2.2 Cash receipts schemes (skimming, cash larceny)

Cash receipts schemes

Cash is the asset most vulnerable to theft because it is liquid, portable, and often handled by lower-level employees. The ACFE's occupational-fraud taxonomy divides cash-receipt theft into two fundamentally different categories based on timing — whether the money is stolen before or after it is recorded in the victim organization's books.

Skimming: theft before recording (off-book)

Skimming is the theft of cash before it is entered into the accounting system. Because no entry is ever made, skimming is an off-book scheme and leaves no direct audit trail — the missing money was never on the books to begin with. This is why skimming is one of the hardest schemes to detect: a straightforward comparison of recorded receipts to deposits will not reveal it, because both figures already exclude the stolen amount.

Common skimming methods include:

• Unrecorded sales. The employee sells goods or services, pockets the payment, and never rings up the sale. A cashier who takes a customer's cash without recording it on the register is skimming. Inventory shrinkage is often the tell — goods leave but no corresponding sale appears.
• Understated sales. The sale is recorded, but for a lower amount than actually collected. The employee records $80, collects $100, and keeps the $20 difference.
• Theft of receivables via lapping. When a payment on account is skimmed, the customer's balance stays open, so the fraudster must hide it. Lapping credits Customer A's account with money later received from Customer B, then covers B with C's payment, and so on. The scheme demands constant attention and typically grows until the fraudster confesses, replaces the funds, or is caught.
• Write-off and credit-memo schemes. To stop a skimmed customer account from becoming delinquent, the fraudster may fraudulently write it off as bad debt or post a fake discount, credit memo, or return.

Because skimmed sales never enter the records, detection relies on indirect methods: comparing inventory usage to recorded sales, analyzing gross-margin trends, reviewing voided and no-sale transactions, monitoring customer complaints, and using surprise cash counts or invigilation.

Cash larceny: theft after recording (on-book)

Cash larceny is the intentional theft of cash that has already been recorded in the victim's accounting system. Because the receipt is on the books, larceny is an on-book scheme and, unlike skimming, creates an imbalance the examiner can find — recorded receipts will exceed the amounts actually deposited.

Cash larceny typically occurs at two points:

• At the point of sale. An employee removes currency from the register after the sale has been rung up. To hide the shortage, the thief may force the register total or alter the tape. Because the sale is already recorded as revenue, the drawer should hold more cash than it does, so a surprise count reveals a shortage — the on-book fingerprint that separates larceny from skimming.
• From the deposit. Cash is stolen from the daily bank deposit after it has been recorded in the books. Deposit lapping — crediting today's recorded deposit with tomorrow's receipts — and holding the deposit as a perpetual "deposit in transit" that never clears are common concealment tactics. Comparing the validated bank deposit slip to the recorded receipts and to the general-ledger cash account exposes the gap.

Skimming vs. larceny — the key distinction

The single most important exam concept here is timing relative to the point of recording:

Distinguishing the receipt schemes in practice

A useful mental model is that sales skimming hits revenue at the point of sale, while receivables skimming hits payments on customer accounts and almost always requires lapping or a fraudulent write-off to stay hidden, because the customer expects the payment to reduce a recorded balance. Red flags common to receipt schemes include declining or erratic gross margins, a rising ratio of bad-debt write-offs, customer complaints that payments were not credited, delayed postings to accounts receivable, altered or missing register tapes, and an employee who refuses to take a vacation or insists on personally handling one customer's account. Because the perpetrator must control both the cash and the records to conceal a receipts scheme, any concentration of incompatible duties in a single person sharply raises the risk.

Prevention and detection

Effective controls target the moment of receipt. Segregation of duties keeps the person who receives cash separate from the person who records it and the person who reconciles the bank. Independent, timely bank reconciliations catch larceny from deposits. Mandatory vacations and job rotation disrupt lapping, which requires the fraudster's continuous involvement to keep the accounts from unraveling. Surprise cash counts, register-report analysis (excessive voids, no-sales, and refunds), customer-complaint monitoring, and trend analysis of gross margin and days-sales-outstanding all help surface receipt schemes. Because skimming leaves no direct trail, prevention — strong point-of-sale controls, receipt requirements for customers, and reconciliation of physical inventory to recorded sales — is the fraud examiner's most powerful weapon against it. Analytics that flag individual cashiers with recurring drawer shortages, or whose voids and refunds cluster suspiciously at the end of a shift, narrow an investigation quickly and turn scattered anomalies into a documented pattern.