Case Studies
Five real engagements: how the allegation arose, how the evidence was gathered and how the conclusion was built — step by step, on ACFE principles.
All cases are drawn from real engagements conducted by Prosecure and anonymized for confidentiality.
Every case runs on the same discipline.
The ACFE (Association of Certified Fraud Examiners) methodology defines five steps that carry an allegation to a conclusion built on evidence, not opinion. The cases below show how these steps work in the field.
Predication
An examination begins only when there is a reasonable, concrete basis; rumor alone does not open a case.
Hypothesis and plan
A “what may have happened” hypothesis is formed and tested. Fraud is never the only hypothesis; operational causes are on the table too.
Documents and data
Evidence is gathered first from documents and data. Its integrity is preserved; the chain of custody determines how defensible the report is.
Interviews
Interviews are planned from the periphery to the center: neutral witnesses first, corroborating witnesses next; the subject of the allegation last.
Findings and report
The report states verified findings, not opinion. An allegation that is not substantiated is a conclusion in its own right.
The service behind the method: Fraud Investigation →
A payment and procurement scheme in an overseas operation was uncovered
In the overseas operation of a domestic holding group, an internal tip alleged that payments to the main supplier were being reported to headquarters as made when they were not, and that the procurement chain was being manipulated.
The tip named a specific supplier, period and transaction type; a verifiable allegation established the basis for an examination.
Payments reported to headquarters were reconciled against supplier records; interviews moved from the periphery to the center, guided by what the document review and data analysis surfaced.
The irregularity was not a single transaction but a pyramid-like payment scheme involving multiple employees. The number of perpetrators and the financial scale exceeded management’s initial estimate.
The individuals, the method and the financial impact were reported with concrete evidence; the ongoing scheme was stopped, preventing recurring losses. The findings provided a basis for legal proceedings.
A serious whistleblower report was shown to be unfounded
In the Türkiye operation of a global consumer brand, a whistleblower alleged that certain retail locations were being deliberately closed and reopened elsewhere to damage the company for private gain.
The report pointed to specific locations and decisions. The examination was built to test the allegation, not to prove it; the presumption of innocence applied to the managers involved.
The commercial rationale behind the closures and openings was cross-tested against financial records, independent market data and management interviews.
The decisions were consistent with market conditions, and no personal-interest link existed between the decision-makers and the new locations. The allegation was not supported on any line of evidence.
The report was found to be unfounded. Wrongful disciplinary action was prevented, and confidence in the country leadership and its decisions was restored.
A record discrepancy was confirmed not to be fraud
At the main storage facility of a global energy company in Türkiye, records showed recurring discrepancies, and off-the-books sales to tanker trucks were alleged.
The record gaps were measurable and recurring; suspicion was reasonable. But the hypothesis table included operational causes alongside fraud — fraud is never the only hypothesis.
Inventory and volume data were analyzed by period; the complex operational setup was examined on site and cross-tested against sales records.
The discrepancies were shown to stem not from unrecorded sales but from gas expansion driven by seasonal conditions.
No finding of fraud; no one was wrongfully accused. Measurement and record-keeping procedures were recommended to account for the seasonal effect.
An investor bidding on real estate was found to be a shell
An international real-estate development group received a purchase offer for high-value properties from a foreign investment company. Everything known about the counterparty came from the counterparty’s own statements.
The gap between the size of the transaction and the amount of verified information called for independent pre-transaction due diligence. The trigger here was not suspicion but professional skepticism.
Corporate records, ultimate beneficial ownership (UBO), litigation and sanctions records and reputation were researched at the source, across multiple countries.
The company and its managing director were found to be running fraud operations under different names in different countries; the declared financial portfolio did not exist, and the structure was entirely a shell.
Negotiations were terminated before any transaction took place, keeping the group out of a deal that could have caused severe financial and reputational harm.
Forged education and criminal-record documents were caught in pre-employment screening
An international company operating in human resources and staffing runs a continuous program with Prosecure to verify candidate documents at the source in high-volume hiring of domestic and foreign candidates.
The basis here is not a single suspicion but a systematic risk: hiring on the candidate’s word alone leaves the door open to forged documents. Verification is therefore built as a process, not a one-off case.
Education, criminal-record and résumé information is confirmed with the issuing institution, not taken from the candidate. For foreign candidates, verification goes to the sources in the relevant country.
Over the course of the program, numerous forged education and criminal-record documents and résumé inconsistencies were detected; some were professionally produced and indistinguishable from genuine documents at first glance.
High-risk candidates were identified before hiring decisions were made. The company decides knowing who its candidates really are; the program has run for years.
For confidentiality, company, individual, country and amount details are not disclosed; sectors are generalized and events are summarized in anonymized form.
No case starts overnight.
What the five cases share: the signals were there before the event. Global data shows the same pattern:
84%
84% of perpetrators had displayed at least one red flag before the event.
43%
43% of cases come to light through a tip — the most effective detection channel.
12 mo
Detecting a fraud takes a median of 12 months.
5%
Organizations lose an estimated 5% of revenue to fraud each year.
Source: ACFE, Occupational Fraud 2026: A Report to the Nations
What separates Case 1 from Case 3 is the method.
The same discipline proves fraud in one case and clears a manager of a wrongful accusation in another. Early detection matters: cases caught within six months show a median loss of $40,000; cases running past five years exceed $1.1 million (ACFE 2026).
If one of these cases happened to you, how prepared is your organization?
The ACFE fraud triangle: Pressure · Opportunity · Rationalization — plus Process/Records · Conflicts of interest · Compliance and Governance; a 0–100 score across six areas.
The question is not only “is there fraud in the organization?” but how exposed the organization’s structure is to it. A 21-question preliminary assessment makes the critical risk indicators visible.
21 questions
Structured assessment
~5 minutes
Quick preliminary check
Preliminary risk analysis
A starting point for expert work
✓Aligned with ACFE principles · ~5 minutes · downloadable PDF report
The simulator does not replace an investigation; it helps identify risk areas that may require expert examination.
The services behind these cases
Three service lines carried the five cases. Every engagement is run at founder level, built on evidence and handled in confidence.
Fraud Investigation
The discipline in Cases 1, 2 and 3: uncovering who, how and through which connections — on evidence.
Explore the service →
Third-Party Risk Management
The discipline in Case 4: independent due diligence on partners, suppliers and investors before the decision.
Explore the service →
Employment Background Check
The discipline in Case 5: verifying candidate statements at the source; catching forged documents before hiring.
Explore the service →If the loss has already occurred: Asset Tracing & Recovery · if you are heading to court: Litigation Support · the name behind every case: Meet the founder
About these case studies
Common questions about where the cases come from, how they are anonymized and how findings can be used.
Are these cases real?
Why are company names, countries and amounts not disclosed?
What does examining a case on ACFE principles mean?
What happens if the allegation is not substantiated?
Can the findings be used in disciplinary and legal proceedings?
What should the first step be in a similar situation?
How do we start?
Three steps: a confidential conversation, a short preliminary assessment, a jointly defined scope. Commitment begins only when the scope is approved.
Request a Preliminary Assessment →
The initial consultation is confidential and without obligation. We respond within one business day.
- 1 · Confidential first conversation — We listen to your situation, the available information and the urgency.
- 2 · Preliminary assessment and scope — Predication, risks and the state of the evidence are assessed; a scope and timeline proposal follows.
- 3 · Examination and report — The work runs on the discipline shown on this page; verified findings and recommendations are reported.