The ACFE Fraud Tree — formally known as the Occupational Fraud and Abuse Classification System — is a systematic taxonomy developed by the Association of Certified Fraud Examiners that organizes every known type of occupational fraud scheme into a hierarchical structure. Think of it as the Dewey Decimal System for fraud: every scheme has its place, its category, and its relationship to related scheme types. For fraud examiners, investigators, and compliance professionals, the Fraud Tree provides a common language and a structured starting point for any investigation.
Created by Dr. Joseph T. Wells, the founder of the ACFE, the Fraud Tree first appeared in his 1997 textbook "Occupational Fraud and Abuse." Wells designed it to address a fundamental challenge in fraud investigation: without a consistent classification system, it was difficult to compare cases, share intelligence across organizations, or train investigators systematically. The ACFE has updated the taxonomy periodically since then to reflect new fraud schemes and evolving methods, particularly as technology has introduced new vectors for financial crime.
The Fraud Tree organizes occupational fraud into three primary branches: asset misappropriation, corruption, and financial statement fraud. Each branch contains multiple sub-branches representing more specific scheme types, which break down further into individual schemes. This hierarchical structure means a fraud examiner encountering any occupational fraud scenario can locate it within the tree, understand its characteristics, identify red flags specific to that scheme type, and apply investigation techniques appropriate to that category.
The ACFE's biennial "Report to the Nations" — the largest study of occupational fraud conducted globally — uses the Fraud Tree as its classification framework. Data collected across thousands of cases can be compared and analyzed consistently because every case is mapped to the tree. The report's statistics on how common each branch is, what the typical losses are, and which detection methods work best for each scheme type are all directly tied to Fraud Tree classifications, giving investigators benchmarks against which to measure specific cases.
Understanding the Fraud Tree is foundational for anyone pursuing the Certified Fraud Examiner (CFE) credential. The CFE exam tests knowledge of all three branches and their sub-schemes in depth across the Financial Transactions and Fraud Schemes section. Beyond exam preparation, it's a practical tool: auditors use it to design testing procedures, compliance officers use it to structure anti-fraud programs, and forensic accountants use it to frame investigative hypotheses during active engagements.
Before Wells developed the Fraud Tree, fraud investigation lacked a standardized classification system. Investigators described the same type of scheme in different terms depending on their background — an accountant might call it "revenue skimming," while a law enforcement officer might call it "theft from employer," and an attorney might frame it as "conversion of corporate assets." The absence of shared terminology made it difficult to train new investigators, compare case databases, or communicate findings consistently across disciplines.
Wells drew on his background as a former FBI agent and CPA to create a taxonomy bridging the language of accounting, law, and investigation. The result was a three-branch structure exhaustive enough to capture virtually every type of occupational fraud scheme yet simple enough to be memorized and applied in the field. The goal wasn't to complicate fraud investigation — it was to create a universal map that any fraud professional could navigate regardless of their primary discipline or industry background.
The Fraud Tree's design reflects a fundamental insight about occupational fraud: most schemes fit recognizable patterns. A payroll fraud looks like payroll fraud whether it occurs at a small nonprofit or a multinational corporation. By recognizing the pattern — and knowing where it sits in the Fraud Tree — an investigator can apply established detection and investigation techniques rather than reinventing the wheel for each case. This pattern-recognition approach is what makes the Fraud Tree valuable in practice, not just in the classroom or on a certification exam.
The ACFE updates the Fraud Tree periodically to incorporate emerging schemes. Advances in digital payment systems, cryptocurrency, and cloud-based financial infrastructure have created fraud vectors that didn't exist when the tree was first published. Each revision maintains the three-branch core structure while refining sub-categories to reflect how fraud is actually perpetrated in contemporary organizations. The latest version remains the standard reference for CFE exam content and all ACFE training curricula worldwide.
The Fraud Tree also serves a research function. By using consistent classification, the ACFE can track how the distribution of fraud schemes changes over time, how losses compare across industries, and how fraud detection methods evolve. This longitudinal data — built on decades of consistently classified cases — is one of the most valuable contributions the Fraud Tree makes to the profession, giving practitioners and researchers an evidence base that grows more reliable with each biennial report.
The most common branch (89% of cases), involving theft or misuse of organizational assets. Divided into cash misappropriation (skimming, larceny, fraudulent disbursements) and non-cash misappropriation (inventory theft, misuse of equipment). Median loss: $120,000.
Appears in 38% of cases, involving misuse of organizational position for personal gain. Sub-schemes include bribery, conflicts of interest, illegal gratuities, and economic extortion. Median loss: $200,000 — significantly higher than asset misappropriation.
The rarest branch (5% of cases) but by far the costliest. Involves intentional misrepresentation of financial reports to mislead investors, lenders, or regulators. Sub-schemes include revenue overstatement, concealed liabilities, and improper asset valuation. Median loss: $766,000.
