Interviewing Suspects and Witnesses in Fraud Examinations

No productive fraud interview begins without a pre-interview review. Before meeting any subject, the examiner should have reviewed all available documentary evidence, formed a working hypothesis about the scheme, identified what the interview must confirm or refute, and prepared a question outline. The outline is not a script, but it sets the territory: known facts to confirm, gaps to fill, and contradictions to surface.

Interviews should be sequenced from the periphery inward. Peripheral witnesses, people with partial knowledge who are unlikely to be implicated, are interviewed first. They provide context and corroboration that sharpens the questions put to more central subjects. The subject most likely to have committed the primary fraud is generally interviewed last, after the examiner's evidential picture is complete. Reversing this sequence is a common mistake: interviewing the main suspect first alerts them before the evidence is consolidated and may prompt document destruction or collusion.

Two interviewers should be present for any interview with a suspect or implicated subject. One interviewer leads the conversation; the second takes contemporaneous notes and observes non-verbal behaviour. Both sign the note at the conclusion of the interview. Single-interviewer practice creates credibility problems if the subject later disputes what was said.

Cognitive interviewing was developed in the 1980s by Ronald Fisher and Ed Geiselman as a response to evidence that standard police questioning contaminated memory by imposing the interviewer's narrative on the witness. The technique draws on cognitive psychology research showing that memory retrieval is improved by multiple encoding cues, that free recall produces more accurate information than direct questioning, and that multiple retrieval paths to the same event can surface details that a single-pass chronological account misses.

The four core components of cognitive interviewing are: mental reinstatement of context (asking the witness to mentally return to the time and place of the event before answering questions), report everything (explicitly instructing the witness not to filter or self-censor on grounds of perceived relevance), varied retrieval order (asking the witness to recall the event backwards or from a different starting point after initial free recall), and change of perspective (asking what another person present would have seen or heard). These components can be used together in a full cognitive interview or selectively in shorter sessions.

In fraud examination, cognitive interviewing is most useful for witnesses who observed events related to the scheme but were not participants: an accounts clerk who processed unusual invoices, a purchasing manager who noticed irregularities in a supplier relationship, or a colleague who witnessed a conversation. These subjects are generally cooperative but may have filtered or minimised their own observations. Cognitive techniques encourage them to report what they actually saw and heard rather than what they concluded or inferred.

The Wicklander-Zulawski technique was developed by David Zulawski and Douglas Wicklander for private-sector interviews where direct accusation would be legally problematic, counterproductive, or both. The central insight is that an accused person who is directly confronted early in an interview will enter a denial cycle that is psychologically difficult to break. By contrast, an interviewer who builds rapport, presents the evidence as already conclusive without specifying it, and offers the subject a face-saving explanation for their behaviour creates conditions in which disclosure becomes the path of least resistance.

The WZ sequence has several stages. The opening establishes rapport and a neutral conversational tone. The introductory statement informs the subject that an investigation has been completed and that the results indicate involvement, without specifying the accusation in detail. Rationalisation follows: the interviewer presents empathetic explanations for why someone might have done what was done, such as financial pressure, an inadequately compensated contribution, or management failures. This is not approval of the conduct; it is a technique to lower the subject's defensive response. The interviewer then presents a behavioural alternative, a direct question framed as a choice between two explanations for the conduct, one slightly more sympathetic than the other. Both alternatives presuppose involvement.

WZ is designed for subjects who are implicated but not yet formally accused. It is not appropriate in interviews where the subject is in custody or where legal cautions are required, because the non-confrontational framing and the use of rationalisation may later be characterised as inducement. Practitioners in jurisdictions with mandatory caution requirements must take legal advice before applying WZ techniques.

Private fraud examiners are not law enforcement officers and in most jurisdictions are not required to administer Miranda-style cautions before questioning. However, this does not mean the interview is legally unconstrained. Several distinct legal frameworks apply depending on the jurisdiction and the nature of the engagement.

