Spotting cash receipts fraud on the CFE exam is like being a triage nurse. You're not just identifying an injury; you're pinpointing when it happened relative to the patient's arrival to determine the right treatment. This single judgment, the timing of theft relative to the accounting records, is what separates a pass from a fail on CFE Section 1.
Cash receipts schemes are thefts of incoming funds. Skimming is the theft of cash before it is recorded (off-book), leaving no audit trail. Cash larceny is the theft of cash after it is recorded (on-book), creating a cash shortage. Register disbursements conceal theft by creating a fake transaction, like a refund or void, to make the cash drawer balance.
Key facts
- Official Body
- Association of Certified Fraud Examiners (ACFE).
- Exam Sections
- 4 sections: Financial Transactions & Fraud Schemes, Law, Investigation, Fraud Prevention & Deterrence.
- CFE1 Focus
- Analysis of fraud schemes, including asset misappropriation, corruption, and financial statement fraud.
- Pass Rate
- The ACFE does not publish official pass rates, but the pass rate is widely estimated to be between 65% and 70%.
- Study Hours
- Most candidates report studying for 80-120 hours.
- Median Salary
- The 2022/2023 ACFE Compensation Guide for Anti-Fraud Professionals reports a median base salary of $92,000 for CFEs in the U.S.
What's the Core Difference Between Skimming, Larceny, and Register Disbursements?
The entire CFE exam tests judgment, not just memorization. For cash receipts schemes, that judgment boils down to one question: where is the cash on its journey from the customer's hand to the company's bank account when the thief strikes? Your ability to pinpoint that moment determines the classification. Try VoraPrep's free CFE practice questions to see how this judgment is tested.
The key is the source document. Did one ever exist? Is it real but unmatched by cash? Or is it a complete fabrication?
Skimming: Theft Before the Books
Skimming is the theft of cash before it enters the accounting system.
Studying for CFE? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Because no record of the sale is made, there is no source document. The company is unaware the revenue was ever earned. This makes skimming an "off-book" scheme, notoriously difficult to detect with standard accounting reconciliations. You can't find a discrepancy if the transaction never existed in the first place.
- Sales Skimming: A cashier pockets cash from a sale and never rings it up. The customer leaves, and the business has no record of the transaction.
- Receivables Skimming: This is more complex. It includes schemes like "lapping," where an employee steals Customer A's payment, then applies Customer B's payment to A's account, then Customer C's to B's, and so on. The theft is hidden in the constantly shifting accounts receivable balances.
Cash Larceny: Theft After the Books
Cash larceny is the theft of cash that has already been recorded in the accounting system.
This is an "on-book" scheme. A legitimate source document exists (like a register tape or a posted accounts receivable payment), but the cash itself is stolen. This always creates an imbalance. The books show cash that isn't physically there.
- Larceny from the Register: An employee rings up a sale, and after the customer leaves, they simply open the drawer and take cash. The register tape shows the sale, but the cash drawer will be short.
- Larceny from the Deposit: An employee steals cash from the daily bank deposit after the deposit slip has been prepared but before it gets to the bank. The company's records show a certain deposit amount, but the bank statement will show a smaller one.
Register Disbursements: Theft Hidden by Fake Records
Register disbursements are a distinct form of on-book fraud where the thief creates a false transaction at the cash register to justify the removal of cash.
The goal is to make the cash drawer balance with the register tape, leaving no immediate cash shortage. The fraudster creates a fake source document to cover their tracks.
- False Refunds: An employee processes a refund for a non-existent return and pockets the cash. A fake refund slip is created, and the register tape shows a legitimate-looking disbursement.
- False Voids: A cashier rings up a sale, gives the customer their items, and then voids the sale after the customer leaves, pocketing the cash. The void slip makes the cash removal appear authorized.
The table below summarizes these critical distinctions.
| Feature | Skimming | Cash Larceny | Register Disbursements |
|---|---|---|---|
| Timing of Theft | Before cash is recorded | After cash is recorded | Cash removed via a false transaction |
| Source Document | None created | Exists, but cash is missing | Falsified to cover theft |
| "On/Off-Book" | Off-book | On-book | On-book |
| Detection Method | Indirect (inventory counts, margin analysis) | Direct (cash reconciliation, deposit slips) | Transaction analysis (reviewing voids/refunds) |
For a deeper look at how these schemes compare to others, see our guide to CFE Section 1 fraud schemes.