Many fraud cases involve schemes from multiple branches simultaneously. An executive who accepts kickbacks (corruption) and also manipulates financial statements to hide the payments (financial statement fraud) represents the co-occurrence that fraud examiners must account for during investigations.
Asset misappropriation is by far the most common branch of the ACFE Fraud Tree, accounting for approximately 89% of all occupational fraud cases studied in the Report to the Nations. It involves the theft or misuse of an organization's assets — most commonly cash, but also inventory, equipment, and other property. Despite being the most frequent category, asset misappropriation typically produces the smallest median losses per case: approximately $120,000, compared to $200,000 for corruption and $766,000 for financial statement fraud.
The asset misappropriation branch divides into two major sub-categories: cash misappropriation and non-cash misappropriation. Cash schemes are more common and more studied, though non-cash schemes — involving inventory theft, misuse of company vehicles or equipment, and theft of intellectual property — are increasingly significant in knowledge-based industries. Both sub-categories share a core characteristic: the perpetrator takes something of value from the organization without authorization, typically in ways designed to evade detection or delay discovery.
Within cash misappropriation, the Fraud Tree distinguishes between two fundamentally different approaches to theft based on when the theft occurs relative to recording. Skimming occurs before cash is recorded in the organization's books — the perpetrator intercepts cash before it enters the accounting system, making detection especially difficult because there's no record of the transaction to audit against. Larceny, by contrast, occurs after cash is already recorded — the perpetrator steals from accounts or cash registers where the existence of the funds is documented, leaving an audit trail that a careful examiner can follow.
Fraudulent disbursements represent the third major sub-category of cash misappropriation and include some of the most prevalent schemes encountered in practice. Billing schemes involve creating fictitious vendors or submitting inflated invoices to divert funds to the perpetrator. Payroll schemes include ghost employees, falsified timesheet hours, and manipulated commission calculations. Expense reimbursement fraud involves submitting false, inflated, or unsupported expense reports. Check and payment tampering involves altering payee names, amounts, or bank account details on legitimate payment instruments to redirect funds.
Non-cash asset misappropriation is frequently overlooked in anti-fraud programs that focus heavily on cash controls. Inventory theft — the misappropriation of goods held for sale or raw materials — is particularly significant in retail, manufacturing, and distribution environments where physical goods move through the supply chain with less scrutiny than cash. Misuse of company assets, such as using company vehicles for personal purposes or directing company resources toward a personal side business, represents a lower-value but pervasive form of non-cash misappropriation that often escapes formal controls entirely.
Cash misappropriation divides into skimming, larceny, and fraudulent disbursements — each representing a distinct point in the cash flow cycle where theft can occur.
Skimming: Theft before recording. An employee accepts cash payment from a customer but doesn't enter the transaction in the accounting system, pocketing the difference. Common in retail, food service, and any business with significant cash transactions. Skimming is the hardest to detect because the records don't show what never got recorded — detection often requires external comparison data or analytical procedures.
Cash larceny: Theft after recording. The funds appear in the accounting system, but the perpetrator intercepts them before deposit — taking cash from a register, diverting a check after receipt, or withdrawing from a bank account. Larceny leaves a paper trail; the challenge is identifying when and by whom the funds were diverted.
Fraudulent disbursements: The organization pays funds it shouldn't, with the perpetrator controlling the payment. Includes check tampering, billing schemes with fictitious vendors, payroll fraud (ghost employees, inflated salaries), and expense reimbursement fraud. These are the most common cash scheme types in most industries.
Non-cash asset misappropriation involves stealing or misusing organizational property that isn't currency — a growing concern as asset values in knowledge-based industries include data, equipment, and intellectual property.
Inventory theft: Most prevalent in manufacturing, retail, and distribution. Employees steal inventory for personal use or resale, often using false receiving records, shipping adjustments, or collusion with external parties. Cycle count discrepancies, high shrinkage rates, and missing receiving documentation are common red flags.
Misuse of assets: Using company property — vehicles, equipment, computers — for personal purposes. Lower value per incident but pervasive. Includes diverting company work orders to personal projects or using company materials for home renovations. Controls: GPS tracking, mileage logs, equipment sign-out procedures.
Data and intellectual property theft: An emerging sub-category not fully captured in original tree versions. Employees exfiltrating client lists, proprietary formulas, trade secrets, or other valuable information. Detected through data loss prevention (DLP) tools, unusual access logs, or discovery that a competitor has acquired knowledge only the organization possessed.
Corruption schemes exploit an employee's organizational authority to generate personal gain through improper relationships or transactions rather than direct asset theft.
