Fraud examiners investigate suspected financial misconduct from the first red flag to the courtroom: they analyze records to find the scheme, interview the people around it, preserve evidence so it survives legal challenge, write a report that lays out what happened, and often testify as expert witnesses when the case goes to trial. The work sits at the intersection of accounting, law, and investigation. It matters more than the title suggests. The typical occupational fraud scheme runs about 12 months before anyone catches it, with a median loss of $145,000 per case, and the examiner is who gets called when an organization suspects an insider is stealing, a regulator flags a filing, or an insurance claim stops adding up.
Analyzing the Financial Records
The technical core of the job is combing through financial records to find patterns that don’t belong. Examiners work from a long catalog of known schemes, each with its own fingerprint.
Skimming involves stealing cash before it ever reaches the accounting system, which makes it nearly invisible on the books. Lapping hides a shortage by applying one customer’s payment to another customer’s account, a rolling cover-up that grows more fragile over time. Ghost employees appear on payroll but don’t actually exist; funds routed to their accounts end up in the perpetrator’s pocket. Examiners catch this by comparing payroll records against tax identification numbers and looking for addresses or bank accounts that overlap with real employees.
One of the more powerful detection tools is Benford’s Law, a mathematical principle that predicts how often each digit from 1 through 9 should appear as the leading digit in naturally occurring number sets. In legitimate accounting data, the digit 1 leads roughly 30% of the time, while 9 leads less than 5%. When someone fabricates invoices, they tend to pick round numbers or cluster amounts just below approval thresholds, which throws off the expected distribution. Forensic software flags those deviations automatically, along with duplicate payments, suspiciously timed entries, and vendors that share addresses or bank accounts with employees.
Financial statement fraud operates at a different scale. Instead of an employee pocketing cash, this involves executives inflating asset values, understating liabilities, or misrepresenting revenue to deceive investors and regulators. Examiners working these cases trace manipulated entries through journal records, looking for manual overrides of automated controls, rounded-dollar transactions in accounts that normally carry precise decimal amounts, and revenue recognized in the wrong period. The penalties attached to these cases are steep. A CEO or CFO who knowingly certifies a false financial report under the Sarbanes-Oxley Act faces up to $1,000,000 in fines and 10 years in prison, with willful certification pushing those numbers to $5,000,000 and 20 years.1Office of the Law Revision Counsel. 18 U.S. Code 1350 – Failure of Corporate Officers to Certify Financial Reports Securities fraud more broadly carries up to 25 years.2Office of the Law Revision Counsel. 18 U.S. Code 1348 – Securities and Commodities Fraud
Interviewing Witnesses and Suspects
Numbers tell part of the story. The rest comes from people. Fraud examiners conduct structured interviews with whistleblowers, co-workers, supervisors, and ultimately the suspects themselves. The goal is to fill gaps the financial records can’t explain: who had access, who authorized a transaction, and why routine procedures were bypassed.
Cooperative witnesses come first. Examiners use open-ended questions to understand daily workflows, approval hierarchies, and the informal dynamics of a department. A bookkeeper might mention that one manager insists on handling vendor payments personally. That kind of detail, invisible in the data, can reframe the entire investigation. Early interviews also help the examiner identify who might be involved and who is simply a bystander.
Suspect interviews require a different approach. Examiners observe behavioral cues, ask questions they already know the answers to, and look for contradictions between the suspect’s account and the financial evidence. The objective is a signed statement or verbal admission that can serve as direct evidence in a legal proceeding. Every interview is recorded meticulously, because any suggestion of coercion can lead to the evidence being excluded at trial. A poorly handled interview doesn’t just lose a piece of evidence; it can sink the entire case.
Whistleblowers who report securities law violations to the SEC receive specific protections under the Dodd-Frank Act. Employers cannot fire, demote, suspend, or harass someone for providing information to the Commission or assisting in an SEC investigation.3U.S. Securities and Exchange Commission. Whistleblower Protections Whistleblowers whose tips lead to enforcement actions with sanctions exceeding $1 million can receive awards of 10% to 30% of the money collected.4U.S. Securities and Exchange Commission. SEC Awards $6 Million to Joint Whistleblowers Examiners working with whistleblowers need to understand these protections and run the investigation in a way that doesn’t inadvertently expose the source.
Preserving Evidence So It Holds Up in Court
An investigation that finds fraud but can’t prove it in court is a failure. Everything hinges on how evidence is handled from the moment it’s identified. Fraud examiners follow the chain of custody protocol, documenting every person who touches a piece of evidence, when they accessed it, and what they did with it. Physical documents go into tamper-evident packaging. Each transfer is logged with dates and times. Federal Rule of Evidence 901 requires that any item introduced at trial be authenticated: the offering party must show it is what they claim it is. A broken chain of custody gives opposing counsel exactly the argument they need to get evidence excluded.
Digital evidence carries its own challenges. Examiners create forensic images of hard drives, bit-for-bit copies that preserve the original data including metadata, deleted files, and hidden directories. The original hardware stays sealed. All analysis happens on the copy. This approach ensures no one can argue the examiner altered the data during review. Examiners search these images for off-the-books ledgers, communications about the scheme, and records the perpetrator thought they had erased.
Cloud storage and mobile devices add complexity because data may reside on remote servers controlled by third parties. Specific forensic tools are needed to retrieve and preserve that information without altering it. Once captured, cloned data is stored on write-protected media so no further changes can occur. Destroying or falsifying records to obstruct a federal investigation is itself a serious crime under 18 U.S.C. § 1519, carrying up to 20 years in prison.5Office of the Law Revision Counsel. 18 U.S. Code 1519 – Destruction, Alteration, or Falsification of Records in Federal Investigations and Bankruptcy That statute gives examiners leverage when subjects or their associates are tempted to wipe drives or shred documents.
