Case Studies
Real engagements: how the allegation arose, how the evidence was gathered and how the conclusion was built — step by step, on ACFE principles.
All cases are drawn from real engagements conducted by Prosecure and anonymized for confidentiality.
Every case runs on the same discipline.
The ACFE (Association of Certified Fraud Examiners) methodology defines five steps that carry an allegation to a conclusion built on evidence, not opinion. The cases below show how these steps work in the field.
Predication
An examination begins only when there is a reasonable, concrete basis; rumor alone does not open a case.
Hypothesis and plan
A “what may have happened” hypothesis is formed and tested. Fraud is never the only hypothesis; operational causes are on the table too.
Documents and data
Evidence is gathered first from documents and data. Its integrity is preserved; the chain of custody determines how defensible the report is.
Interviews
Interviews are planned from the periphery to the center: neutral witnesses first, corroborating witnesses next; the subject of the allegation last.
Findings and report
The report states verified findings, not opinion. An allegation that is not substantiated is a conclusion in its own right.
The service behind the method: Fraud Investigation →
A payment and procurement scheme in an overseas operation was uncovered
In the overseas operation of a domestic holding group, an internal tip alleged that payments to the main supplier were being reported to headquarters as made when they were not, and that the procurement chain was being manipulated.
Examination steps
The tip named a specific supplier, period and transaction type; a verifiable allegation established the basis for an examination.
Payments reported to headquarters were reconciled against supplier records; interviews moved from the periphery to the center, guided by what the document review and data analysis surfaced.
The irregularity was not a single transaction but a pyramid-like payment scheme involving multiple employees. The number of perpetrators and the financial scale exceeded management’s initial estimate.
The individuals, the method and the financial impact were reported with concrete evidence; the ongoing scheme was stopped, preventing recurring losses. The findings provided a basis for legal proceedings.
A serious whistleblower report was shown to be unfounded
In the Türkiye operation of a global consumer brand, a whistleblower alleged that certain retail locations were being deliberately closed and reopened elsewhere to damage the company for private gain.
Examination steps
The report pointed to specific locations and decisions. The examination was built to test the allegation, not to prove it; the presumption of innocence applied to the managers involved.
The commercial rationale behind the closures and openings was cross-tested against financial records, independent market data and management interviews.
The decisions were consistent with market conditions, and no personal-interest link existed between the decision-makers and the new locations. The allegation was not supported on any line of evidence.
The report was found to be unfounded. Wrongful disciplinary action was prevented, and confidence in the country leadership and its decisions was restored.
A record discrepancy was confirmed not to be fraud
At the main storage facility of a global energy company in Türkiye, records showed recurring discrepancies, and off-the-books sales to tanker trucks were alleged.
Examination steps
The record gaps were measurable and recurring; suspicion was reasonable. But the hypothesis table included operational causes alongside fraud — fraud is never the only hypothesis.
Inventory and volume data were analyzed by period; the complex operational setup was examined on site and cross-tested against sales records.
The discrepancies were shown to stem not from unrecorded sales but from gas expansion driven by seasonal conditions.
No finding of fraud; no one was wrongfully accused. Measurement and record-keeping procedures were recommended to account for the seasonal effect.
An investor bidding on real estate was found to be a shell
An international real-estate development group received a purchase offer for high-value properties from a foreign investment company. Everything known about the counterparty came from the counterparty’s own statements.
Examination steps
The gap between the size of the transaction and the amount of verified information called for independent pre-transaction due diligence. The trigger here was not suspicion but professional skepticism.
Corporate records, ultimate beneficial ownership (UBO), litigation and sanctions records and reputation were researched at the source, across multiple countries.
The company and its managing director were found to be running fraud operations under different names in different countries; the declared financial portfolio did not exist, and the structure was entirely a shell.
Negotiations were terminated before any transaction took place, keeping the group out of a deal that could have caused severe financial and reputational harm.
Forged education and criminal-record documents were caught in pre-employment screening
An international company operating in human resources and staffing runs a continuous program with Prosecure to verify candidate documents at the source in high-volume hiring of domestic and foreign candidates.
Examination steps
The basis here is not a single suspicion but a systematic risk: hiring on the candidate’s word alone leaves the door open to forged documents. Verification is therefore built as a process, not a one-off case.
Education, criminal-record and résumé information is confirmed with the issuing institution, not taken from the candidate. For foreign candidates, verification goes to the sources in the relevant country.
Over the course of the program, numerous forged education and criminal-record documents and résumé inconsistencies were detected; some were professionally produced and indistinguishable from genuine documents at first glance.
High-risk candidates were identified before hiring decisions were made. The company decides knowing who its candidates really are; the program has run for years.
For confidentiality, company, individual, country and amount details are not disclosed; sectors are generalized and events are summarized in anonymized form.
