CFE-Investigation Exam Dumps - Certified Fraud Examiner (CFE) - Investigation

Fraud examiners can obtain documentary evidence by consent, subpoena, or other legal means. While oral consent may sometimes be sufficient,bank records from financial institutions generally require written consent. Without written consent, the bank is not required to provide access. As stated in the manual:

“Accessing a subject’s bank records from financial institutions, for instance, generally requires written consent. If no consent is given… legal action might be required, most often a subpoena or other court order”.

Thus, although the suspect gave oral consent, Alex cannot access the bank records without written authorization or legal order.

TheFraud Examiners Manuallists required steps before seizing evidence:

Obtain legal authority.

Review privacy issues.

Ensure software/hardware are validated.

Document surroundings, inspect for traps, image drives, etc.

There isno requirementto assemble a team exclusively of outside experts.

Before seizing evidence in adigital forensic investigation, the2014 International Fraud Examiners Manualoutlines several critical steps:

Obtain legal authority / review orders:

“Before obtaining evidence, ensure that there is legal authority to seize evidence and review the data associated with the evidence. This might require obtaining a warrant in a criminal matter or ensuring that internal policies authorise seizure for an internal investigation.”

Determine privacy issues:

“Before the fraud examiner can seize evidence, he must take certain steps to help ensure that the evidence will be admissible: He must determine whether there are any privacy interests in the item(s) to be searched… In every case where it becomes necessary to seize a computer or other device capable of storing digital evidence, the investigator should consult with legal counsel.”

Use only trained professionals/software:

“It is important to allow a trained examiner to conduct a proper seizure and examination of digital evidence to help ensure that the information can be used in a legal proceeding.”

✅These are allvalid required steps.

In contrast, the idea that the team must be composedonly of outside digital forensic expertsisNOT a required step. The Manual stresses flexibility in team composition:

“Some organisations have their own in-house personnel… while others might prefer the use of an outside examiner. Sometimes retrieving digital data is as easy as searching the target computer’s hard drive, but other times retrieval requires a thorough knowledge of computers.”

Thus, requiringonly outside expertsis not a standard step, since investigations may useinternal, external, or a mixof specialists depending on the situation.

TheFraud Examiners ManualandCFE Prepemphasize:

“Generally, documentary evidence, including digital evidence, will not be admitted in a legal proceeding unless it is established as authentic… Consequently, fraud examiners who collect evidence from social media must capture, download, and preserve any useful information as soon as they discover it, and they must memorialize each step of the collection process”.

Thus, preservation for authenticity is the key.

Pretexting is defined asimpersonating someone else or making false/misleading statements to obtain information. Many jurisdictions specifically prohibitpretexting against financial institutions, which includes pretending to be a customer to access their bank account information.

The2014 Fraud Examiners ManualandCFE Preplist common concealment methods:

“Some common techniques for hiding assets include transferring assets into foreign trusts, overpaying taxes, prepaying on a home mortgage, obtaining a life insurance policy, and transferring assets into someone else’s name.”

Thus, the correct answer isD.