Calculate Your CFE Score & Study Hours by Domain
Adjust your practice scores across official CFE blueprint domains to predict your pass probability and generate a domain-weighted study schedule.
How to Solve a Cash Receipts Scheme Question Step-by-Step
Exam questions will give you a scenario and force you to classify it. Don't get lost in the details. Follow this process.
Later that day, his manager asks him to prepare the bank deposit. The deposit slip totals $2,500 based on the day's sales tapes. On the way to the bank, Alex removes $100 from the deposit bag and deposits only $2,400.
Which schemes did Alex commit?- Analyze the first incident (the drill return):
- Question: Was the cash stolen before or after being recorded? It was stolen after the initial sale was recorded.
- Question: How was the theft concealed? Alex created a false source document (a fake return slip) to justify removing the $50. The register tape and cash drawer will balance.
- Conclusion: This is a classic Register Disbursement.
- Analyze the second incident (the bank deposit):
- Question: Was the cash stolen before or after being recorded? The $2,500 was recorded on the deposit slip. The theft of $100 happened after this recording.
- Question: How was the theft concealed? It wasn't, really. He just took the money. There is no fake transaction covering the missing $100. This will create a discrepancy between the deposit slip ($2,500) and the bank statement ($2,400).
- Conclusion: This is Cash Larceny (specifically, larceny from the deposit).
- Evaluate the answer choices:
- A. Register Disbursement and Skimming. (Incorrect, the second act was larceny).
- B. Cash Larceny and Register Disbursement. (Correct, matches both conclusions).
- C. Only Cash Larceny. (Incorrect, misses the register disbursement).
- D. Only Register Disbursement. (Incorrect, misses the cash larceny).
What Are the Most Common Traps for These Schemes on the Exam?
Candidates who fail often know the definitions but can't apply them under pressure. The exam writers know exactly how to exploit this gap.
The biggest trap is focusing on where the cash was stolen (e.g., the register) instead of how the theft was concealed. Both cash larceny and register disbursements can happen at the register, but they are fundamentally different schemes.
Always ask: did the thief create a fake transaction to cover their tracks?
- Yes -> Register Disbursement
- No -> Cash Larceny
Another trap is getting the timing of "recorded" wrong. "Recorded" means entered into the company's formal accounting system. If a salesperson collects cash in the field and pockets it before submitting their daily report, that's skimming. The cash never made it onto the official books, even though the employee received it.
Use this simple decision tree to cut through the noise on exam day.
This mental model forces you to answer the two critical questions that unlock every cash receipts scheme problem.
How Can I Master These Concepts in One Week?
Building true judgment requires active practice, not passive reading. Use this 7-day plan to lock in these concepts for your 2026 CFE exam.
- Day 1-2: Master the Concepts. Use VoraPrep's interactive lessons to learn the precise definitions and concealment methods. Don't just read; engage with the embedded questions and decision trees that force you to apply the rules.
- Day 3-4: Targeted Practice. Complete at least 50 practice questions specifically on cash receipts schemes. VoraPrep's adaptive engine will identify if you're confusing larceny and register disbursements and serve you more questions on that specific weakness until you master it. Read every explanation.
- Day 5: Analyze Scenarios. Write five of your own short fraud scenarios. Classify each one and write a one-sentence justification. If you're unsure, ask Vory, your 24/7 personal tutor, to review your logic and correct your thinking.
- Day 6: Reinforce with Flashcards. Use VoraPrep's spaced-repetition flashcards to drill the key attributes of each scheme. This moves the core rules from short-term to long-term memory.
- Day 7: Mixed Review Quiz. Take a timed 25-question quiz covering all of CFE Section 1. This forces you to switch contexts and identify these schemes when they are mixed in with other topics, just like on the real exam.
This active-recall approach is proven to build the durable knowledge you need. For more details on the full CFE exam, see our official VoraPrep information page.
Ready to Pass Your CFE Exam? Stop memorizing and start thinking like a fraud examiner. VoraPrep offers a complete 6-pillar interactive course with textbook-grade lessons, thousands of adaptive practice questions, 1:1 exam simulators, and Vory, your 24/7 personal tutor. Our system is designed to build your judgment, not just your memory.
Visit voraprep.com to get started and see why we're the most effective way to prepare for the CFE exam.
Start Your Free 14-Day Trial at voraprep.com →