Glossary

Definitions of terms used across the Fraud-OSINT Wiki. Terms link to their full articles where one exists.

A–C

ACFE — Association of Certified Fraud Examiners; issues the CFE credential and the biennial Report to the Nations.

Affinity fraud — Investment fraud that exploits trust within a religious, ethnic, professional or social group. See Ponzi and Investment Fraud.

Allegation response plan — A pre-agreed written procedure for triage, conflict screening, evidence preservation and escalation in the first days after a fraud allegation. See Forensic Investigation Planning.

Altman Z-Score — A discriminant model of financial distress with zones at 1.81 and 2.99 for public manufacturers. See Revenue and Earnings Manipulation Tests.

AML — Anti-Money Laundering; the body of law and controls aimed at detecting and preventing money laundering.

Anti-Kickback Statute — Federal law criminalizing payments to induce or reward referrals of federal health program business. See Healthcare and Insurance Fraud.

Asset misappropriation — theft or misuse of an organization's assets; the most common branch of the Fraud Tree (89% of cases) but the least costly.

Association matrix — A grid of entities against entities recording the links between each pair. See Link and Network Analysis.

AU-C 240 — The AICPA auditing standard on consideration of fraud in a financial statement audit. See Auditing Standards and Fraud.

Authorized push payment (APP) fraud — Fraud in which the victim initiates a real payment but is deceived about its purpose or recipient. See Payment Fraud and BEC.

Badges of fraud — Non-exclusive factors listed in fraudulent-transfer statutes, such as transfer to an insider or retained control, from which intent to defraud creditors may be inferred. See Hidden Assets in Divorce and Bankruptcy.

Bank deposits method — Indirect proof of income that adjusts total deposits for non-income items and cash expenditures to estimate receipts. See Tax Fraud and Evasion.

Bankruptcy fraud (18 U.S.C. 152, 157) — Federal offences covering concealment of assets, false oaths and schemes to defraud in bankruptcy, each punishable by up to five years. See Hidden Assets in Divorce and Bankruptcy.

Behavioral red flag — An observable warning behaviour in a perpetrator, such as living beyond means or unusually close ties to a vendor, present in 84% of ACFE-reported cases. See Fraudster Psychology and the Dark Triad.

Beneficial owner — The natural person who ultimately owns or controls a legal entity, as opposed to the nominal registered holder. See Shell Companies and Beneficial Ownership.

Beneish M-Score — An eight-variable probit model whose score above -1.78 flags a probable earnings manipulator. See Revenue and Earnings Manipulation Tests.

Benford's Law — the observation that in many natural datasets the leading digit is 1 about 30% of the time; used to detect fabricated numbers. See Benford's Law.

Betweenness centrality — A graph measure of how often a node lies on the shortest paths between other nodes. See Link and Network Analysis.

Bid rigging — An agreement among competitors to fix the outcome of a competitive tender, a per se Sherman Act violation. See Procurement and Contract Fraud.

Bill-and-hold — A sale billed while goods stay with the seller, recognizable only if strict ASC 606 criteria are met. See Revenue and Earnings Manipulation Tests.

BSA — Bank Secrecy Act (1970); the foundational U.S. AML statute requiring reporting such as the CTR and SAR.

Business email compromise (BEC) — A scam in which a compromised or impersonated email account induces a business to send payment to a criminal-controlled account. See Payment Fraud and BEC.

But-for analysis — A damages method comparing actual results with a reconstructed counterfactual of what would have occurred without the wrongful act. See Business Valuation and Damages Quantification.

But-for damages — Damages measured as the difference between actual results and the position absent the wrongful act. See Litigation Support and Damages.

Certificate Transparency — Public append-only logs of issued TLS certificates (RFC 9162), searchable to find domains and issuance dates. See Web Archives and Domain Intelligence.

Chain of custody — the unbroken, documented record of who handled evidence and when. See Chain of Custody.

Change-order abuse — Winning with a low bid and recovering margin through unjustified post-award scope changes. See Procurement and Contract Fraud.

