Fraud Examination, 3E
Chapter 7: Investigating Theft Acts
COPYRIGHT © 2009 South-Western, a part of Cengage Learning
Learning Objectives
• Discuss theft investigation methods and
how they are used to investigate suspected
fraud.
• Understand how to coordinate an
investigation, using a vulnerability chart.
• Describe the nature of surveillance and
covert operations.
• Understand the effectiveness of invigilation
to investigate fraud.
2
Learning Objectives
• Explain how to obtain physical evidence
and how it can be used in a fraud
investigation.
• Understand how to seize and analyze
electronic information from cell phones,
hard drives, e-mail, and other sources.
• Use trash and other social engineering
methods to investigate fraud.
3
Fraud Investigation Methods
1.
2.
3.
4.
Theft Investigative Methods
Surveillance and covert operations
Invigilation
Seizing and searching computers
Physical evidence
Concealment Investigative
Methods
1. Document examination
2. Audits
3. Electronic searches
4. Physical asset counts
Conversion investigative
Methods
1. Searching public records
2. Online resources
3. The net worth method
Inquiry Investigative Methods
1. Interviews and interrogation
2. Honesty testing
4
Theft Act Investigative Methods
Methods that directly investigate the fraud
act
Examples:
• Surveillance and covert operations
• Invigilation
• Obtaining physical evidence
• Gathering electronic evidence
5
Theft Act Investigative Methods
The three types of surveillance:
(1) stationary or fixed point
– Record events occurring at a scene
– Log includes time, place, and events
(2) moving or tailing
– Following the suspect
– Should only be done by professionals
(3) electronic surveillance
– Video camera
6
Theft Act Investigative Methods
Invigilation
Involves close supervision of suspects during
an examination period
Strict temporary controls are implemented
so that committing fraud is almost
impossible
7
Theft Act Investigative Methods
Physical Evidence
Involves analyzing objects such as:
• inventory, assets, and broken locks
• substances such as grease and fluids
• traces such as paints and stains
• impressions such as cutting marks, tire
tracks, and fingerprints or searching
computers
8
Theft Act Investigative Methods
Steps to Gather Electronic Evidence
Secure the device and perform initial tasks
Clone the device and calculate a CRC checksum
Search the device manually
Search the device using automated procedures
vice and perform initial tasks
9
Theft Act Investigative Methods
E-mail Systems
Many copies may exist (sender, receiver, email server)
Includes text messaging in certain countries
Web-based e-mail (Hotmail, GMail, Yahoo!
Mail) is more difficult to search
10