Types of Fraud: Definition, Business Examples and Red Flags

Fraud is an intentional act of deception used to gain an unfair or unlawful advantage, such as money, property or a contract. In a business, it falls into two families: internal fraud, committed by employees or executives, and external fraud, committed by customers, vendors or criminals posing as them. According to the ACFE study released on May 12, 2026, organizations lose an estimated 5% of revenue to occupational fraud each year. This guide covers the legal definition, the main types of fraud with business examples, the red flags, and the controls that work, including document fraud detection, since most schemes rely on a forged or altered file.

Types of fraud at a glance

The table sorts the most common business fraud schemes: the first three are internal, committed by employees or executives, the last three external. For each, a typical example and the first warning sign a finance or compliance team can spot.

What is the definition of fraud?

Under US common law, fraud requires five elements: a false statement of a material fact, knowledge that it is false, intent to deceive, justifiable reliance by the victim, and resulting harm. Intent is what separates fraud from error. A costly mistake is not fraud; a small, deliberate misstatement can be.

Auditors draw the same line. US auditing standards (PCAOB AS 2401 for public companies, AU-C 240 for private ones) classify misstatements as fraud when they are intentional, and recognize two kinds: fraudulent financial reporting and misappropriation of assets.

Which laws apply to business fraud?

There is no single federal "fraud" offense. Prosecutors use specific statutes depending on how the scheme was carried out, and most cases combine several charges:

• wire fraud (18 U.S.C. § 1343) and mail fraud (§ 1341): any scheme to defraud that uses interstate wires, email or the mail; up to 20 years in prison, 30 years if a financial institution is affected;
• embezzlement: theft of funds entrusted to an employee, mostly prosecuted under state law;
• forgery: making or altering a document with intent to defraud, also a state crime, with federal charges when the document is a check, a security or a government record.

Civil remedies run in parallel: a company can sue to recover its losses, and public companies face SEC enforcement for misleading financial statements.

What are the main types of fraud in business?

The Association of Certified Fraud Examiners (ACFE) classifies internal, or occupational, fraud into three categories. External fraud covers the schemes run by outsiders. Both families often meet: an employee may collude with a fake vendor, and an outside criminal may need an insider's approval.

Asset misappropriation

An employee steals or misuses company resources: padded expense reports, billing schemes through a shell company, inventory theft, ghost employees on the payroll. In the ACFE's 2024 report (1,921 cases), it appeared in 89% of cases, with the lowest median loss of the three categories, $120,000.

Corruption

An employee abuses their position for personal gain: kickbacks from a supplier, an undisclosed conflict of interest, a rigged bid. The 2026 edition finds corruption in 45% of cases, up from 10% in the first study in 1996.

Financial statement fraud

Management presents misleading accounts: revenue booked early or invented, expenses deferred, inventory overstated. It is the rarest and costliest category: 5% of cases in 2024, with a median loss of $766,000.

External fraud

External schemes target cash and onboarding. In CEO fraud, a criminal impersonates an executive to get an urgent wire. In vendor impersonation, an email announces new bank details and diverts payment of a real invoice. The FBI's Internet Crime Complaint Center counted $3.05 billion in reported business email compromise losses in 2025. Other schemes rely on forged paperwork sent to the company: a fake invoice slipped into accounts payable, a fake pay stub in a rental or loan application, a forged diploma in a job application.

Why do people commit fraud?

The most widely used model is the fraud triangle described by criminologist Donald Cressey: occupational fraud combines pressure (debt, an impossible target), opportunity (a missing or weak control) and rationalization ("I'll pay it back", "they owe me"). A company mostly acts on opportunity, which is why controls matter. The diagram follows that path through to detection.

How much does fraud cost a business?

The 2026 ACFE report analyzes 2,402 occupational fraud cases in 143 countries, with more than $3.4 billion in losses. The median loss per case is $104,000, and a typical scheme runs 12 months before it is detected. The longer it lasts, the more it costs, so the goal is to shorten that window. Investigation costs, legal fees, lost customers and reputational damage come on top and are rarely measured.

What are the red flags of fraud?

According to the ACFE, 84% of fraudsters display at least one behavioral red flag while committing the fraud. The best known are living beyond one's means, refusing to take vacation or share duties, and an unusually close relationship with a vendor. Accounting and document red flags are more objective:

• a vendor whose bank details change without a clear reason, or who shares an address with an employee;
• payments just under the dual approval threshold;
• invoices or receipts with mixed fonts, wrong totals or non-sequential numbers;
• PDF files re-saved in an editing tool when they should come straight from billing software;
• an urgent request that forbids telling anyone or calling the person back.

How can a business prevent and detect fraud?

Prevention targets opportunity: make fraud hard to commit and quick to surface. The controls below appear in every anti-fraud framework, and they only work when they are applied without exceptions.

Segregate duties and require dual approval

The person who sets up a vendor should not be the one who pays it, and every change of bank details should be confirmed by calling a number already on file. Payments above a set amount need two approvers.

Run a reporting hotline

In the ACFE study, 43% of frauds were detected through a tip, far more than through audits. The Sarbanes-Oxley Act already requires audit committees of listed companies to set up a confidential channel for accounting concerns.

Check the documents, not only the amounts

Accounting controls check that the numbers add up; they do not see that a bank statement or an invoice was edited. Examining the file itself, its metadata, fonts, layers and incremental saves, reveals changes the eye cannot see. Software built for invoice fraud detection runs these checks on every incoming document.

What should you do when you discover fraud?

First, preserve the evidence in its original form: the files as received, not printed or rescanned copies, because the traces of editing live inside the file. Next, stop pending payments and call the bank if a wire has gone out. Then report the case: to local police or the FBI's IC3 for external schemes, and to legal counsel before confronting an employee, so the investigation and any termination hold up.

How we put this guide together

This guide is based on the ACFE press release of May 12, 2026 presenting Occupational Fraud 2026, the ACFE's Occupational Fraud 2024 report for the breakdown by category, the FBI IC3 2025 Internet Crime Report, and the text of 18 U.S.C. §§ 1341 and 1343. Sources were checked on November 4, 2026. The top ranking US pages on the topic were read in full to cover both the legal definition and the schemes businesses actually face.

Frequently asked questions

What are the three types of fraud?

The ACFE classifies occupational fraud into three types: asset misappropriation, corruption and financial statement fraud. Asset misappropriation is the most common, while financial statement fraud causes the largest losses.

What are the five elements of fraud?

Under US common law: a false statement of a material fact, knowledge that it is false, intent to deceive, justifiable reliance by the victim, and resulting damages. All five must be proven in a civil fraud claim.

What is the most common type of business fraud?

Asset misappropriation, found in 89% of cases in the ACFE's 2024 study. Among external schemes, business email compromise, which includes CEO fraud and vendor impersonation, caused $3.05 billion in reported losses in 2025 according to the FBI.

What is the difference between fraud and error?

Intent. An error is an unintentional misstatement; fraud is deliberate and concealed. US auditing standards, AS 2401 and AU-C 240, are built on that distinction.

What are the consequences of financial fraud?

For the company: direct losses, investigation and legal costs, and damaged trust with customers, lenders and auditors. For the perpetrator: termination, civil liability and criminal charges, with up to 20 years in prison for federal wire or mail fraud.