Channel stuffing — Shipping more product to distributors than end demand justifies, often with side terms that make the sales not final, to inflate current-period revenue. See Financial Fraud Case Studies in Detection.

Check kiting — Exploiting float by depositing checks drawn on accounts at different banks that lack sufficient funds. See Payment Fraud and BEC.

Chronolocation — Determining when an image or video was captured, for example from shadow angle or imagery history. See Geolocation and Imagery OSINT.

Cognitive interview — A memory-based interview protocol (context reinstatement, report everything, varied order) that elicits more correct details. See Forensic Interviewing and Statement Analysis.

Content Credentials (C2PA) — Cryptographically signed provenance metadata recording a file's origin and edits, often stripped on social platforms. See Geolocation and Imagery OSINT.

Cookie jar reserves — Excess provisions built up in good periods and released into income in poor periods to smooth or meet earnings targets. See Financial Fraud Case Studies in Detection.

Cookie-jar reserve — An over-accrued liability released into income later to smooth earnings. See Revenue and Earnings Manipulation Tests.

Corporate Transparency Act — 2021 U.S. law creating FinCEN beneficial ownership reporting, narrowed in 2025-26 to foreign-registered entities. See Shell Companies and Beneficial Ownership.

Corruption — abuse of entrusted power for private gain; on the Fraud Tree it includes bribery, kickbacks, bid rigging, and conflicts of interest.

COSO framework — The 2013 Internal Control - Integrated Framework with five components and 17 principles, used to assess internal control over financial reporting. See Internal Controls and Fraud Risk Assessment.

Cover bid — A deliberately uncompetitive bid submitted to give the appearance of competition while a favored bidder wins. See Procurement and Contract Fraud.

CTR — Currency Transaction Report; filed for cash transactions exceeding $10,000 in a business day.

Cutoff testing — Audit procedure matching transactions near period-end to shipping, signing and delivery evidence to confirm they were recorded in the correct period. See Financial Fraud Case Studies in Detection.

D–F

Dark Triad — Three subclinical personality traits, Machiavellianism, narcissism and psychopathy, associated with manipulation and low empathy. See Fraudster Psychology and the Dark Triad.

Daubert standard — the U.S. federal test making the judge a "gatekeeper" for expert evidence. See Evidence and Testimony.

Digital forensics — the recovery and analysis of electronic evidence. See Digital Forensics.

Discount for lack of marketability — A reduction in the value of a private ownership interest reflecting the difficulty of selling it quickly. See Business Valuation and Damages Quantification.

Discounted cash flow (DCF) — A valuation method that discounts projected free cash flows and a terminal value to present value at a risk-appropriate rate. See Business Valuation and Damages Quantification.

Do Not Pay — Treasury's pre-payment verification service that checks payees against exclusion and death data. See Public Sector Fraud and Improper Payments.

Entity List — BIS list of foreign parties subject to specific licence requirements for exports under the EAR. See Sanctions and Export Controls.

Entity resolution — Deciding whether records from different sources describe the same real-world person, company or account. See Link and Network Analysis.

Expectation gap — The difference between what users think auditors do (detect all fraud) and what standards require (reasonable assurance on material misstatement). See Auditing Standards and Fraud.

Expenditures method — Estimating unreported income as spending that exceeds identified sources of funds. See Bank Statement and Cash Analysis.

Fair market value — The price at which property would change hands between a willing buyer and willing seller, each with reasonable knowledge and neither under compulsion (Rev. Rul. 59-60). See Business Valuation and Damages Quantification.

FATCA — 2010 U.S. law requiring foreign financial institutions to report U.S. account holders and individuals to file Form 8938. See Tax Fraud and Evasion.

FATF — Financial Action Task Force; the intergovernmental AML/CFT standard-setter behind the 40 Recommendations.

FBAR — FinCEN Form 114 report of foreign accounts exceeding $10,000 in aggregate, required under the Bank Secrecy Act. See Tax Fraud and Evasion.