In the United States, Miranda v. Arizona (1966) requires law enforcement officers to advise suspects of their right to silence and to counsel before custodial interrogation. Private examiners are not covered. However, if a private examiner is acting as an agent of law enforcement (conducting an interview at the direction of, or coordinated with, a government investigator), courts have found that Miranda protections may apply. Private examiners in the US must also be aware of state employment law provisions that regulate what questions can be asked and whether employees can be compelled to answer as a condition of continued employment.

In the United Kingdom, the Police and Criminal Evidence Act 1984 (PACE) and its associated Codes of Practice govern police interviews. Authorised investigators under the Regulation of Investigatory Powers Act 2000 have additional obligations. Private fraud examiners conducting interviews under a civil mandate are not directly subject to PACE, but admissions obtained in a PACE-non-compliant manner may be inadmissible if the matter is later referred to police and prosecution. The PEACE model, designed for use within the PACE framework, is also widely adopted by private investigators for its disciplined structure.

In India, the Bharatiya Nagarik Suraksha Sanhita 2023 replaced the Code of Criminal Procedure 1973 and governs police powers over arrested persons. Statements made to police officers are generally inadmissible as confessions under the Bharatiya Sakshya Adhiniyam 2023 (which replaced the Indian Evidence Act 1872), but statements made to private investigators employed by the complaint party are treated differently. The Digital Personal Data Protection Act 2023 adds a layer: any interview that involves processing personal data of the subject may require adherence to the Act's data-handling obligations.

Denials are the default response in any suspect interview and should be anticipated rather than treated as the end of the interview. In the WZ framework, denials are categorised as either factual denials (direct contradiction of a specific fact) or explanatory denials (attempts to provide an alternative innocent explanation). Factual denials that can be immediately tested against known evidence should be noted and not directly rebutted in the room: 'I've noted that' is more useful than a confrontation, because the interview's goal is to continue the conversation, not to win a debate.

When a subject moves from denial to partial disclosure or full admission, the interviewer must shift into documentation mode. The sequence: stop introducing new information, allow the subject to complete their account, ask clarifying questions about specifics (dates, amounts, other parties, locations), and then ask the subject to provide a written statement confirming the admission. If the subject declines to write, the interviewer writes a summary in the subject's presence and asks whether the subject agrees it is accurate.

The contemporaneous note is the primary documentary output of the interview. It records: the date, time, and location of the interview; all persons present; the cautions or disclosures given at the outset; a verbatim or near-verbatim record of questions and responses; any denials made and the exact wording used; any admissions made and the exact wording used; any documents shown to the subject and their responses; and the time the interview ended. Both interviewers sign the note. The note should be completed the same day and reviewed by the lead examiner before any further investigative steps are taken.

Fraud examiners frequently need to form a view on whether a subject is being truthful. Behavioural indicators can support that assessment but cannot replace documentary evidence. No single verbal or non-verbal cue reliably indicates deception: the scientific literature consistently shows that unaided human ability to detect lies from behaviour alone is only marginally above chance. The value of behavioural observation is in flagging areas for follow-up investigation, not in drawing conclusions.

Verbal indicators that may warrant follow-up include: failure to answer the specific question asked (responding to a related but different question); excessive hedging in answers to factual questions ('I believe', 'I think' when certainty would be expected); spontaneous inclusion of information the question did not request; and inconsistency between a subject's account and the documentary record. These are indicators for investigation, not conclusions about guilt.

Statement analysis, sometimes called scientific content analysis (SCAN), is a structured method for evaluating written statements for linguistic patterns associated with deception, such as lack of conviction in first-person language, unusual response to questions about time, or omission of expected content. SCAN has academic critics and should not be presented in reports as a validated forensic method, but it can guide the examiner's follow-up questions. The legal standard for credibility assessment remains corroborated documentary or testimonial evidence, not behavioural inference.