Bribery — receiving: An employee with decision-making authority (purchasing, contracting, regulatory compliance) accepts payments from external parties in exchange for favorable treatment. Purchasing kickbacks are the most common form — a vendor pays a percentage of contract value to the employee who awards or directs business to them.
Bribery — paying: The organization's employees pay bribes to external parties — government officials, foreign counterparts, regulatory personnel — to obtain business, permits, or favorable treatment. Creates Foreign Corrupt Practices Act (FCPA) exposure for organizations with international operations.
Conflicts of interest: Employee has an undisclosed financial interest in a transaction. A CFO who awards the organization's banking business to a bank where his brother is a senior executive has a conflict of interest — the transaction may be legitimate, but the undisclosed relationship creates a duty to disclose.
Illegal gratuities and extortion: Gratuities are payments made after a decision, rewarding past favorable treatment. Extortion involves demanding value as a condition of action or inaction — particularly problematic in procurement and regulatory contexts.
Financial statement fraud involves deliberate misrepresentation of reported financial results to create a false impression of organizational health or performance.
Revenue overstatement: The most common form. Techniques include recording fictitious sales, booking revenue before performance obligations are met, channel stuffing (forcing distributors to accept excess inventory), and round-tripping (creating circular transactions that generate apparent revenue). Pressure to meet analyst expectations or loan covenants is the typical driver.
Expense and liability concealment: Hiding costs by capitalizing expenses that should flow through income, failing to accrue known liabilities, or delaying recognition of losses. Enron's use of special purpose entities to keep debt off balance sheet is a classic example of liability concealment at scale.
Improper asset valuation: Inflating inventory values, failing to write down impaired assets to fair value, or recording fictitious assets on the balance sheet. Common in industries with significant long-lived assets or illiquid holdings where valuation is inherently subjective.
Improper disclosures: Omitting or misstating material information in the notes to financial statements — related-party transactions, contingent liabilities, going concern issues — that would affect stakeholders' understanding of the financial statements even if the numbers themselves are technically accurate.
Corruption represents the second branch of the ACFE Fraud Tree and carries a disproportionate financial impact relative to its frequency. While corruption appears in approximately 38% of occupational fraud cases, its median loss per case — around $200,000 — is significantly higher than asset misappropriation. Corruption involves an employee using their organizational position to gain an improper advantage through schemes that compromise the organization's decision-making processes rather than directly stealing its assets. This distinction matters for investigators: corruption leaves different evidence patterns than asset theft.
Bribery is the most recognizable corruption scheme and can operate in two directions. An employee may pay bribes — to win contracts, secure favorable terms from suppliers, or avoid regulatory action — or receive them, accepting payments from vendors, contractors, or competitors in exchange for favorable treatment. The ACFE Fraud Tree divides bribery into purchasing schemes, where employees with procurement authority accept kickbacks from vendors, and sales schemes, where employees accept payments to steer business or share proprietary client information with competitors.
Conflicts of interest occur when an employee has an undisclosed personal financial interest in a transaction or relationship that affects their organizational duties. A purchasing manager who awards contracts to a company owned by their spouse, without disclosing the relationship to their employer, is engaged in a conflict of interest scheme. These are particularly difficult to detect through traditional financial controls because the transactions themselves may appear entirely legitimate — the problem lies in the undisclosed relationship, not the transaction mechanics. Mandatory disclosure policies and vendor screening programs are the primary controls.
Illegal gratuities and economic extortion round out the corruption branch. Illegal gratuities differ from bribery in timing — the payment is made after a decision rather than before it, rewarding favorable treatment already given rather than purchasing it in advance. Economic extortion occurs when an employee demands something of value as a condition of taking or withholding an action within their authority. Both schemes exploit organizational authority to extract personal benefit, and both are frequently discovered through tips from the external parties who were pressured rather than through internal financial controls.
The ACFE's research consistently shows that corruption schemes run longer and generate higher losses when they involve collusion between internal employees and external parties. Collusive schemes are harder to detect because the co-conspirators can coordinate their stories, share the proceeds in ways that reduce per-person risk, and structure transactions to avoid the red flags that single-perpetrator schemes often produce. Organizations operating in high-risk procurement environments or with significant third-party relationships should prioritize corruption-specific controls accordingly.
Begin with the triggering event: a whistleblower tip, an internal control exception, an audit finding, or an unexplained financial variance. Document the specific anomaly without premature conclusions about what type of fraud may be involved.
Use the anomaly's characteristics to identify which branch or branches of the Fraud Tree the pattern is consistent with. A vendor payment anomaly suggests the asset misappropriation branch (billing schemes). Unusual favorable contract terms plus lifestyle changes suggest corruption. Implausible revenue growth suggests financial statement fraud.
For each candidate branch, develop specific scheme hypotheses based on the Fraud Tree's sub-categories. If the billing scheme hypothesis is active, consider: Is there a fictitious vendor? Are invoices inflated? Is the vendor related to an employee? Each hypothesis drives specific data requests and document examination.