Financial Fraud Kill Chain (FFKC) — FBI IC3 Recovery Asset Team process for working with banks to freeze funds stolen through fraudulent transfers. See Payment Fraud and BEC.

Financial statement fraud — deliberate misstatement of financial reports; rarest but costliest occupational fraud. See Financial Statement Fraud.

Forensic accounting — accounting applied to matters of law. See Forensic Accounting.

Fraud pentagon — An extension of the fraud diamond that adds arrogance or competence to incentive, opportunity, rationalization and capability. See Fraudster Psychology and the Dark Triad.

Fraud risk assessment — A structured inventory of fraud schemes scored by likelihood and impact and mapped to preventive and detective controls. See Internal Controls and Fraud Risk Assessment.

Fraud theory approach — A hypothesis-driven investigative loop of analysing data, creating a hypothesis, testing it with if-then reasoning, and refining it. See Forensic Investigation Planning.

Fraud triangle — pressure, opportunity, and rationalization. See Fraud Triangle.

FRE 702 — the U.S. Federal Rule of Evidence governing expert testimony, amended effective 1 Dec 2023.

Fuzzy matching — Approximate string comparison (such as Levenshtein or Jaro-Winkler) that finds records despite typos and variants. See Link and Network Analysis.

G–M

GEOINT — Geospatial Intelligence; analysis of imagery and geospatial data. See OSINT Disciplines.

Hard fraud vs soft fraud — Insurance-fraud classification separating staged or fabricated events from exaggeration of genuine claims. See Healthcare and Insurance Fraud.

Hawala — an informal value-transfer system used in layering.

HUMINT — Human Intelligence; information from human sources.

Improper payment — A payment that should not have been made or was made in the wrong amount; includes but is mostly not fraud. See Public Sector Fraud and Improper Payments.

Integration — the third stage of money laundering, returning laundered funds as apparently legitimate wealth.

Intelligence cycle — the process turning raw information into finished intelligence. See Intelligence Cycle.

ISO 37001 — The certifiable international standard for anti-bribery management systems, revised in February 2025. See Internal Controls and Fraud Risk Assessment.

Journal entry testing — Filtering the general ledger on risk criteria such as period-end timing, round amounts and unusual users to detect override. See Auditing Standards and Fraud.

Lapping — Concealing theft of a customer payment by applying later customers' payments to earlier accounts. See Bank Statement and Cash Analysis.

Layering — the second stage of money laundering, obscuring the trail through complex transactions.

Legal Entity Identifier (LEI) — A 20-character ISO 17442 code identifying a legal entity, published with parent data by GLEIF. See Corporate Registries and Leak Databases.

Lifestyle analysis — Reconstruction of a household's actual spending from account records and comparison with disclosed income to expose unreported funds. See Hidden Assets in Divorce and Bankruptcy.

Lis pendens — A recorded notice that litigation affects title to a specific property. See Public Records and Court Dockets.

Lost profits — Lost revenue minus avoided incremental costs, discounted to present value when future. See Litigation Support and Damages.

Lowest intermediate balance rule — A tracing rule limiting the claimant's interest in a commingled account to the lowest balance after the deposit. See Litigation Support and Damages.

Lowest intermediate balance rule (LIBR) — A tracing rule limiting a claimant's interest in a commingled account to the lowest balance it reached after the deposit. See Ponzi and Investment Fraud.

Management override — Management's ability to circumvent controls, treated by auditing standards as a presumed fraud risk in every audit. See Internal Controls and Fraud Risk Assessment.

MICE — A motive taxonomy for fraud: money, ideology, coercion and ego. See Fraudster Psychology and the Dark Triad.

Monetary-unit sampling — Sampling in which each dollar is a sampling unit so large items are more likely to be selected. See Journal Entry and Ledger Testing.

Money mule — A person whose account receives and forwards fraud proceeds, knowingly or not. See Payment Fraud and BEC.

N–R

50 Percent Rule — OFAC guidance that entities owned 50% or more in aggregate by blocked persons are themselves blocked. See Sanctions and Export Controls.

