1. Fraud Examination, 3E Chapter 7: Investigating Theft Acts
COPYRIGHT © 2009 South-Western, a part of Cengage Learning

2. Learning Objectives
Discuss theft investigation methods and how they are used to investigate suspected fraud.
Understand how to coordinate an investigation, using a vulnerability chart.
Describe the nature of surveillance and covert operations.
Understand the effectiveness of invigilation to investigate fraud.

3. Learning Objectives
Explain how to obtain physical evidence and how it can be used in a fraud investigation.
Understand how to seize and analyze electronic information from cell phones, hard drives, , and other sources.
Use trash and other social engineering methods to investigate fraud.

4. Fraud Investigation Methods
Theft Investigative Methods
Surveillance and covert operations
Invigilation
Seizing and searching computers
Physical evidence
Concealment Investigative Methods
Document examination
Audits
Electronic searches
Physical asset counts
Conversion investigative Methods
Searching public records
Online resources
The net worth method
Inquiry Investigative Methods
Interviews and interrogation
Honesty testing

5. Theft Act Investigative Methods
Methods that directly investigate the fraud act
Examples:
Surveillance and covert operations
Invigilation
Obtaining physical evidence
Gathering electronic evidence

6. Theft Act Investigative Methods
The three types of surveillance:
stationary or fixed point
Record events occurring at a scene
Log includes time, place, and events
moving or tailing
Following the suspect
Should only be done by professionals
electronic surveillance
Video camera

7. Theft Act Investigative Methods
Invigilation Involves close supervision of suspects during an examination period Strict temporary controls are implemented so that committing fraud is almost impossible

8. Theft Act Investigative Methods
Physical Evidence
Involves analyzing objects such as:
inventory, assets, and broken locks
substances such as grease and fluids
traces such as paints and stains
impressions such as cutting marks, tire tracks, and fingerprints or searching computers

9. Theft Act Investigative Methods
Steps to Gather Electronic Evidence
Secure the device and perform initial tasks
Clone the device and calculate a CRC checksum
Search the device manually
Search the device using automated procedures
vice and perform initial tasks

10. Theft Act Investigative Methods
Systems Many copies may exist (sender, receiver, server) Includes text messaging in certain countries Web-based (Hotmail, GMail, Yahoo! Mail) is more difficult to search