The Fraud Triangle White-Collar Crime · Crime Lab 3 · Midwestern State University

In 1950 Donald Cressey interviewed 133 people imprisoned for violating a position of financial trust and asked what had to be true for each of them to do it. His answer became the most widely used model in fraud examination, and it is on the syllabus of every accounting program in the country under a name he never used: the fraud triangle. This lab puts six recent embezzlement cases in front of you, each drawn from a Department of Justice press release. For each one you will try to find the three elements Cressey said were necessary, using only what the record contains. You will find that one of the three is almost never there. Then you will decide whether the triangle explains these cases or only describes them after the fact, which is the question the opportunity perspective, this week's Meeting A reading, was built to answer. Work in pairs, but each of you submits your own response sheet at the end of class.

Cressey's final hypothesis, in his words

Cressey revised his hypothesis four times as interviews contradicted it. The version that survived every case reads as follows.

Cressey, 1950, p. 742

"Trusted persons become trust violators when they conceive of themselves as having a financial problem which is non-shareable, have the knowledge or awareness that this problem can be secretly resolved by violation of the position of financial trust, and are able to apply to their own conduct in that situation verbalizations which enable them to adjust their conceptions of themselves as trusted persons with their conceptions of themselves as users of the entrusted funds or property."

1. A non-shareable financial problem

Not a financial problem, a non-shareable one. Cressey's subjects had debts, gambling losses, and expensive habits, but so did people who never stole. What set the violators apart was that they felt they could not tell anyone. His evidence was their language: they were "ashamed" to ask for help, or had "too much false pride." Later writers shortened this to pressure, and lost the point.

2. Awareness that the position offers a secret solution

The person has to know that the entrusted funds can be used, and has to connect that general knowledge to their own problem. Cressey's subjects said "it occurred to me" or "it dawned on me." Later writers called this opportunity, which is close, but Cressey meant the perception of it, not the objective gap in controls.

3. Verbalizations that reconcile the act with the self

The person applies to their own situation a phrase that their groups have applied to others: this is borrowing, not stealing; I am a special kind of businessman, not a thief. Cressey was explicit that this is the motivation, not an excuse invented afterward. Later writers called it rationalization. It is the element you will have the hardest time finding in a press release.

What the revisions added

Kassem and Higson (2012), your second Meeting B reading, review the models that followed and combine them. Each addition was a response to the same problem: two of Cressey's three sides cannot be observed from outside.

The fraud scale (Albrecht, Howe, and Romney, 1984)

Replaces rationalization with personal integrity, on the argument that integrity can be observed in a person's decisions over time and rationalization cannot. Built from 212 frauds reported by internal auditors, with nine motivation types that map onto Cressey's non-shareable problems: living beyond one's means, high personal debt, feeling underpaid, a close association with customers, excessive gambling, and others.

The fraud diamond (Wolfe and Hermanson, 2004)

Adds capability: the position, the intelligence, the ego, the ability to coerce others, the skill at lying, and the tolerance for stress that turn an opportunity into an act. Many frauds, they argued, would not have happened without the right person in the seat.

MICE (Kranacher and colleagues, 2010)

Expands pressure into four motives: Money, Ideology, Coercion, and Ego. Ideology covers fraud committed for a perceived greater good. Coercion covers people pulled in unwillingly, who sometimes become whistleblowers. Ego covers the fear of losing status or position in front of others.

The new fraud triangle model (Kassem and Higson, 2012)

Combines the four: motivation (as MICE), opportunity, integrity, and capability. Written for external auditors, whose problem is that they must assess fraud risk before any fraud is known. That is the same problem you will meet in the next two tabs.

Quick check. According to the literature Kassem and Higson review, which two sides of Cressey's triangle cannot be easily observed by someone outside the offender's head?

Pressure and rationalization. Dorminey and colleagues, cited by Kassem and Higson, make the point directly: the model cannot solve the fraud problem alone because two of its three sides cannot be easily observed. Opportunity is the side an organization can see and change. Keep that in mind as you work through the six cases. You will be able to find the opportunity in every one of them. The other two will be harder, and the reason is not that the cases lack them. It is that the record was not written to capture them.

Sources: Cressey, D. R. (1950). The criminal violation of financial trust. American Sociological Review, 15(6), 738-743 (final hypothesis at p. 742; "ashamed" and "too much false pride" at p. 742, note 13; "it occurred to me" and "it dawned on me" at p. 743). Kassem, R., and Higson, A. (2012). The new fraud triangle model. Journal of Emerging Trends in Economics and Management Sciences, 3(3), 191-195 (fraud scale, fraud diamond, MICE, and the new model at pp. 193-194). Albrecht, W. S., Howe, K. R., and Romney, M. B. (1984). Deterring Fraud: The Internal Auditor's Perspective. Institute of Internal Auditors Research Foundation. Wolfe, D. T., and Hermanson, D. R. (2004). The fraud diamond: Considering the four elements of fraud. The CPA Journal, 74(12), 38-42.

Six people who violated a position of financial trust

Each case below is real and was sentenced between 2025 and 2026. The summary is built from the Department of Justice press release and, where noted, court reporting. For each case, make four calls: what the record shows about the non-shareable problem, what gave the person access, what the record contains by way of rationalization, and whether an employer could have seen the pressure before the money left. The reference answers use only what the record says. When the record is silent, the reference says so, because that silence is the point.

0 of 6 cases completed.

