In fraud investigations, which question helps distinguish suspect from victim?

• A. Was the account balance?
• B. Were the funds immediately accessed?
• C. Was the transaction out of pattern for profile?
• D. Is this ongoing or an isolated incident?

Answer: (C)

Understanding what counts as normal activity for an account is essential in fraud investigations. When a transaction is out of pattern for the profile, it signals a deviation from the user’s established behavior, which is a strong indicator that someone else may be acting on the account or that the account has been compromised. This kind of anomaly helps investigators separate legitimate user actions (victim) from unauthorized or suspicious activity (potential suspect), because it relies on the historical behaviors of the account holder rather than just a single event.

The other prompts don’t directly help with identifying who is responsible. The current account balance doesn’t reveal who performed actions and could be consistent with either legitimate use or fraud. Whether funds were accessed immediately speaks to timing but not to identity. Whether an incident is ongoing or isolated speaks to scope and impact, not to who is driving the activity.