The One-Word Answer: TIMING
If you remember nothing else from this article, remember this:
Skimming = Stealing cash BEFORE it's recorded in the books
Larceny = Stealing cash AFTER it's recorded in the books
This distinction is so fundamental that it determines everything else about these schemes: how they're committed, how they're concealed, how they're detected, and their relative risk to the perpetrator.
- Skimming is "off-book" fraud — the stolen money was never recorded, so there's no audit trail
- Larceny is "on-book" fraud — the stolen money was already recorded, creating an imbalance that must be concealed
Visual Timeline: When Theft Occurs
(Transaction entered in books)
Think of the recording point as a bright yellow line. On one side is skimming territory; on the other side is larceny territory. The exact same physical act of taking cash can be either scheme depending entirely on when it happens relative to the recording.
Skimming Schemes Explained
Skimming involves stealing incoming cash before it ever appears on the company's books. According to the ACFE's 2024 Report to the Nations, skimming accounts for approximately 9% of asset misappropriation cases.
Why Skimming Is the "Perfect Crime" (For Fraudsters)
From a perpetrator's perspective, skimming is ideal because:
- No direct audit trail exists — you can't trace what was never recorded
- The company may never know cash was received in the first place
- No records need to be falsified — the perpetrator simply doesn't create them
- Detection requires indirect methods — inventory counts, analytical reviews, customer complaints
The exam will test whether you understand that skimming is harder to detect than larceny precisely because it leaves no audit trail. This is a frequent true/false trap!
Three Categories of Skimming
The ACFE Fraud Tree divides skimming into three main categories:
1. Sales Skimming
The employee sells goods or services, collects payment, and pockets the money without recording the sale.
- Unrecorded Sales: The employee simply doesn't ring up the transaction at all. A bartender pours drinks, collects cash, and never enters the sale in the register.
- Understated Sales: The employee records a lower amount than collected. A cashier charges $50 but enters $40 in the system, pocketing the $10 difference.
A retail employee opens the register using the "No Sale" function to make change or place cash inside. To observers, it looks like a legitimate transaction. In reality, no sale was recorded, and the employee later removes the unrecorded cash.
2. Receivables Skimming
The employee intercepts customer payments on existing accounts receivable before they're posted to the customer's account.
- Mailroom Theft: An employee in the mailroom intercepts customer checks before they reach the accounting department
- Payment Diversion: A collections clerk receives customer payments and pockets them instead of posting to accounts
Receivables skimming is trickier because customers expect their accounts to show payment. This often leads to lapping as a concealment method (more on this below).
3. Refunds and Other
The employee steals cash that was supposed to go to customers as refunds or write-offs.
- Refund Skimming: A customer overpaid and is due a refund. The employee intercepts the refund check before it's sent and deposits it to their own account (often at a bank with a similar-sounding name)
- Write-off Skimming: After an account is written off as uncollectible, any subsequent payment isn't expected—making it easy to pocket
Cash Larceny Schemes Explained
Cash larceny involves stealing money that has already been recorded on the company's books. According to ACFE data, cash larceny accounts for approximately 8% of asset misappropriation cases—slightly less common than skimming.
Why Larceny Is Riskier for Fraudsters
Unlike skimming, larceny creates an immediate problem: the books won't balance. The company recorded receiving $1,000, but now only $900 exists. This discrepancy is the "central weakness" of cash larceny schemes and why they require active concealment.
Larceny is easier to detect than skimming because it leaves an audit trail—the recorded amount doesn't match the actual cash. Detection comes through reconciliations, cash counts, and bank statement comparisons.
Three Points Where Cash Larceny Occurs
1. Larceny at the Point of Sale
The employee steals cash directly from the register after a sale has been properly recorded.
A cashier correctly rings up a $50 sale. Later in the shift, when the store is quiet, they open the drawer and remove $50. At shift end, the register tape shows $50 in sales that doesn't exist in the drawer.
2. Larceny of Receivables
Customer payments that have been recorded are stolen before deposit. This often occurs when the same person handles receiving, recording, and depositing payments (poor segregation of duties).
3. Larceny from the Deposit
Cash is stolen while in transit to the bank or from the deposit itself.
The company's records show a deposit of $5,000. The employee responsible for bank deposits removes $500 from the bag before making the deposit. The bank receipt shows $4,500, creating a $500 discrepancy that must be hidden.
Side-by-Side Comparison
| Feature | Skimming | Cash Larceny |
|---|---|---|
| Timing | BEFORE recording | AFTER recording |
| Book Status | Off-book fraud | On-book fraud |
| Audit Trail | ❌ No direct trail | ✅ Trail exists (imbalance) |
| Detection Difficulty | 🔴 More difficult | 🟢 Easier |
| Concealment Needed? | Minimal (no record to hide) | Significant (must explain imbalance) |
| Primary Detection Method | Indirect: inventory counts, analytical review, customer complaints | Direct: cash counts, reconciliations, bank statement comparison |
| Typical Perpetrator Position | Point-of-sale employee, cashier, mailroom, A/R clerk | Anyone with access to recorded cash (register, deposits) |
| Common Concealment | Lapping, destroying records, not sending statements | False voids/refunds, altered cash counts, reversing entries |
How Fraudsters Conceal These Schemes
Skimming Concealment
Since skimming doesn't create an audit trail, concealment is primarily about preventing discovery that cash was ever received:
- Not recording sales at all (unrecorded sales skimming)
- Destroying customer receipts or correspondence
- Intercepting customer statements before they're mailed
- Lapping (using one customer's payment to cover another's missing payment)
Lapping is the most common method for concealing receivables skimming. Here's how it works:
- Employee steals $100 payment from Customer A
- Customer B pays $100 → Employee credits it to Customer A's account
- Customer C pays $100 → Employee credits it to Customer B's account
- This continues indefinitely, becoming increasingly complex
Red flag: Employees who lap often refuse to take vacations because the scheme will unravel if someone else handles their accounts.