Apply scheme-specific investigation techniques to test each hypothesis. Billing scheme procedures include vendor master file analysis, duplicate payment searches, vendor address matching against employee addresses, and invoice sequence analysis. The Fraud Tree guides which procedures apply to which hypotheses.
Once the scheme is confirmed, document findings using Fraud Tree classification language. This ensures consistent communication with legal counsel, law enforcement, insurers, and audit committees — and contributes to organizational learning that can prevent recurrence.
Financial statement fraud is the rarest branch of the Fraud Tree, appearing in only about 5% of occupational fraud cases, yet it generates by far the largest losses — a median of $766,000 per case, more than six times the median loss for asset misappropriation. These schemes involve intentional manipulation of an organization's financial reports to create a false impression of financial health, typically to mislead investors, lenders, regulators, or other stakeholders who rely on reported financial results to make decisions.
The most common financial statement fraud schemes involve overstating revenues: recording fictitious sales, recognizing revenue before performance obligations are met, or inflating the value of existing transactions through channel stuffing or round-trip arrangements. Conversely, understatement schemes hide liabilities, understate expenses, or conceal losses to make financial results appear stronger than reality. Asset valuation schemes manipulate the carrying value of assets on the balance sheet — recording inventory at inflated values, failing to write down impaired assets, or capitalizing expenses that should flow through the income statement immediately.
Financial statement fraud is typically perpetrated by senior management or executives who have the access and authority to override controls and influence financial reporting. This distinguishes it from most asset misappropriation schemes, which are frequently committed by lower-level employees with narrower access. The motivation is usually external: meeting earnings targets, maintaining access to credit facilities, inflating stock prices, or avoiding covenant violations on existing debt — pressures that create incentives for manipulation at the top of the organization rather than the bottom.
Detection requires techniques beyond standard financial controls. Analytical procedures — comparing reported results to industry benchmarks, historical trends, and macroeconomic data — can reveal implausible patterns that merit investigation. Digital analysis tools using Benford's Law identify suspicious distributions in financial data that manual manipulation tends to produce. External auditors, active audit committees, and well-publicized whistleblower programs are the most reliable institutional defenses, though the ACFE's data shows tips remain the single most common initial detection mechanism across all fraud types, including financial statement fraud.
The Fraud Tree's practical value extends well beyond active investigations. Internal audit departments that structure their annual risk assessments around the Fraud Tree's categories ensure coverage across all three branches — that cash disbursement controls address billing schemes and payroll schemes, that conflict-of-interest policies address corruption risks, and that financial reporting controls are designed to catch the specific manipulation techniques used in financial statement fraud. This branch-by-branch approach prevents the common mistake of focusing disproportionately on the most visible fraud types while leaving other branches undercontrolled.
Fraud awareness training built around the Fraud Tree is more effective than generic anti-fraud messaging. When employees understand that billing fraud, expense fraud, and payroll fraud are all sub-categories of asset misappropriation — and that each has specific red flags — they're better equipped to recognize and report suspicious activity. Training programs that walk through realistic scenarios for each Fraud Tree branch produce significantly higher detection rates through employee tips than programs that discuss fraud in abstract terms without connecting behaviors to scheme types.
Organizations operating in high-risk industries or regions often use the Fraud Tree to prioritize their fraud risk assessment efforts. A manufacturing company with significant inventory might weight asset misappropriation controls heavily. A government contractor subject to the Foreign Corrupt Practices Act might prioritize the corruption branch. A publicly traded company facing intense earnings pressure might invest more in controls targeting financial statement fraud. The Fraud Tree makes this risk-based prioritization explicit and defensible.
The ACFE's research shows that organizations with proactive monitoring programs, fraud-specific internal audit work plans, and employee hotlines — all structured around the Fraud Tree's categories — detect fraud in half the time and recover significantly more of their losses compared to organizations relying on reactive controls. The difference between a $120,000 median loss and a multi-million dollar fraud is often the presence of a Fraud Tree-informed control environment that catches patterns early rather than waiting for the scheme to collapse under its own weight.
The CFE exam's Financial Transactions and Fraud Schemes section tests the Fraud Tree extensively. Expect scenario-based questions that present a fraud fact pattern and require you to identify the correct branch, sub-branch, and scheme type. Common exam formats include: identifying whether a scheme is skimming vs. larceny vs. fraudulent disbursement; determining whether a corruption scenario is bribery vs. conflict of interest vs. illegal gratuity; and distinguishing financial statement fraud sub-types. Memorize the tree's structure — branch names, sub-branch names, and the defining characteristic of each scheme type. Practice applying the tree to novel fact patterns, not just memorizing definitions. The exam rewards the ability to classify quickly and accurately under time pressure.