0 of 6

Cases where the record contains any rationalization at all

6 of 6

Cases where the opportunity is fully described in the record

0 of 6

Cases where the record shows a pressure that was visible before detection

Look at the shape of that. Every press release tells you how the money moved and what control was missing or bypassed, because that is what the charge requires the government to prove. Most tell you what the money was spent on, because it is evidence of intent. Almost none tell you what the person told themselves, because nothing in a wire fraud count depends on it. Cressey got his third element by sitting in a prison and asking. The official record is not built to hold it. When you apply the triangle to a case from documents alone, you are usually applying two sides of it and inferring the third.

Does the triangle predict, or only describe?

Cressey studied 133 people who had already been convicted. Every one of them had a non-shareable problem, an opportunity, and a verbalization, because he kept revising the hypothesis until every case fit. What he could not study was the people who had all three and did not steal. The Association of Certified Fraud Examiners collects the largest ongoing dataset of occupational fraud, and it lets you see the problem from the other direction.

In the ACFE's 2024 study of 1,921 occupational fraud cases in 138 countries, what share of the perpetrators had never before been charged with or convicted of a fraud-related offense?

50%

87%

Perpetrators with no prior fraud charge or conviction

12 mo.

Median time a scheme ran before detection

43%

Cases detected by a tip, the leading method; over half of tips came from employees

32%

Cases where the primary weakness was a lack of internal controls; with management override, more than half

Eighty-seven percent were first-time offenders, as far as anyone knew. They had passed background checks. Most had been in their positions for years. The ACFE reports that at least one behavioral red flag was present in every case, and the most common are living beyond one's means and personal financial difficulty. But those flags describe a large share of the working population in any given year, and almost none of them steal. This is the base rate problem. A model whose elements are common in the population and are identified after the fact will fit every case and predict none.

The triangle is a description of a completed act, and that is not nothing. Describing accurately is the first job of a theory. The auditing profession responded by turning Cressey's model into a checklist for the one side it could act on, which is why the fraud examiner's toolkit is almost entirely about opportunity: segregation of duties, second signatures, surprise audits, mandatory vacations, tip lines. The 43 percent figure is the reason every large organization now has a hotline. Notice that the intervention does not require knowing anyone's pressure or rationalization at all.

Source: Association of Certified Fraud Examiners, Occupational Fraud 2024: A Report to the Nations (1,921 cases in 138 countries, January 2022 to September 2023; median loss $145,000; asset misappropriation in 89 percent of cases with a median loss of $120,000; median duration 12 months; 43 percent detected by tip, 52 percent of tips from employees; 87 percent of perpetrators never previously charged or convicted; lack of internal controls the primary weakness in 32 percent of cases). Retrieved September 2026.

Cressey's own view of "wine, women and wagering" as explanations of embezzlement was that they

He said that using them as explanations "merely indicates lack of understanding of the problem." Gambling and expensive living appear constantly in embezzlement cases, including four of the six on the previous tab. Cressey's point was that they are not the cause. They become causal only when the debts they create are felt to be unshareable, and many people with the same habits share their problems, borrow legally, or absorb the loss. The press releases you read list the gambling because it proves intent and traces the money. They do not tell you why this person, out of the many who gambled, could not ask for help.

Source: Cressey (1950), p. 743.

Opportunity, in the terms of Meeting A

Benson and Simpson describe white-collar crime as depending on three properties of the situation: specialized access to the target through a legitimate role, superficial legitimacy, meaning the offense looks like ordinary business while it is happening, and spatial separation from the victim, so that no one is present to object. Benson, Madensen, and Eck (2009) apply the same logic through routine activity theory: a motivated offender, a suitable target, and the absence of a capable guardian. Match each property to the case that illustrates it most cleanly.

Every case had all three. That is what a position of financial trust is: a role that provides access, a set of routine transactions that any theft can be dressed as, and a victim, whether a company, a church, a school, or a government office, that is not standing at the counter. The opportunity perspective's argument is that because these properties are features of positions rather than of people, they can be redesigned. The pressure and the rationalization live in a person you cannot see. The second signature, the outside auditor, and the bank statement that someone other than the bookkeeper opens are things an organization can put in place tomorrow. Two of the six cases on this page ended because an outside auditor looked. None ended because someone noticed a non-shareable problem.

Sources: Benson, M. L., and Simpson, S. S. (2015). Understanding White-Collar Crime: An Opportunity Perspective (2nd ed.), ch. 4. Benson, M. L., Madensen, T. D., and Eck, J. E. (2009). White-collar crime from an opportunity perspective. In S. S. Simpson and D. Weisburd (Eds.), The Criminology of White-Collar Crime (pp. 175-193). Springer.

Lab 3 response sheet

Answer the four questions below in complete sentences. Then use the button at the bottom to assemble your answers and your case calls into one block of text, and paste that text into the Lab 3 submission in D2L before you leave class. Your answers stay on this page and are not sent anywhere until you paste them.

Your name

1. Pick one of the six cases. Say what the record gives you for each of Cressey's three elements, and what you had to infer. Then say whether the triangle explained the case or only sorted its facts into three boxes.

Four to six sentences. Name the case.

2. The base rate problem. Eighty-seven percent of ACFE perpetrators had no prior record, and the common red flags describe many people who never steal. Given that, what is the triangle good for? Answer with reference to the one side an organization can observe and change.

Three to five sentences.

3. Kassem and Higson add capability, integrity, and the four MICE motives. Take one addition and one case, and say whether the addition tells you something the original triangle did not. Be specific about what in the record supports it.