National Health Care Fraud Takedown — DOJ's annual coordinated nationwide announcement of health care fraud charges. See Healthcare and Insurance Fraud.

Net investment method — Valuing a customer claim as cash deposited minus cash withdrawn, ignoring fictitious statement balances. See Ponzi and Investment Fraud.

Net winner — An investor in a Ponzi scheme who withdrew more than was deposited, exposing the excess to clawback. See Ponzi and Investment Fraud.

Net worth method — an indirect technique proving unexplained income from changes in wealth. See Net Worth Method.

Nominee director — A person who is named as a company officer or shareholder on behalf of an undisclosed real controller. See Shell Companies and Beneficial Ownership.

Occupational fraud — fraud committed by employees against their own organization. See Occupational Fraud.

Offshore Leaks Database — ICIJ's searchable database of 810,000+ offshore entities from the Panama, Paradise and Pandora Papers and related leaks. See Corporate Registries and Leak Databases.

OSINT — Open-Source Intelligence. See OSINT.

PACER — The U.S. federal judiciary's fee-based system for dockets and filings, charging $0.10 per page capped at $3.00 per document. See Public Records and Court Dockets.

Pass-through ratio — Outflows divided by inflows over a short window, used to flag mule accounts. See Payment Fraud and BEC.

Passive DNS — Historical records of DNS resolutions collected by sensors, used to find shared infrastructure without contacting the target. See Web Archives and Domain Intelligence.

Pay and chase — Paying claims first and trying to recover fraudulent payments afterwards. See Public Sector Fraud and Improper Payments.

PEACE model — A non-accusatory interview framework: Planning, Engage and explain, Account, Closure, Evaluation. See Forensic Interviewing and Statement Analysis.

PEP — Politically Exposed Person; a heightened-risk category in due diligence and anti-corruption OSINT.

Persons with significant control (PSC) — UK register of individuals who ultimately own or control a company, normally above a 25% threshold. See Corporate Registries and Leak Databases.

Pig butchering — A long-con crypto-investment scam in which victims are groomed and steered to fake trading platforms. See Ponzi and Investment Fraud.

Placement — the first stage of money laundering, introducing illicit cash into the financial system.

Ponzi scheme — An investment fraud paying purported returns to earlier investors from later investors' money rather than real profit. See Ponzi and Investment Fraud.

PRAC — The Pandemic Response Accountability Committee, an inspector-general body with a data analytics center, extended to 2034. See Public Sector Fraud and Improper Payments.

Predication — The totality of circumstances that would lead a reasonable, prudent professional to believe a fraud has occurred, is occurring or will occur, required before an examination begins. See Forensic Investigation Planning.

Prejudgment remedy — Court-ordered security such as attachment or garnishment obtained before final judgment. See Litigation Support and Damages.

Procurement Collusion Strike Force — DOJ interagency partnership launched November 2019 to combat antitrust crimes in government procurement and grants. See Procurement and Contract Fraud.

Proof of cash — A four-column reconciliation of bank and book balances, receipts and disbursements that exposes unrecorded transactions and cut-off errors. See Bank Statement and Cash Analysis.

Qui tam — A False Claims Act suit brought by a private relator on behalf of the government, who shares in the recovery. See Whistleblowers and the False Claims Act.

RDAP — Registration Data Access Protocol, the JSON/HTTPS successor to WHOIS and the definitive gTLD registration source since 28 January 2025. See Web Archives and Domain Intelligence.

RECAP — A Free Law Project browser extension that donates purchased PACER documents to the free CourtListener archive. See Public Records and Court Dockets.

Red flag — an indicator of possible fraud. See Red Flags.

Relative distance (RD) — A bid-rigging screen: the gap between the lowest two bids divided by the standard deviation of the losing bids. See Procurement and Contract Fraud.

Relator — The private person who files a qui tam complaint under the False Claims Act. See Whistleblowers and the False Claims Act.