Cash Larceny Concealment
Since larceny creates an imbalance, concealment focuses on explaining away or hiding the discrepancy:
- False Voids: Reversing the original sale transaction to reduce recorded cash
- False Refunds: Processing fake customer refunds to justify missing cash
- Altering Cash Counts: Falsifying the count so it matches the register
- Reversing Entries: Creating journal entries to offset the shortage
- "Deposits in Transit": Recording missing cash as still being on its way to the bank
- Death by a Thousand Cuts: Stealing very small amounts that get written off as "cash shortages"
Detection Methods
Detecting Skimming (Indirect Methods Required)
Since no direct audit trail exists, detection relies on circumstantial evidence:
- Inventory Analysis: If goods are disappearing but sales aren't being recorded, inventory counts will show shrinkage
- Analytical Review: Compare revenue to industry benchmarks, prior periods, or other locations
- Customer Complaints: Customers may report being charged but never receiving credit on their account
- Surveillance: Video monitoring of cash-handling areas
- Register Tape Analysis: Look for unusual patterns in "no sale" transactions
- Comparing Cash to Receipts: In businesses that issue receipts separately from registers
Detecting Cash Larceny (Direct Methods Available)
Because larceny leaves an audit trail, detection can be more straightforward:
- Cash Counts: Regular, unannounced cash counts compared to register totals
- Bank Reconciliations: Compare recorded deposits to actual bank receipts
- Void/Refund Analysis: Review all voids and refunds for patterns or unauthorized transactions
- Exception Reports: Generate reports of unusual transactions (high voids, odd amounts)
- Segregation Testing: Verify that different people handle receiving, recording, and depositing
Test Your Understanding: Scenarios
For each scenario, determine whether it's skimming or larceny:
A bartender makes a cocktail for a customer who pays $15 cash. The bartender puts the money in the register drawer but never rings up the sale. At the end of the night, they remove $15 from the drawer.
Why: The sale was never recorded in the first place. The cash was stolen before it appeared on the books. The register tape shows no record of this transaction.
A cashier properly rings up a $50 sale. The customer pays and leaves. An hour later, when the store is empty, the cashier opens the drawer and takes $50. They then process a void for the earlier transaction.
Why: The sale was recorded first, then the cash was stolen. The void is a concealment technique for the larceny, not the theft itself. The key is that the money was recorded before being taken.
A mailroom employee opens incoming mail and finds a customer check for $500 to settle an outstanding invoice. The employee endorses the check and deposits it to their personal account.
Why: The payment was intercepted before it reached the accounting department to be recorded. Although the original invoice exists, this specific payment was never recorded as received.
The A/R clerk prepares a bank deposit for $3,000. On the way to the bank, they remove $300 from the deposit bag. The bank receipt shows $2,700 deposited.
Why: The $3,000 was already recorded on the company's books before the employee stole from the deposit. This creates a $300 discrepancy between recorded cash and actual bank deposit.
A parking garage attendant collects $20 cash from a driver. Instead of giving the driver a ticket and recording the payment, the attendant manually lifts the gate arm and pockets the money.
Why: Classic unrecorded sales skimming. The transaction was never entered into any system. The company doesn't know this car ever parked there.
CFE Exam Practice Questions
Explanation: Cash larceny involves stealing cash that has already been recorded on the books (on-book), while skimming involves stealing cash before it's recorded (off-book). This timing distinction is the fundamental difference between the two schemes.
Explanation: Cash larceny is easier to detect because the stolen cash was already recorded, creating a discrepancy between the books and actual cash. Skimming leaves no direct audit trail because the cash was never recorded in the first place.
Explanation: Lapping requires constant attention to move payments between accounts. If the employee takes vacation, someone else handling their accounts will discover the discrepancies. Employees running lapping schemes often refuse vacations—a major behavioral red flag.
Explanation: The sale was properly recorded first ("rings up a $100 sale"), making this larceny rather than skimming. The void is a concealment technique for the larceny. If the employee had never rung up the sale at all, it would be skimming.
Memory Tricks for the CFE Exam
- SKIM the cream off the TOP of milk (before it mixes in) → Skimming happens BEFORE recording
- STEAL from the BUCKET (after it's already collected) → Larceny happens AFTER recording
- Skimming = OFF the books (Off-book fraud) — harder to find
- Larceny = ON the books (On-book fraud) — leaves a trail
When you see a scenario question about cash theft, ask yourself ONE question:
"Was the transaction recorded before or after the cash was taken?"
- If the transaction was never recorded or was recorded after theft → SKIMMING
- If the transaction was recorded before theft → LARCENY
Conclusion: The Recording Point Is Everything
Understanding the difference between skimming and larceny comes down to one simple question: When was the money stolen relative to when it was recorded?
This distinction isn't just academic—it has real-world implications for fraud detection and prevention:
- Skimming requires indirect detection methods because there's no paper trail to follow
- Larceny can be caught through reconciliations and cash counts because the discrepancy exists in the records
- Different internal controls address each scheme differently
- Different concealment methods are used for each
Master this concept, and you'll be ready for the multiple questions about cash theft schemes that appear on every CFE exam.
Ready to Practice?
Test your knowledge with hundreds of CFE practice questions covering all four exam sections