A supplier's beneficial owner was identified before signature
Ahead of a high-volume supply agreement, a corporate group wanted to verify who it was really contracting with. The relationship between the visible ownership structure and actual control was unclear.
Examination steps
The size of the contract, combined with the fact that everything known about the supplier rested on its own statements, called for independent verification before signature.
Public trade-registry records, the ownership chain and open-source research were analyzed together; visible ownership was separated from actual control.
Behind the visible ownership, actual control by a beneficial owner with a problematic commercial history was identified.
The findings were reported to management before signature; contract terms were reassessed and the group made its decision without entering a risky dependency.
A partner in a high-risk country was approved with confidence
There were negative rumors about a prospective partner in a country considered high-risk. The decision was to be made on verified information, not hearsay.
Examination steps
The country's risk profile and market rumors required the claims to be independently tested before closing the door on the partnership.
Publicly available sanctions lists, politically exposed person (PEP) data and media archives were screened; the corporate structure was verified against official registries.
None of the alleged issues were supported by verifiable records; the corporate structure and commercial history proved consistent.
The partnership was established with confidence, backed by contractual safeguards for reputational risk; the opportunity was not lost to rumor.
Limited risk in a prospective distributor, managed through contract safeguards
The assessment of a distributor candidate produced a picture that was neither fully clean nor disqualifying. Structuring the decision correctly depended on clarifying the nature of the risk.
Examination steps
Uncertainty in financial strength and reputational indicators made an unconditional start to the relationship risky.
Financial documents shared with the candidate’s consent were analyzed together with publicly available registry and reputation records; the source and likely impact of the risk were separated and reported.
Partial financial weakness and limited adverse findings were identified; no disqualifying risk was confirmed.
The relationship was launched with collateral and performance clauses added; periodic monitoring of the identified indicators was recommended.
A chain of below-value property transfers made ahead of litigation was uncovered
In a receivables dispute, the debtor claimed inability to pay. The records showed striking transfer activity in the period just before the dispute.
Examination steps
The mismatch between the claimed inability to pay and the historical asset picture called for the transfer activity to be examined.
Land-registry records accessed lawfully within the scope of the litigation file, public trade-registry data and related-party information were analyzed together; transfer dates were cross-referenced with the dispute chronology.
A chain of transfers to related parties, made just before the dispute at notably low values, was documented from the records.
The findings were reported to the legal team in a form usable in litigation strategy; recovery efforts were redirected toward tangible assets.
The true beneficial owner behind an offshore structure was documented for arbitration
In an arbitration, the counterparty's assets sat behind a multi-layer offshore structure. Whom the structure really served was the key question in the file.
Examination steps
The arbitration strategy required the true beneficial owner behind the visible corporate layers to be established in a verifiable way.
The multi-layer structure was resolved step by step through international public company registries, open-source data and documents submitted within the case file, with findings cross-linked at each layer.
The true beneficial owner behind the visible ownership, and the link to the assets, were established with a documented chain usable in arbitration.
The findings entered the arbitration file as evidence; the balance of negotiation shifted in the client’s favor.
A debtor's undisclosed company shares and income sources were mapped
In a recovery matter, the debtor's declared position did not match the observable standard of living. Finding the missing pieces would open the way for strategy.
Examination steps
The gap between declaration and observable reality called for a systematic sweep for undeclared assets.
Company shares and income sources were traced beyond the declared picture through public registry records, commercial footprints and open-source data; areas obtainable only through lawful legal channels were separately flagged.
Undeclared company shares and income trails were identified from the records; the picture was partially completed, with areas requiring formal legal requests left to the appropriate channels.
Accessible assets were prioritized into a staged recovery strategy; monitoring was recommended for the areas left open.
Two seemingly independent companies were documented as answering to the same decision-maker
In a commercial lawsuit, the counterparty argued that two companies were independent of each other. The course of the file depended on testing that claim.
Examination steps
The alleged de facto relationship between the two companies sat at the center of the litigation strategy; rebutting the defense required a verifiable link.
Public trade-registry records, published signature authorities and commercial footprints were examined together; the decision-making chain was mapped through cross-referencing.
It was documented, through authority and transaction trails, that both companies acted under the same individual on critical decisions.
The findings were reported in court-ready form; the "independence" defense was left without foundation.
In a shareholder dispute, the sequence of key decisions reversed the claim
In a partnership dispute, the parties described the same events in different orders. Which decision came first would determine where the fault lay.
Examination steps
With claim and defense building different chronologies on the same facts, an independent timeline became the key to the file.
Corporate changes, transfers of authority and transaction dates were verified from public records and documents submitted within the file, then merged into a single timeline.
The documented sequence of key decisions showed events running contrary to the asserted narrative; the chain of fault changed direction.
The chronology report proved decisive in negotiation; the file progressed on ground favorable to the client.
In a cross-border matter, accessible sources proved limited and the scope was redefined
Verifying an expected connection was the goal in a cross-border file. The target jurisdiction's records regime limited access from the outset.
