category. Social engineering is the key concept: many cyber frauds succeed by manipulating a person, not by defeating a firewall. Phishing tricks a victim into surrendering credentials; business email compromise impersonates an executive or vendor to redirect a payment, and has caused staggering losses; account takeover uses stolen credentials to drain an existing account.

Payment fraud spans card-not-present transactions, skimming devices, and unauthorized A-C-H and wire transfers. For the exam, do what you've done all section: classify. A cyber scheme that moves company funds out the door is still asset misappropriation, just executed through a keyboard.

That wraps the schemes section. Next, we step into the legal frame — the Law section opens with the legal system and the elements of fraud.

Sources

  • ACFE CFE Exam Content Outline — financial institution, insurance, healthcare, and consumer fraud
  • ACFE cyberfraud/identity-theft materials
  • common payment-fraud and social-engineering typologies

Test your knowledge

A few CFE questions on this material — pick an answer to see the explanation.

  1. Q1. An out-of-court statement offered to prove the truth of the matter asserted is generally classified as:

  2. Q2. The standard of proof required to obtain a civil judgment is:

  3. Q3. The first step in planning a fraud examination after receiving an allegation should be to:

  4. Q4. Which of the following best describes 'predication' in the context of a fraud examination?

Ready to practice?

Put this lesson to work on real CFE questions.

Drill the full CFE bank →