Reserve roll-forward — Reconciliation of a reserve account from opening balance through provisions, utilisations and releases to closing balance, used to expose earnings management. See Financial Fraud Case Studies in Detection.

Rule 2004 examination — A broad bankruptcy examination, of the debtor or third parties, on assets, conduct and financial condition, used by trustees to find concealed property. See Hidden Assets in Divorce and Bankruptcy.

S–Z

SAB 99 — SEC Staff Accounting Bulletin on materiality that adds qualitative factors to numerical thresholds. See Auditing Standards and Fraud.

SAR — Suspicious Activity Report; filed when a financial institution suspects illicit activity, including structuring.

Scienter — The knowledge or intent element required to establish liability for fraud. See Whistleblowers and the False Claims Act.

SDN List — OFAC's list of Specially Designated Nationals and Blocked Persons whose U.S. property is blocked. See Sanctions and Export Controls.

Second-digit test — A Benford analysis of the second digit of amounts, sensitive to rounding and invented numbers. See Journal Entry and Ledger Testing.

Secondary sanctions — Sanctions threatening non-U.S. persons who deal with designated targets, via loss of access to the U.S. financial system. See Sanctions and Export Controls.

Segregation of duties — Dividing authorization, custody, recordkeeping and reconciliation among different people so no one can commit and conceal fraud alone. See Internal Controls and Fraud Risk Assessment.

Sell-in versus sell-through — Comparison of shipments to distributors with their sales to end customers, used to detect channel stuffing. See Financial Fraud Case Studies in Detection.

Shell company — A legal entity with no significant operations or assets used to hold property or move money, often to obscure ownership. See Shell Companies and Beneficial Ownership.

Shell vendor — A fictitious or nominal supplier created to receive fraudulent payments. See Procurement and Contract Fraud.

Smurfing / structuring — breaking cash into sub-$10,000 amounts to evade CTR reporting.

SOCMINT — Social Media Intelligence. See OSINT Disciplines.

SOX — Sarbanes-Oxley Act (2002); enacted after Enron and WorldCom, requiring executive certification of financial statements.

SOX 806 — Sarbanes-Oxley provision (18 U.S.C. 1514A) protecting employees of public companies from retaliation for reporting fraud. See Whistleblowers and the False Claims Act.

SPE — Special Purpose Entity; an off-balance-sheet vehicle, central to the Enron fraud. See Case Studies.

Stark Law — Strict-liability federal law barring physician referrals for designated health services to entities with which they have a financial relationship. See Healthcare and Insurance Fraud.

Strategic Use of Evidence — An interview technique that controls when evidence is disclosed to test the subject's account. See Forensic Interviewing and Statement Analysis.

Three Lines Model — The IIA's 2020 governance framework assigning roles to the governing body, management (first and second lines) and internal audit (third line). See Forensic Investigation Planning.

Trust fund recovery penalty — 100% civil penalty under IRC 6672 on responsible persons for unpaid withheld employment taxes. See Tax Fraud and Evasion.

UCC-1 financing statement — A filing that perfects a lender's security interest in personal property, effective five years unless continued. See Public Records and Court Dockets.

Unbundling — Billing separately for services that should be billed under a single comprehensive code. See Healthcare and Insurance Fraud.

Uniform Voidable Transactions Act — The 2014 uniform state law, updating the Uniform Fraudulent Transfer Act, that lets creditors unwind transfers made with intent to defraud or for inadequate value. See Hidden Assets in Divorce and Bankruptcy.

Upcoding — Billing a higher-paying procedure or visit-level code than the service actually delivered. See Healthcare and Insurance Fraud.

Upjohn warning — A statement by company counsel in an internal-investigation interview that counsel represents the company and not the employee, and that the privilege belongs to the company. See Forensic Investigation Planning.

Weighted average cost of capital (WACC) — The blended cost of equity and after-tax debt used to discount free cash flow to the firm. See Business Valuation and Damages Quantification.

Write-blocker — a device or tool preventing any change to a storage medium during forensic imaging. See Digital Forensics.