Examination steps
File strategy required the limits of accessibility to be tested honestly before investing in documenting the connection.
The target jurisdiction's records regime, accessible sources and alternative verification routes were systematically surveyed.
Because the records were closed to the public, the expected connection could not be verified; the accessible trails were limited and insufficient on their own.
The result was reported plainly; the scope was narrowed to verifiable areas and the file’s resources were redirected to lines likely to produce results.
A finance director candidate's diploma could not be verified at its source
A candidate in the final stage for a key finance position listed a bachelor's degree on their résumé. Pre-employment verification was initiated as standard practice.
Examination steps
The position's level of financial authority made source-verification of the education claim essential.
With the candidate's consent, the stated diploma was checked against the records of the issuing institution.
No graduation record was found at the institution; the document did not correspond to any genuine record.
The hiring process was stopped before the offer stage; the risk of a fraudulent claim reaching a key position was prevented.
A key-position candidate's undisclosed criminal record was identified
The candidate had declared on the application form and in the interview that they had no criminal record. Given the nature of the position, the declaration was verified.
Examination steps
In positions of trust, a criminal-history declaration is an area to be closed with records, not statements.
With the candidate's consent, the criminal record was queried at the official source and compared with the declaration.
Contrary to the declaration, a record directly relevant to the position was identified; the inconsistency was documented.
The decision was left to management with a verified picture; the company was protected from a trust risk it would otherwise have assumed unknowingly.
Two employers missing from the social-security record were reasonably explained
The candidate's social-security statement showed two short-term employers absent from the résumé. The inconsistency was treated as a matter for explanation, not automatic rejection.
Examination steps
The gap between the statement and the résumé needed to be clarified without presuming bad faith — and without leaving it open.
The records were shared with the candidate; the context of the short stints was taken in an interview and cross-checked through reference calls.
The omission proved not to be concealment: it stemmed from short transition periods, explained consistently and plausibly.
The candidate remained in the process; the file was closed on a verified and explained picture.
No case starts overnight.
What the five cases share: the signals were there before the event. Global data shows the same pattern:
84%
84% of perpetrators had displayed at least one red flag before the event.
43%
43% of cases come to light through a tip — the most effective detection channel.
12 mo
Detecting a fraud takes a median of 12 months.
5%
Organizations lose an estimated 5% of revenue to fraud each year.
Source: ACFE, Occupational Fraud 2026: A Report to the Nations
What separates Case 1 from Case 3 is the method.
The same discipline proves fraud in one case and clears a manager of a wrongful accusation in another. Early detection matters: cases caught within six months show a median loss of $40,000; cases running past five years exceed $1.1 million (ACFE 2026).
If one of these cases happened to you, how prepared is your organization?
The ACFE fraud triangle: Pressure · Opportunity · Rationalization — plus Process/Records · Conflicts of interest · Compliance and Governance; a 0–100 score across six areas.
The question is not only “is there fraud in the organization?” but how exposed the organization’s structure is to it. A 21-question preliminary assessment makes the critical risk indicators visible.
21 questions
Structured assessment
~5 minutes
Quick preliminary check
Preliminary risk analysis
A starting point for expert work
✓Aligned with ACFE principles · ~5 minutes · downloadable PDF report
The simulator does not replace an investigation; it helps identify risk areas that may require expert examination.
The services behind these cases
Three service lines carried the five cases. Every engagement is run at founder level, built on evidence and handled in confidence.
Fraud Investigation
The discipline in Cases 1, 2 and 3: uncovering who, how and through which connections — on evidence.
Explore the service →
Third-Party Risk Management
The discipline in Case 4: independent due diligence on partners, suppliers and investors before the decision.
Explore the service →
Employment Background Check
The discipline in Case 5: verifying candidate statements at the source; catching forged documents before hiring.
Explore the service →If the loss has already occurred: Asset Tracing & Recovery · if you are heading to court: Litigation Support · the name behind every case: Meet the founder
About these case studies
Common questions about where the cases come from, how they are anonymized and how findings can be used.
Are these cases real?
Why are company names, countries and amounts not disclosed?
What does examining a case on ACFE principles mean?
What happens if the allegation is not substantiated?
Can the findings be used in disciplinary and legal proceedings?
What should the first step be in a similar situation?
How do we start?
Three steps: a confidential conversation, a short preliminary assessment, a jointly defined scope. Commitment begins only when the scope is approved.
Request a Preliminary Assessment →
The initial consultation is confidential and without obligation. We respond within one business day.
- 1 · Confidential first conversation — We listen to your situation, the available information and the urgency.
- 2 · Preliminary assessment and scope — Predication, risks and the state of the evidence are assessed; a scope and timeline proposal follows.
- 3 · Examination and report — The work runs on the discipline shown on this page; verified findings and recommendations are reported.