Writing the Report and Testifying as an Expert
The investigation’s output is a written report that details the scope of the examination, the methods used, the evidence collected, and the findings. It reads like a roadmap for prosecutors or corporate counsel. Under the Association of Certified Fraud Examiners’ Code of Professional Ethics, examiners establish a reasonable basis for any opinion they render and never express an opinion on whether someone is guilty or innocent. The report lays out what happened and who was involved. Deciding guilt is the court’s job.
Many fraud investigations uncover violations of the federal wire fraud statute, 18 U.S.C. § 1343, which covers any scheme to defraud carried out through electronic communications. The standard penalty is up to 20 years in prison. When the fraud targets a financial institution or exploits a presidential disaster declaration, the maximum jumps to 30 years and $1,000,000 in fines.6Office of the Law Revision Counsel. 18 U.S.C. 1343 – Fraud by Wire, Radio, or Television The report identifies which statutes appear to have been violated, allowing legal counsel to determine the most effective path forward.
When a case goes to trial, the fraud examiner often serves as an expert witness. Federal Rule of Evidence 702 allows a person qualified by knowledge, skill, experience, training, or education to offer specialized opinions that help the jury understand the evidence. Before that testimony reaches the jury, the trial judge acts as a gatekeeper under the Daubert standard, evaluating whether the examiner’s methods can be tested, have been subjected to peer review, have a known error rate, and are generally accepted within the field. Examiners who rely on established forensic accounting methods and documented analytical procedures typically clear this bar.
Testimony itself often involves visual aids: flowcharts showing how money moved through shell companies, timelines of fraudulent transactions, side-by-side comparisons of legitimate and fabricated records. The examiner’s job on the stand is to translate financial complexity into something a jury can follow. Cross-examination will probe every step, from how evidence was preserved to whether the conclusions could have alternative explanations. Examiners who built their case on a solid chain of custody and well-documented methodology hold up. Those who cut corners get exposed.
Supporting Criminal Referrals and Civil Recovery
Once the investigation wraps up, the victimized organization faces a choice: pursue criminal prosecution, seek civil recovery, or both. The paths aren’t mutually exclusive, but they involve different standards and outcomes, and the examiner’s work supports both.
Criminal Referrals
Organizations that discover fraud involving employees typically must report it regardless of the dollar amount. Federal regulations require reporting any known or suspected criminal activity by insiders, including theft, embezzlement, and misapplication of funds, no matter how small. When the suspect is an outsider, reporting thresholds of $5,000 or $25,000 apply depending on whether the organization can identify a suspect.7eCFR. Part 612 Standards of Conduct and Referral of Known or Suspected Criminal Violations Financial institutions have additional obligations to file Suspicious Activity Reports with FinCEN. Criminal prosecution requires proof beyond a reasonable doubt, which is why the examiner’s evidence preservation and documentation work is critical.
Civil Recovery
Civil suits offer a different set of tools. The burden of proof drops to a preponderance of the evidence, essentially more likely than not, making it easier for the victim to prevail. Civil cases also allow recovery of compensatory damages, interest, professional service fees, and in some cases punitive damages, categories that criminal restitution orders often don’t cover.8Office for Victims of Crime. PSVF Chapter 3 – Services for Fraud Victims
Civil recovery may be the only financial option when the U.S. Attorney’s Office declines prosecution, which happens regularly with smaller-dollar cases. Fraud examiners play a key role here by tracing where the stolen funds ended up. They look at the perpetrator’s bank accounts, real property, investment holdings, and lifestyle purchases. In federal cases, the government can seek a writ of attachment to freeze the debtor’s property, anything except earnings, to prevent dissipation while the lawsuit is pending.9Office of the Law Revision Counsel. 28 U.S. Code 3102 – Attachment The attachment creates a lien that lasts until the court enters or denies a judgment.
Statutes of limitations apply to civil claims, and letting them lapse can permanently bar recovery no matter how strong the evidence. That’s one reason organizations bring in fraud examiners early. A single investigation produces the evidence needed for both criminal and civil proceedings, preserving every option.
Who Qualifies as a Fraud Examiner
The standard professional credential in this field is the Certified Fraud Examiner (CFE) designation, awarded by the Association of Certified Fraud Examiners. Earning it requires a combination of education and experience. Most applicants hold at least a bachelor’s degree, which counts for 40 of the 50 qualifying points. Applicants without a degree can substitute two years of fraud-related work experience for each year of academic study. Regardless of education, everyone needs at least two years of professional experience in fraud detection or deterrence before the credential is awarded.10Association of Certified Fraud Examiners. CFE Credential Eligibility
The CFE exam itself covers three sections as of June 2026: Fraud Schemes and Financial Crimes, Fraud Investigations and Legal Issues, and Fraud Prevention and Deterrence.11Association of Certified Fraud Examiners. About the CFE Exam The breadth reflects the actual work. Examiners need to understand both the accounting mechanics of a billing scheme and the legal requirements for preserving evidence that holds up at trial.
Certified Fraud Examiners are bound by a Code of Professional Ethics that shapes everything described above. They must accept only assignments where they can perform competently, testify truthfully without bias, keep information confidential unless properly authorized to disclose it, and reveal all material facts discovered during an examination, including inconvenient ones. No examiner may express an opinion on guilt or innocence. That ethical framework is what separates a fraud examiner from an advocate: the job is to find the truth, document it, and let the legal system decide what to do with it.