The classification is not a filing system. Each branch describes a different evidence trail, and one of them describes no trail at all.
Start a conversation with the Forensic Concierge, already scoped to anatomy of fraud schemes. Pick a starting point, or describe the matter directly.
The ACFE’s Occupational Fraud and Abuse Classification System — universally called the Fraud Tree — is the shared vocabulary of this field, and it is worth learning properly, because a wrong leaf name tells a practitioner immediately that the writer is an outsider. But its practical value is not taxonomic. Each branch predicts where the evidence sits: fraudulent disbursements leave a payment record and a payee; skimming leaves nothing, because the money left before the accounting system saw it; corruption often leaves nothing inside the victim entity at all; financial statement fraud leaves everything inside the books and almost nothing outside them. Frequency and severity also run in opposite directions, so the schemes that appear most often are not the ones that cost most.
Six structural features of the taxonomy that change how a matter is worked, rather than how it is labeled.
Corruption, asset misappropriation and financial statement fraud. A single case can involve one, two or all three, which is why the frequencies exceed 100% and why the tree is not a pie chart.
The ACFE defines skimming as theft of an incoming payment before it is recorded, and cash larceny as theft after. In Occupational Fraud 2024 each appeared in 10% of cases, with medians of $43,000 and $50,000 — near-identical numbers, completely different provability.
Billing, payroll, expense reimbursement, check and payment tampering, and register disbursements. Billing is the most common of them — 21% of all cases, $90,000 median (Occupational Fraud 2026, Fig. 5).
Check 21 took effect on 28 October 2004 and originals are now typically destroyed after imaging, so the detective control that historically caught check tampering — the owner reviewing returned checks with the statement — has largely gone. The branch is Check and Payment Tampering, which reaches electronic payment redirection as well as the paper instrument.
The Justice Department says collusion can be established by direct evidence such as participant testimony, or by circumstantial evidence such as suspicious bid patterns, travel and expense reports, telephone records and business diary entries. Almost none of it is an accounting record.
Overstatement and understatement run across the same five categories — timing differences, revenue, liabilities and expenses, asset valuations and disclosures — with the leaf names inverted: fictitious against understated revenues, concealed against overstated liabilities and expenses. The SEC’s Sunbeam administrative proceeding alleged three techniques at once: cookie-jar reserves, bill-and-hold sales in which the company typically also paid the costs of storage, shipment and insurance, and channel stuffing. Understatement is the branch that appears in divorce, oppression and tax matters.
How a scheme family is identified from the records that survive.
The classification decides the shape of the matter in its first fortnight.
The ACFE defines skimming as theft of an incoming payment before it is recorded on the organization’s books. Money that never entered the accounting system produces no entry to flag and no discrepancy to reconcile. The books will balance whether or not the scheme ran, which is why proof has to come from somewhere else entirely.
No, and it is worth being precise about what it is. It is the ACFE’s classification system, which grew out of the first Report to the Nation on Occupational Fraud and Abuse in 1996. ACFE founder Joseph T. Wells set out to describe how occupational fraud is actually committed; John Warren, now the ACFE’s chief executive, worked directly with him, reading more than 2,000 case details submitted by certified fraud examiners and sorting the paper surveys by scheme type. Wells later described the result as a study of 2,608 cases sorted into the categories he called the fraud tree. It is a shared professional vocabulary and a research instrument, not a legal test — no element of any fraud claim requires placing conduct on a branch.
Because a single case can involve more than one branch, and many do — a kickback arrangement funded through a shell-company vendor and concealed with fraudulent entries touches all three. In Occupational Fraud 2026: A Report to the Nations, asset misappropriation appeared in 90% of cases, corruption in 45% and financial statement fraud in 6%. Median losses run the other way: roughly $100,000, $150,000 and $1,000,000 respectively. Frequency and severity are inverted, which is why any presentation of these categories as a pie chart is wrong twice over — it implies exclusivity the data does not have, and it invites readers to treat the most common schemes as the most consequential.
Skimming and corruption, for the same underlying reason. Skimming produces no accounting entry, so there is nothing to test inside the victim’s system and the case rests on inference from independent operational data — which is also exactly where a defense should attack it. Corruption is worse still: in a kickback or bid-rigging arrangement the payment frequently never touches the victim’s accounts, so the general ledger is simply the wrong place to look. Note also that the Justice Department says of its own collusion indicators that they are not proof of collusion, and gives the innocent explanation — a deliberately high bid from a contractor too busy to want the work. Red flags establish a basis to investigate, not liability.
By whether goods actually arrived. Detection of the shell-company variant usually begins in the vendor master file rather than in any single invoice, because it is the entity, not the transaction, that fails to hold up: vendor bank details matching an employee’s, a PO box as the only address, missing or inactive telephone numbers, a new vendor absorbing high volume, service-only invoices with non-specific descriptions, amounts just under an approval threshold, and unbroken sequential invoice numbering, which suggests the vendor bills few or no other customers. No single indicator is dispositive; these tests generate high false-positive rates in isolation. The harder variant is the pass-through, where a controlled intermediary buys real goods from a genuine supplier and re-invoices at an inflated price. The goods arrive, the three-way match reconciles cleanly, and only the margin is in question.
Describe what is alleged to have happened and where. The Institute will help you see which scheme family it resembles and what evidence that family leaves.